feat(web): /skill slash command with autocomplete

Trigger /<name>, dropdown lists all skills filtered by name prefix,
arg passthrough sends the rest as the user message. Synthetic
skill_use tool_use renders identically to model-invoked skills.

.dockerignore

@@ -10,3 +10,13 @@ dist
 .vite
 coverage
 /tmp
+
+# Secrets and runtime data
+secrets/
+data/
+*.pem
+*.key
+id_rsa*
+id_ed25519*
+known_hosts
+.ssh/

.env.example

@@ -3,5 +3,6 @@ PORT=3000
 DATABASE_URL=postgres://boocode:CHANGE_ME@boocode_db:5432/boocode
 LLAMA_SWAP_URL=http://100.101.41.16:8401
 PROJECT_ROOT_WHITELIST=/opt
+BOOTSTRAP_ROOT=/opt/projects
 DEFAULT_MODEL=qwen3.6-35b-a3b-mxfp4
 POSTGRES_PASSWORD=CHANGE_ME

.gitignore

@@ -5,3 +5,5 @@ dist
 .DS_Store
 .vite
 coverage
+secrets/
+data/

AGENTS.md

@@ -0,0 +1,191 @@
+# Agents
+
+## Code Reviewer
+---
+temperature: 0.3
+description: Reviews code for bugs, security issues, and maintainability. Read-only.
+---
+You review code. Find real problems, not style nits.
+
+Process:
+1. Read the file(s) in question with view_file. If a diff is provided, read surrounding context too.
+2. Use grep/find_files to check how changed symbols are used elsewhere.
+3. Cite every finding as file:line.
+
+Prioritize in order:
+1. Bugs and logic errors
+2. Security issues (injection, auth bypass, secret leakage, unsafe deserialization, SSRF, path traversal)
+3. Race conditions, error handling, resource leaks
+4. Performance issues with measurable impact
+5. Maintainability (only if it blocks future work)
+
+Skip: formatting, naming preferences, "consider extracting", "add a comment here". The user has a linter.
+
+Output format:
+- Critical: <file:line> — <issue> — <fix>
+- Major: <file:line> — <issue> — <fix>
+- Minor: <file:line> — <issue> — <fix>
+
+If nothing critical or major, say so in one line. Do not pad.
+
+
+## Debugger
+---
+temperature: 0.2
+description: Diagnoses bugs from error messages, logs, or described symptoms.
+---
+You diagnose bugs. Form a hypothesis, prove it with evidence from the code.
+
+Process:
+1. Restate the symptom in one line. Confirm you understand it.
+2. Read the error/stacktrace. Identify the exact frame where things go wrong.
+3. view_file on that frame. Read 50 lines around it.
+4. grep for callers, related state, recent changes that could explain it.
+5. State the root cause with file:line evidence.
+6. Propose the minimal fix. Note any side effects.
+
+Rules:
+- Never guess. If evidence is missing, say what you need (specific log line, specific file, specific repro step).
+- Distinguish symptom from cause. A null check fixes the symptom; missing init causes it.
+- Off-by-one, race conditions, and silent except blocks are common — check for them.
+- If two plausible causes exist, name both and say what would discriminate.
+
+Output:
+- Symptom: <one line>
+- Root cause: <file:line> — <explanation>
+- Fix: <minimal diff or description>
+- Risk: <what could break>
+
+
+## Refactorer
+---
+temperature: 0.3
+description: Proposes refactors for clarity, deduplication, or decoupling. Read-only — outputs plans, not edits.
+---
+You propose refactors. You do not apply them. The user applies via OpenCode or Claude Code.
+
+Process:
+1. Read the target file(s).
+2. grep for callers, duplicates, and similar patterns elsewhere in the repo.
+3. Identify the smallest refactor that delivers the goal.
+
+Prioritize:
+1. Deduplication where 3+ sites have near-identical logic
+2. Extracting a function/module when one is doing two unrelated jobs
+3. Decoupling when a change in A forces a change in B unnecessarily
+4. Renaming when a name actively misleads
+
+Reject:
+- Refactors that touch 10+ files for marginal gain
+- "Modernization" with no concrete benefit
+- Abstraction for future flexibility that may never come
+- Style-only changes
+
+Output:
+- Goal: <one line>
+- Scope: <files affected, count of lines roughly>
+- Plan: numbered steps, each one self-contained
+- Risk: <what tests must pass, what could regress>
+- Skip if: <conditions under which this refactor is not worth doing>
+
+
+## Architect
+---
+temperature: 0.5
+description: Designs new features, modules, or architectural changes. Outputs a build plan.
+---
+You design. You produce build plans, not code.
+
+Process:
+1. Restate the goal in your own words. Confirm constraints (perf, deploy, deps).
+2. list_dir the relevant areas. Read existing patterns — match them unless there's a reason not to.
+3. Decide: extend existing code or add new module. Justify.
+4. Sketch the data flow: inputs → transforms → outputs → side effects.
+5. Identify integration points: DB schema, API surface, env vars, container boundaries.
+6. List failure modes and how the design handles them.
+
+Rules:
+- Reuse before inventing. If a service/lib in the repo already does this, say so.
+- Prefer boring tech. New deps require justification.
+- Tailscale IPs for internal routing. No 0.0.0.0 binds.
+- Least privilege: separate read/write paths, explicit auth gates.
+- State assumptions inline. Do not ask clarifying questions mid-design unless blocked.
+
+Output:
+- Goal
+- Existing code to reuse: <file paths>
+- New code: <file paths, one-line purpose each>
+- Data model changes: <SQL or schema diff>
+- API surface: <endpoints, request/response shapes>
+- Failure modes: <list>
+- Build order: numbered, each step 30-90 min
+
+
+## Security Auditor
+---
+temperature: 0.2
+description: Audits code for security vulnerabilities. Read-only.
+---
+You audit for security issues. Concrete findings only, no generic warnings.
+
+Process:
+1. Identify the trust boundary: where does untrusted input enter? Where does it leave?
+2. Trace input flow with grep. Mark every transformation.
+3. Check each finding against a real attack scenario.
+
+Look for:
+- Injection: SQL (raw queries, string concat into queries), command (subprocess with shell=True, unescaped args), XSS (unescaped output in HTML/JSX), template injection, NoSQL injection
+- AuthN/AuthZ: missing checks on routes, IDOR (user-supplied IDs without ownership check), JWT misuse (alg=none, weak secret, no expiry), session fixation
+- Secrets: hardcoded keys/passwords, .env in repo, secrets in logs, secrets in error messages
+- Crypto: weak hashes (MD5, SHA1 for passwords), missing salt, predictable randomness (Math.random for tokens), ECB mode, custom crypto
+- Network: SSRF (user URL → server fetch), open CORS, missing CSRF on state-changing requests, plaintext over public network
+- File: path traversal, unrestricted upload type/size, zip slip
+- Deserialization: pickle, yaml.load, eval, exec on user input
+- Resource: missing rate limits on auth/expensive endpoints, unbounded query results
+
+For each finding:
+- Severity: Critical / High / Medium / Low
+- Location: file:line
+- Attack scenario: one sentence describing how an attacker exploits this
+- Fix: minimal change
+
+Skip:
+- Generic "use HTTPS" advice
+- "Consider adding rate limiting" without a specific endpoint
+- CVE-of-the-week scares without proof the code is affected
+
+If the code is clean, say so. Do not invent findings.
+
+
+## Prompt Builder
+---
+temperature: 0.4
+description: Builds prompts for OpenCode, Claude Code, or BooCode dispatch.
+---
+You write prompts that another coding agent will execute. Your output is the prompt, not the work.
+
+Process:
+1. Ask the user (or read context) for: goal, target repo, target files if known, constraints.
+2. list_dir and view_file the target area. Confirm files exist and are roughly the shape you think.
+3. Identify imports, exports, and conventions in the repo (component layout, error handling style, test framework).
+4. Write the prompt.
+
+Prompt structure:
+- One-line goal at the top
+- Constraints block: don't commit, don't push, don't pull. Use `#careful` and `#nofluff` style hashtags if the target agent honors them
+- Pre-flight: list_dir or grep commands the agent must run before writing (e.g. "run: ls frontend/src/components/ui/ and only import primitives that exist")
+- Files to modify: explicit paths
+- Files to create: explicit paths with one-line purpose
+- Behavior spec: numbered, testable
+- Backup rule: `cp file file.bak-$(date +%Y%m%d)` before any destructive edit
+- Verification: `py_compile`, `tsc --noEmit`, `docker compose up --build -d` — whichever applies
+- Stop conditions: when to halt and report instead of pressing on
+
+Rules:
+- Tailored to the target agent: OpenCode honors hashtag snippets and skills; Claude Code honors CLAUDE.md and slash commands; BooCode batches are written as user-facing markdown
+- Never include credentials or secrets
+- Never instruct the agent to commit or push
+- Include the exact model the user wants if dispatch is via Paseo or BooCode batch
+- For BooLab frontend prompts, always include the "verify shadcn primitives exist" preflight
+
+Output: the prompt, ready to paste. Nothing else.

CLAUDE.md

@@ -0,0 +1,111 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What is BooCode
+
+Self-hosted single-user developer chat app. AI assistant with read-only file tools (view_file, list_dir, grep, find_files) running against a local llama-swap inference server. Sessions organized by project, with a multi-pane workspace (chat + file browser side by side).
+
+## Commands
+
+```bash
+# Development (run in separate terminals)
+pnpm dev:server          # tsx watch, port 3000
+pnpm dev:web             # Vite dev server, port 5173 (proxies /api to :3000)
+
+# Build
+pnpm build               # builds web then server
+pnpm -C apps/server build  # server only (tsc + copy schema.sql)
+pnpm -C apps/web build     # web only (vite)
+
+# Type checking (no emit)
+npx tsc --noEmit                              # project references (root)
+npx tsc -p apps/web/tsconfig.app.json --noEmit  # web app specifically
+
+# IMPORTANT: root tsc --noEmit uses project references and can miss errors
+# that the per-app tsconfig catches. Always verify with the per-app command
+# when editing web code. The server build (pnpm -C apps/server build) is
+# authoritative for server code.
+
+# Production
+docker compose build --no-cache boocode && docker compose up -d
+```
+
+Tests: `pnpm -C apps/server test` runs 23 vitest tests. No test harness on `apps/web` (adding it requires installing vitest as a new devDep). Vitest pinned to `^3` because Vite 5 / vitest 4 are incompatible. No linters configured.
+
+## Architecture
+
+**Monorepo**: pnpm workspaces with `apps/server` (Fastify + postgres) and `apps/web` (React + Vite).
+
+### Server (`apps/server/src/`)
+
+- **Fastify** with `@fastify/websocket` and `@fastify/static` (serves built frontend)
+- **postgres** (porsager/postgres) with tagged-template SQL — no ORM. Schema in `schema.sql`, applied on startup. LSP may false-positive on `sql<Type[]>\`...\`` generics; CLI `tsc` / `pnpm build` is authoritative.
+- **Zod** for request validation and config parsing.
+
+Key services:
+- **`services/inference.ts`** — Streams LLM responses, executes tool loops (max depth 15, see `MAX_TOOL_LOOP_DEPTH`), flushes to DB every 500ms. Publishes `InferenceFrame` events through the broker.
+- **`services/broker.ts`** — In-memory pub/sub with two channel types: per-session (message streaming) and per-user (sidebar updates). No persistence; clients reconnect on restart.
+- **`services/tools.ts`** — Four read-only file tools exposed as OpenAI function-calling schemas. All file access goes through `path_guard.ts` which resolves against project root.
+- **`services/file_ops.ts`** — Shared file operation implementations used by both inference tools and HTTP routes.
+- **`services/auto_name.ts`** — Non-streaming LLM call to generate 4-word session titles after first assistant reply.
+
+Route registration: all routes registered in `index.ts` via `register*Routes(app, sql, ...)` functions. Routes are in `routes/*.ts`.
+
+### Frontend (`apps/web/src/`)
+
+- **React 18** + React Router v6 + **Tailwind v4** + shadcn/radix-ui primitives.
+- **Shiki** for syntax highlighting (async `codeToHtml` in `CodeBlock.tsx` and `FileViewer` in `FileBrowserPane.tsx`).
+- Path alias: `@/` maps to `src/`.
+- **Mobile interaction primitives** (post-v1.6): `useViewport` (matchMedia, breakpoints mobile <768 / tablet 768–1023 / desktop ≥1024), `useSidebarDrawer` / `useRightRailDrawer` (Context + auto-close on `useLocation().pathname` change), `useLongPress` (500ms timer, dispatches synthetic `contextmenu` on `[data-tab-id]`), `usePullToRefresh` (80px threshold, 600ms hold), `SwipeablePaneTab` (60px close, 30px vertical bail). Tap-target convention: `max-md:min-h-[44px] max-md:min-w-[44px]`. Mobile headers: `border-b px-3 sm:px-4 py-2` + `style={{ paddingTop: 'max(0.5rem, env(safe-area-inset-top))' }}`. Hamburger left, FolderTree right.
+
+Key patterns:
+- **`hooks/sessionEvents.ts`** — Module-singleton event bus (Set of listeners). Used for cross-component communication: session renames, file-open events, attachment dispatch. 9 event types in the discriminated union. When adding a new event type to the `SessionEvent` union, you must also add a case to the `applyEvent` switch in `useSidebar.ts` (even if it's a no-op `return prev`).
+- **`hooks/useSessionStream.ts`** — WebSocket per session, `applyFrame` reducer builds message list from streaming frames.
+- **`hooks/useUserEvents.ts`** — Single app-level WS to `/api/ws/user` with exponential backoff reconnect. Forwards frames onto the sessionEvents bus.
+- **`hooks/useSidebar.ts`** — Module-singleton with Set<setState> subscriber pattern; one bus subscription guarded by `globalThis.__boocode_sidebar_subscribed` for HMR safety. Every new `SessionEvent` type needs a `case` in the `applyEvent` switch (no-op `return prev` is fine).
+- **`api/client.ts`** — Centralized typed fetch wrapper. All endpoints under `api.*` namespace.
+
+### Data flow for chat
+
+1. User sends message → POST `/api/sessions/:id/messages` creates user + assistant (status=streaming) rows
+2. `inference.enqueue()` starts async streaming loop
+3. LLM deltas published via `broker.publish(sessionId, frame)`
+4. Client's `useSessionStream` WS receives frames, `applyFrame` reducer updates message list
+5. Tool calls: inference executes tools server-side, publishes tool_call/tool_result frames, loops back to LLM
+6. Terminal states (complete/error): DB updated with final content + token counts, `session_updated` frame published on user channel
+
+### Multi-pane workspace
+
+Sessions hold 1–5 panes (chat / empty / placeholder terminal+agent). Workspace pane state is **client-side only** (localStorage key `boocode.workspace.panes.<sessionId>`); the legacy `session_panes` table and its REST endpoints are deprecated — no `/api/panes/*` routes exist. Each chat lives in at most one pane; tab strip is per-pane and tracks `chatIds[]` + `activeChatIdx`. Sessions 1:N chats; chats own messages. Tab reorder via native HTML5 drag events.
+
+## Database
+
+PostgreSQL 16. Tables: `projects`, `sessions`, `chats`, `messages`, `settings`, `session_panes` (deprecated). Schema applied idempotently on startup via `applySchema()`. Use `clock_timestamp()` (not `NOW()`) inside transactions. CHECK constraints in place: `projects_status_chk` ('open'|'archived'), `sessions_status_chk` (same), `chats_status_chk` (same), `messages_role_chk`, `messages_status_chk` — keep in sync with the `*_STATUSES` const arrays in `apps/server/src/types/api.ts`.
+
+Schema CHECK migration order when renaming allowed values: (1) `ALTER TABLE ... DROP CONSTRAINT IF EXISTS <system_name>` (inline `CREATE TABLE` checks get `<table>_<column>_check`), (2) `UPDATE` rows to new values, (3) wrap new constraint ADD in `DO $$ ... pg_constraint` guard — that block is the only way to get `ADD CONSTRAINT IF NOT EXISTS`.
+
+Position-shift pattern for panes (legacy `session_panes` table): negate-and-restore to avoid UNIQUE(session_id, position) collisions during reorder/insert/delete. Sentinel value -100 for the moving pane.
+
+## Environment
+
+Required: `DATABASE_URL`, `LLAMA_SWAP_URL`. Optional: `PORT` (3000), `HOST` (0.0.0.0), `PROJECT_ROOT_WHITELIST` (/opt, read-only scope for add-existing path resolution), `BOOTSTRAP_ROOT` (/opt/projects, writable scope for create-new-project bootstrap mkdir target — host must `mkdir -p /opt/projects` before container start), `DEFAULT_MODEL`, `LOG_LEVEL`.
+
+## Workflow
+
+- Sam reviews all diffs and commits manually. Do not commit unless explicitly asked.
+- Deploy: `cd /opt/boocode && docker compose up --build -d` (or `docker compose build --no-cache boocode && docker compose up -d` if you suspect a layer-cache issue).
+- Git push to Gitea: `GIT_SSH_COMMAND="ssh -i /opt/boocode/secrets/boocode_gitea -o IdentitiesOnly=yes" git push origin <branch>`. The default agent identity is rejected; the in-repo deploy key (`secrets/`, gitignored) is the working one. Transient `Connection reset by peer` retries cleanly after `sleep 5`.
+- Don't accumulate `.bak-*` files. Clean them up in the same batch or immediately after merge.
+- Fastify global JSON parser tolerates empty bodies (overridden in `index.ts`); bodyless POSTs (archive, unarchive, stop) work without setting `Content-Type` tricks on the client.
+- Event dedup discipline: for any mutation the server publishes via `broker.publishUser`, do NOT add a local `sessionEvents.emit(...)` after the API call — `useUserEvents` forwards the WS frame onto the bus. Frontend mutation handlers must be idempotent (dedup by id, no-op on already-present).
+
+## Conventions
+
+- `overflowWrap` not `wordWrap` — TypeScript's CSSStyleDeclaration marks `wordWrap` as deprecated (error 6385).
+- No app-layer auth. Authelia handles auth at the reverse proxy. All `broker.publishUser`/`subscribeUser` calls use `'default'` as the user key.
+- TypeScript strict mode. Both apps share `tsconfig.base.json`.
+- Server uses NodeNext module resolution (`.js` extensions in imports).
+- Discriminated unions for type narrowing: `Pane` (by `kind`), `SessionEvent` (by `type`), `InferenceFrame` (by `type`).
+- shadcn primitives live in `components/ui/`. Don't modify them unless adding a new primitive.
+- `inferLanguage()` from `lib/attachments.ts` is the canonical file-extension-to-language map. `CodeBlock.tsx` keeps its own `LANG_MAP` because it also resolves markdown fence names.

Dockerfile

@@ -19,7 +19,8 @@ RUN pnpm deploy --filter=@boocode/server --prod --legacy /out/server
 
 
 FROM node:20-alpine AS runtime
-RUN apk add --no-cache ripgrep
+RUN apk add --no-cache ripgrep git openssh-client
+RUN mkdir -p /root/.ssh && ssh-keyscan -p 2222 -H 100.114.205.53 git.indifferentketchup.com >> /root/.ssh/known_hosts && chmod 700 /root/.ssh && chmod 600 /root/.ssh/known_hosts
 WORKDIR /app
 
 COPY --from=builder /out/server ./

apps/server/package.json

@@ -7,7 +7,8 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsc && node -e \"import('node:fs').then(fs=>fs.copyFileSync('src/schema.sql','dist/schema.sql'))\"",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@fastify/static": "^7.0.4",
@@ -21,6 +22,7 @@
     "@types/node": "^20.14.10",
     "@types/ws": "^8.5.10",
     "tsx": "^4.16.2",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "vitest": "^3.2.4"
   }
 }

apps/server/src/auth.ts

@@ -1,31 +0,0 @@
-import type { FastifyInstance, FastifyRequest } from 'fastify';
-
-declare module 'fastify' {
-  interface FastifyRequest {
-    user?: string;
-  }
-}
-
-const PUBLIC_PATHS = new Set<string>(['/api/health']);
-
-export function registerAuth(app: FastifyInstance): void {
-  app.addHook('onRequest', async (req, reply) => {
-    if (!req.url.startsWith('/api')) return;
-    if (PUBLIC_PATHS.has(req.routeOptions.url ?? req.url.split('?')[0]!)) return;
-
-    const header = req.headers['remote-user'];
-    const user = Array.isArray(header) ? header[0] : header;
-    if (!user || user.trim() === '') {
-      reply.code(401).send({ error: 'unauthenticated' });
-      return reply;
-    }
-    req.user = user.trim();
-  });
-}
-
-export function requireUser(req: FastifyRequest): string {
-  if (!req.user) {
-    throw new Error('user not set on request — auth hook must run first');
-  }
-  return req.user;
-}

apps/server/src/config.ts

@@ -7,8 +7,13 @@ const ConfigSchema = z.object({
   DATABASE_URL: z.string().url(),
   LLAMA_SWAP_URL: z.string().url(),
   PROJECT_ROOT_WHITELIST: z.string().default('/opt'),
+  BOOTSTRAP_ROOT: z.string().default('/opt/projects'),
   DEFAULT_MODEL: z.string().default('qwen3.6-35b-a3b-mxfp4'),
   LOG_LEVEL: z.string().default('info'),
+  GITEA_BASE_URL: z.string().url().default('https://git.indifferentketchup.com'),
+  GITEA_USER: z.string().default('indifferentketchup'),
+  GITEA_TOKEN: z.string().optional(),
+  GITEA_SSH_HOST: z.string().default('100.114.205.53:2222'),
 });
 
 export type Config = z.infer<typeof ConfigSchema>;

apps/server/src/index.ts

@@ -5,17 +5,20 @@ import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from './config.js';
 import { getSql, applySchema, pingDb, closeDb } from './db.js';
-import { registerAuth } from './auth.js';
+
 import { registerProjectRoutes } from './routes/projects.js';
 import { registerSessionRoutes } from './routes/sessions.js';
 import { registerSettingsRoutes } from './routes/settings.js';
 import { registerMessageRoutes } from './routes/messages.js';
+import { registerChatRoutes } from './routes/chats.js';
 import { registerSidebarRoutes } from './routes/sidebar.js';
 import { registerWebSocket } from './routes/ws.js';
 import { registerModelRoutes } from './routes/models.js';
-import { registerPaneRoutes } from './routes/panes.js';
+import { registerAgentRoutes } from './routes/agents.js';
+import { registerSkillsRoutes } from './routes/skills.js';
 import { createInferenceRunner } from './services/inference.js';
 import { createBroker } from './services/broker.js';
+import { listSkills } from './services/skills.js';
 
 async function main() {
   const config = loadConfig();
@@ -24,14 +27,28 @@ async function main() {
     logger: { level: config.LOG_LEVEL },
   });
 
+  // Allow empty JSON bodies on POSTs that don't take a body (archive, unarchive, stop, etc.).
+  // Default Fastify parser throws FST_ERR_CTP_EMPTY_JSON_BODY on empty string.
+  app.removeContentTypeParser(['application/json']);
+  app.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => {
+    const str = (body as string) ?? '';
+    if (str.trim().length === 0) {
+      done(null, {});
+      return;
+    }
+    try {
+      done(null, JSON.parse(str));
+    } catch (err) {
+      done(err as Error, undefined);
+    }
+  });
+
   const sql = getSql(config);
   await applySchema(sql);
   app.log.info('database schema applied');
 
   await app.register(fastifyWebsocket);
 
-  registerAuth(app);
-
   app.get('/api/health', async () => {
     const dbOk = await pingDb(sql);
     return { status: dbOk ? 'ok' : 'degraded', db: dbOk };
@@ -43,8 +60,18 @@ async function main() {
   registerSessionRoutes(app, sql, config, broker);
   registerSettingsRoutes(app, sql);
   registerModelRoutes(app, config);
+  registerAgentRoutes(app, sql);
   registerSidebarRoutes(app, sql);
-  registerPaneRoutes(app, sql);
+  registerChatRoutes(app, sql, broker);
+
+  // Batch 9.6: warm the skills cache at boot and surface the count. Empty or
+  // missing /data/skills is non-fatal — the skill tools just return empty.
+  try {
+    const skills = await listSkills();
+    app.log.info(`skills loaded: ${skills.length}`);
+  } catch (err) {
+    app.log.warn({ err }, 'skills boot walk failed');
+  }
 
   const inference = createInferenceRunner(
     {
@@ -60,32 +87,70 @@ async function main() {
     }
   );
   registerMessageRoutes(app, sql, {
-    enqueueInference: (sessionId, assistantId, user) => {
-      inference.enqueue(sessionId, assistantId, user);
+    enqueueInference: (sessionId, chatId, assistantId, user) => {
+      inference.enqueue(sessionId, chatId, assistantId, user);
     },
-    publishUserMessage: (sessionId, userMessageId, content) => {
+    enqueueCompact: (sessionId, chatId, compactId, user) => {
+      inference.enqueueCompact(sessionId, chatId, compactId, user);
+    },
+    cancelInference: async (sessionId, chatId) => {
+      return inference.cancel(sessionId, chatId);
+    },
+    hasActiveInference: (chatId) => inference.hasActive(chatId),
+    publishUserMessage: (sessionId, chatId, userMessageId, content) => {
       broker.publish(sessionId, {
         type: 'message_started',
         message_id: userMessageId,
+        chat_id: chatId,
         role: 'user',
       });
       broker.publish(sessionId, {
         type: 'delta',
         message_id: userMessageId,
+        chat_id: chatId,
         content,
       });
       broker.publish(sessionId, {
         type: 'message_complete',
         message_id: userMessageId,
+        chat_id: chatId,
       });
     },
-    publishMessagesDeleted: (sessionId, messageIds) => {
+    publishMessagesDeleted: (sessionId, chatId, messageIds) => {
       broker.publish(sessionId, {
         type: 'messages_deleted',
         message_ids: messageIds,
+        chat_id: chatId,
       });
     },
   });
+  registerSkillsRoutes(app, sql, {
+    enqueueInference: (sessionId, chatId, assistantId, user) => {
+      inference.enqueue(sessionId, chatId, assistantId, user);
+    },
+    publishUserMessage: (sessionId, chatId, userMessageId, content) => {
+      broker.publish(sessionId, {
+        type: 'message_started',
+        message_id: userMessageId,
+        chat_id: chatId,
+        role: 'user',
+      });
+      broker.publish(sessionId, {
+        type: 'delta',
+        message_id: userMessageId,
+        chat_id: chatId,
+        content,
+      });
+      broker.publish(sessionId, {
+        type: 'message_complete',
+        message_id: userMessageId,
+        chat_id: chatId,
+      });
+    },
+    publishSessionFrame: (sessionId, frame) => {
+      broker.publish(sessionId, frame);
+    },
+  });
   registerWebSocket(app, sql, broker);
 
   const webDist = process.env.WEB_DIST_PATH ?? resolve(process.cwd(), '../web/dist');
@@ -120,6 +185,9 @@ async function main() {
   process.on('SIGINT', () => void shutdown('SIGINT'));
   process.on('SIGTERM', () => void shutdown('SIGTERM'));
 
+  // Bound to 0.0.0.0 intentionally. Public access goes through Caddy → Authelia.
+  // Direct Tailscale access (100.114.205.53:9500) is unauthenticated by design;
+  // the threat model treats Tailnet membership as the trust boundary.
   await app.listen({ port: config.PORT, host: config.HOST });
   app.log.info(`boocode server listening on http://${config.HOST}:${config.PORT}`);
 }

apps/server/src/routes/__tests__/projects.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtemp, mkdir, rm, realpath, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveProjectPath } from '../projects.js';
+
+describe('resolveProjectPath', () => {
+  let scratch: string;
+  let whitelist: string;
+  let outside: string;
+
+  beforeAll(async () => {
+    // mkdtemp returns a real path on most platforms, but symlink-resolve it
+    // anyway to defeat /tmp -> /private/tmp style indirection on macOS, and
+    // keep this stable for the comparisons below.
+    scratch = await realpath(await mkdtemp(join(tmpdir(), 'boocode-projects-test-')));
+    whitelist = join(scratch, 'wl');
+    outside = join(scratch, 'other');
+    await mkdir(whitelist, { recursive: true });
+    await mkdir(outside, { recursive: true });
+  });
+
+  afterAll(async () => {
+    if (scratch) {
+      await rm(scratch, { recursive: true, force: true });
+    }
+  });
+
+  it('returns real path and basename for a valid subdirectory under the whitelist', async () => {
+    const projectDir = join(whitelist, 'my-project');
+    await mkdir(projectDir);
+    const result = await resolveProjectPath(projectDir, whitelist);
+    expect('error' in result).toBe(false);
+    if ('error' in result) return; // narrow
+    expect(result.real).toBe(projectDir);
+    expect(result.name).toBe('my-project');
+  });
+
+  it('rejects a path outside the whitelist', async () => {
+    const projectDir = join(outside, 'foo');
+    await mkdir(projectDir);
+    const result = await resolveProjectPath(projectDir, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects relative paths', async () => {
+    const result = await resolveProjectPath('relative/path', whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('absolute');
+  });
+
+  it('rejects nonexistent paths', async () => {
+    const result = await resolveProjectPath('/nonexistent/foo-boocode-test', whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('does not exist');
+  });
+
+  it('rejects symlink escapes (realpath resolution catches traversal)', async () => {
+    // Create a symlink INSIDE the whitelist that points OUTSIDE. realpath
+    // should resolve through it and the resulting real path should fail the
+    // whitelist scope check.
+    const escapeLink = join(whitelist, 'escape-link');
+    await symlink(outside, escapeLink);
+    const result = await resolveProjectPath(escapeLink, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects the whitelist directory itself as a project root', async () => {
+    // A project's parent can't be the project. The scope check must require
+    // the candidate path to be strictly below the whitelist (whitelist + sep
+    // prefix), not just equal to it.
+    const result = await resolveProjectPath(whitelist, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects non-directory targets (file under whitelist)', async () => {
+    const filePath = join(whitelist, 'a-file.txt');
+    await writeFile(filePath, 'content', 'utf8');
+    const result = await resolveProjectPath(filePath, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('not a directory');
+  });
+});

apps/server/src/routes/agents.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from 'fastify';
+import type { Sql } from '../db.js';
+import { getAgentsForProject } from '../services/agents.js';
+
+export function registerAgentRoutes(app: FastifyInstance, sql: Sql): void {
+  app.get<{ Params: { id: string } }>(
+    '/api/projects/:id/agents',
+    async (req, reply) => {
+      const rows = await sql<{ path: string }[]>`
+        SELECT path FROM projects WHERE id = ${req.params.id}
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'project not found' };
+      }
+      // getAgentsForProject handles AGENTS.md presence/parse/cache; never throws.
+      return await getAgentsForProject(rows[0]!.path);
+    }
+  );
+}

apps/server/src/routes/chats.ts

@@ -0,0 +1,327 @@
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import type { Sql } from '../db.js';
+import type { Broker } from '../services/broker.js';
+import type { Chat, Message } from '../types/api.js';
+
+const CreateBody = z.object({
+  name: z.string().min(1).max(200).optional(),
+});
+
+const PatchBody = z.object({
+  name: z.string().min(1).max(200),
+});
+
+const ForkBody = z.object({
+  message_id: z.string().uuid(),
+  name: z.string().min(1).max(200).optional(),
+});
+
+export function registerChatRoutes(
+  app: FastifyInstance,
+  sql: Sql,
+  broker: Broker
+): void {
+  app.get<{ Params: { id: string }; Querystring: { status?: string } }>(
+    '/api/sessions/:id/chats',
+    async (req, reply) => {
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const status = req.query.status === 'archived' ? 'archived' : 'open';
+      // Enriched list: computed per-chat fields via LATERAL joins.
+      const rows = await sql<Chat[]>`
+        SELECT
+          c.id, c.session_id, c.name, c.status, c.created_at, c.updated_at,
+          COALESCE(mc.cnt, 0)::int AS message_count,
+          lp.preview AS last_message_preview,
+          ec.tokens AS effective_context_tokens
+        FROM chats c
+        LEFT JOIN LATERAL (
+          SELECT COUNT(*) AS cnt FROM messages WHERE chat_id = c.id
+        ) mc ON TRUE
+        LEFT JOIN LATERAL (
+          SELECT LEFT(BTRIM(REGEXP_REPLACE(content, E'[\\n\\r]+', ' ', 'g')), 80) AS preview
+          FROM messages
+          WHERE chat_id = c.id AND kind = 'message' AND content <> ''
+          ORDER BY created_at DESC
+          LIMIT 1
+        ) lp ON TRUE
+        LEFT JOIN LATERAL (
+          SELECT ctx_used AS tokens
+          FROM messages
+          WHERE chat_id = c.id AND kind = 'message' AND role = 'assistant'
+            AND status = 'complete' AND ctx_used IS NOT NULL
+          ORDER BY created_at DESC
+          LIMIT 1
+        ) ec ON TRUE
+        WHERE c.session_id = ${req.params.id} AND c.status = ${status}
+        ORDER BY c.updated_at DESC
+      `;
+      return rows;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/chats',
+    async (req, reply) => {
+      const parsed = CreateBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const [chat] = await sql<Chat[]>`
+        INSERT INTO chats (session_id, name, status)
+        VALUES (${req.params.id}, ${parsed.data.name ?? null}, 'open')
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      broker.publishUser('default', {
+        type: 'chat_created',
+        chat: chat!,
+        session_id: req.params.id,
+      });
+      reply.code(201);
+      return chat;
+    }
+  );
+
+  app.patch<{ Params: { id: string } }>(
+    '/api/chats/:id',
+    async (req, reply) => {
+      const parsed = PatchBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+      const rows = await sql<Chat[]>`
+        UPDATE chats
+        SET name = ${parsed.data.name},
+            updated_at = clock_timestamp()
+        WHERE id = ${req.params.id}
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = rows[0]!;
+      broker.publishUser('default', {
+        type: 'chat_updated',
+        chat_id: chat.id,
+        session_id: chat.session_id,
+        name: chat.name,
+        updated_at: chat.updated_at,
+      });
+      return chat;
+    }
+  );
+
+  // v1.9: bulk-archive every open chat in a session. Mirrors the single
+  // /chats/:id/archive shape — N chat_archived frames published, useSidebar
+  // reducer handles each via the existing case.
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/chats/archive-all',
+    async (req, reply) => {
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const rows = await sql<{ id: string }[]>`
+        UPDATE chats
+           SET status = 'archived', updated_at = clock_timestamp()
+         WHERE session_id = ${req.params.id} AND status = 'open'
+         RETURNING id
+      `;
+      const ids = rows.map((r) => r.id);
+      for (const id of ids) {
+        broker.publishUser('default', {
+          type: 'chat_archived',
+          chat_id: id,
+          session_id: req.params.id,
+        });
+      }
+      return { archived: ids.length, ids };
+    }
+  );
+
+  // v1.9: count helper for the confirm dialog.
+  app.get<{ Params: { id: string } }>(
+    '/api/sessions/:id/chats/open-count',
+    async (req, reply) => {
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const rows = await sql<{ count: number }[]>`
+        SELECT COUNT(*)::int AS count
+          FROM chats
+         WHERE session_id = ${req.params.id} AND status = 'open'
+      `;
+      return { count: rows[0]?.count ?? 0 };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/archive',
+    async (req, reply) => {
+      const rows = await sql<{ id: string; session_id: string }[]>`
+        UPDATE chats SET status = 'archived', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'open'
+        RETURNING id, session_id
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found or already archived' };
+      }
+      const row = rows[0]!;
+      broker.publishUser('default', {
+        type: 'chat_archived',
+        chat_id: row.id,
+        session_id: row.session_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/unarchive',
+    async (req, reply) => {
+      const rows = await sql<Chat[]>`
+        UPDATE chats SET status = 'open', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'archived'
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found or not archived' };
+      }
+      const chat = rows[0]!;
+      broker.publishUser('default', { type: 'chat_unarchived', chat });
+      return chat;
+    }
+  );
+
+  app.delete<{ Params: { id: string } }>(
+    '/api/chats/:id',
+    async (req, reply) => {
+      const result = await sql<{ id: string; session_id: string }[]>`
+        DELETE FROM chats WHERE id = ${req.params.id}
+        RETURNING id, session_id
+      `;
+      if (result.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const row = result[0]!;
+      broker.publishUser('default', {
+        type: 'chat_deleted',
+        chat_id: row.id,
+        session_id: row.session_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/fork',
+    async (req, reply) => {
+      const parsed = ForkBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+
+      const sourceRows = await sql<Chat[]>`
+        SELECT id, session_id, name, status, created_at, updated_at
+        FROM chats WHERE id = ${req.params.id}
+      `;
+      if (sourceRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const source = sourceRows[0]!;
+
+      const targetRows = await sql<{ created_at: string; status: string }[]>`
+        SELECT created_at, status FROM messages
+        WHERE chat_id = ${source.id} AND id = ${parsed.data.message_id}
+      `;
+      if (targetRows.length === 0) {
+        reply.code(404);
+        return { error: 'message not found in chat' };
+      }
+      const target = targetRows[0]!;
+      if (target.status !== 'complete') {
+        reply.code(400);
+        return { error: 'can only fork from completed messages' };
+      }
+
+      const newName = parsed.data.name ?? `${source.name ?? 'Chat'} (fork)`;
+
+      const newChat = await sql.begin(async (tx) => {
+        const [chat] = await tx<Chat[]>`
+          INSERT INTO chats (session_id, name, status)
+          VALUES (${source.session_id}, ${newName}, 'open')
+          RETURNING id, session_id, name, status, created_at, updated_at
+        `;
+        await tx`
+          INSERT INTO messages (
+            session_id, chat_id, role, content, kind, tool_calls, tool_results,
+            status, tokens_used, ctx_used, ctx_max, started_at, finished_at,
+            created_at, metadata
+          )
+          SELECT
+            ${source.session_id}, ${chat!.id}, role, content, kind,
+            tool_calls, tool_results, status,
+            tokens_used, ctx_used, ctx_max, started_at, finished_at,
+            clock_timestamp() + (
+              ROW_NUMBER() OVER (ORDER BY created_at ASC, id ASC) * INTERVAL '1 microsecond'
+            ),
+            metadata
+          FROM messages
+          WHERE chat_id = ${source.id}
+            AND created_at <= ${target.created_at}::timestamptz
+            AND status = 'complete'
+        `;
+        return chat!;
+      });
+
+      broker.publishUser('default', {
+        type: 'chat_created',
+        chat: newChat,
+        session_id: source.session_id,
+      });
+      reply.code(201);
+      return newChat;
+    }
+  );
+
+  app.get<{ Params: { id: string } }>(
+    '/api/chats/:id/messages',
+    async (req, reply) => {
+      const chat = await sql`SELECT id FROM chats WHERE id = ${req.params.id}`;
+      if (chat.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const rows = await sql<Message[]>`
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
+               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at, metadata
+        FROM messages
+        WHERE chat_id = ${req.params.id}
+        ORDER BY created_at ASC, id ASC
+      `;
+      return rows;
+    }
+  );
+}

apps/server/src/routes/messages.ts

@@ -1,21 +1,31 @@
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import type { Sql } from '../db.js';
-import type { Message, Session } from '../types/api.js';
-import { requireUser } from '../auth.js';
+import type { Chat, Message, Session } from '../types/api.js';
 
 const SendBody = z.object({
   content: z.string().min(1).max(64_000),
 });
 
+// v1.8.2: Continue extends an inference loop that hit the tool budget. Caller
+// passes the sentinel message it's continuing from; server validates shape
+// and the per-chat hard ceiling before resuming.
+const ContinueBody = z.object({
+  sentinel_message_id: z.string().uuid(),
+});
+
 interface MessageHandlers {
-  enqueueInference: (sessionId: string, assistantMessageId: string, user: string) => void;
+  enqueueInference: (sessionId: string, chatId: string, assistantMessageId: string, user: string) => void;
+  enqueueCompact: (sessionId: string, chatId: string, compactMessageId: string, user: string) => void;
   publishUserMessage: (
     sessionId: string,
+    chatId: string,
     userMessageId: string,
     content: string
   ) => void;
-  publishMessagesDeleted: (sessionId: string, messageIds: string[]) => void;
+  publishMessagesDeleted: (sessionId: string, chatId: string, messageIds: string[]) => void;
+  cancelInference: (sessionId: string, chatId: string) => Promise<boolean>;
+  hasActiveInference: (chatId: string) => boolean;
 }
 
 export function registerMessageRoutes(
@@ -32,8 +42,8 @@ export function registerMessageRoutes(
         return { error: 'session not found' };
       }
       const rows = await sql<Message[]>`
-        SELECT id, session_id, role, content, tool_calls, tool_results, status, last_seq,
-               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
+               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at, metadata
         FROM messages
         WHERE session_id = ${req.params.id}
         ORDER BY created_at ASC, id ASC
@@ -43,7 +53,7 @@ export function registerMessageRoutes(
   );
 
   app.post<{ Params: { id: string } }>(
-    '/api/sessions/:id/messages',
+    '/api/chats/:id/messages',
     async (req, reply) => {
       const parsed = SendBody.safeParse(req.body);
       if (!parsed.success) {
@@ -51,33 +61,39 @@ export function registerMessageRoutes(
         return { error: 'invalid body', details: parsed.error.flatten() };
       }
 
-      const session = await sql<Session[]>`SELECT id FROM sessions WHERE id = ${req.params.id}`;
-      if (session.length === 0) {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
         reply.code(404);
-        return { error: 'session not found' };
+        return { error: 'chat not found' };
       }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
 
       const result = await sql.begin(async (tx) => {
         const [userMsg] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${req.params.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
           RETURNING id
         `;
         const [assistantMsg] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${req.params.id}, 'assistant', '', 'streaming', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
           RETURNING id
         `;
-        await tx`UPDATE sessions SET updated_at = NOW() WHERE id = ${req.params.id}`;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
         return { user_message_id: userMsg!.id, assistant_message_id: assistantMsg!.id };
       });
 
       handlers.publishUserMessage(
-        req.params.id,
+        sessionId,
+        chat.id,
         result.user_message_id,
         parsed.data.content
       );
-      handlers.enqueueInference(req.params.id, result.assistant_message_id, requireUser(req));
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
 
       reply.code(202);
       return result;
@@ -85,14 +101,24 @@ export function registerMessageRoutes(
   );
 
   app.post<{ Params: { id: string; message_id: string } }>(
-    '/api/sessions/:id/messages/:message_id/regenerate',
+    '/api/chats/:id/messages/:message_id/regenerate',
     async (req, reply) => {
-      const { id: sessionId, message_id: targetId } = req.params;
+      const { id: chatId, message_id: targetId } = req.params;
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${chatId}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
 
       const target = await sql<{ id: string; role: string; status: string }[]>`
         SELECT id, role, status
         FROM messages
-        WHERE session_id = ${sessionId} AND id = ${targetId}
+        WHERE chat_id = ${chatId} AND id = ${targetId}
       `;
       if (target.length === 0) {
         reply.code(404);
@@ -109,34 +135,258 @@ export function registerMessageRoutes(
       }
 
       const { newAssistantId, deletedIds } = await sql.begin(async (tx) => {
-        // Subquery keeps created_at in postgres at TIMESTAMPTZ µs precision.
-        // Round-tripping through JS Date loses sub-ms precision and can pull
-        // earlier rows (e.g. the triggering user message) into the >= bound.
         const deletedRows = await tx<{ id: string }[]>`
           DELETE FROM messages
-          WHERE session_id = ${sessionId}
+          WHERE chat_id = ${chatId}
             AND created_at >= (
               SELECT created_at FROM messages WHERE id = ${targetId}
             )
           RETURNING id
         `;
         const [row] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${sessionId}, 'assistant', '', 'streaming', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chatId}, 'assistant', '', 'streaming', clock_timestamp())
           RETURNING id
         `;
-        await tx`UPDATE sessions SET updated_at = NOW() WHERE id = ${sessionId}`;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chatId}`;
         return {
           newAssistantId: row!.id,
           deletedIds: deletedRows.map((r) => r.id),
         };
       });
 
-      handlers.publishMessagesDeleted(sessionId, deletedIds);
-      handlers.enqueueInference(sessionId, newAssistantId, requireUser(req));
+      handlers.publishMessagesDeleted(sessionId, chatId, deletedIds);
+      handlers.enqueueInference(sessionId, chatId, newAssistantId, 'default');
 
       reply.code(202);
       return { assistant_message_id: newAssistantId };
     }
   );
+
+  app.delete<{ Params: { id: string; message_id: string } }>(
+    '/api/chats/:id/messages/:message_id',
+    async (req, reply) => {
+      const { id: chatId, message_id: messageId } = req.params;
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${chatId}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+
+      if (handlers.hasActiveInference(chatId)) {
+        reply.code(409);
+        return { error: 'chat is currently streaming; stop it first' };
+      }
+
+      const deletedIds = await sql.begin(async (tx) => {
+        const deletedRows = await tx<{ id: string }[]>`
+          DELETE FROM messages
+          WHERE chat_id = ${chatId}
+            AND created_at >= (
+              SELECT created_at FROM messages
+              WHERE id = ${messageId} AND chat_id = ${chatId}
+            )
+          RETURNING id
+        `;
+        if (deletedRows.length > 0) {
+          await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chatId}`;
+        }
+        return deletedRows.map((r) => r.id);
+      });
+
+      if (deletedIds.length === 0) {
+        reply.code(404);
+        return { error: 'message not found' };
+      }
+
+      handlers.publishMessagesDeleted(chat.session_id, chatId, deletedIds);
+
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/compact',
+    async (req, reply) => {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      const [compactMsg] = await sql<{ id: string }[]>`
+        INSERT INTO messages (session_id, chat_id, role, content, kind, status, created_at)
+        VALUES (${sessionId}, ${chat.id}, 'system', '', 'compact', 'streaming', clock_timestamp())
+        RETURNING id
+      `;
+
+      handlers.enqueueCompact(sessionId, chat.id, compactMsg!.id, 'default');
+
+      reply.code(202);
+      return { compact_message_id: compactMsg!.id };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/stop',
+    async (req, reply) => {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+
+      const cancelled = await handlers.cancelInference(chat.session_id, chat.id);
+      if (!cancelled) {
+        reply.code(409);
+        return { error: 'no active generation to stop' };
+      }
+
+      reply.code(200);
+      return { stopped: true };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/continue',
+    async (req, reply) => {
+      const parsed = ContinueBody.safeParse(req.body);
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      // Cap-hit sentinels are only ever inserted after a turn completes, so
+      // there must not be an active inference at this moment. If there is,
+      // the client is racing the cap-hit summary that just emitted the
+      // sentinel — bail rather than enqueue a parallel run.
+      if (handlers.hasActiveInference(chat.id)) {
+        reply.code(409);
+        return { error: 'chat is currently streaming' };
+      }
+
+      const sentinel = await sql<{ metadata: { kind?: unknown; can_continue?: unknown } | null }[]>`
+        SELECT metadata
+        FROM messages
+        WHERE id = ${parsed.data.sentinel_message_id}
+          AND chat_id = ${chat.id}
+          AND role = 'system'
+      `;
+      if (sentinel.length === 0) {
+        reply.code(404);
+        return { error: 'sentinel not found' };
+      }
+      const meta = sentinel[0]!.metadata;
+      if (!meta || meta.kind !== 'cap_hit') {
+        reply.code(400);
+        return { error: 'message is not a cap-hit sentinel' };
+      }
+      // Server-side hard ceiling check. UI already disables the button when
+      // can_continue is false; defending against a stale tab or a direct
+      // API hit is the only reason this lives on the server too.
+      if (meta.can_continue !== true) {
+        reply.code(409);
+        return { error: 'hard limit reached for this chat' };
+      }
+
+      const result = await sql.begin(async (tx) => {
+        const [assistantMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
+          RETURNING id
+        `;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
+        return { assistant_message_id: assistantMsg!.id };
+      });
+
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
+
+      reply.code(202);
+      return result;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/force_send',
+    async (req, reply) => {
+      const parsed = SendBody.safeParse(req.body);
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      // Await actual cancellation completion (catch block persists state).
+      // 5s timeout guards against llama-swap stalls; if hit, proceed anyway.
+      await Promise.race([
+        handlers.cancelInference(sessionId, chat.id).then(() => undefined),
+        new Promise<void>((_, rej) =>
+          setTimeout(() => rej(new Error('cancel-timeout')), 5000)
+        ),
+      ]).catch((e: Error) => {
+        if (e.message !== 'cancel-timeout') throw e;
+        req.log.warn({ chatId: chat.id }, 'cancel timeout exceeded, proceeding with force-send');
+      });
+
+      const result = await sql.begin(async (tx) => {
+        const [userMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
+          RETURNING id
+        `;
+        const [assistantMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
+          RETURNING id
+        `;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
+        return { user_message_id: userMsg!.id, assistant_message_id: assistantMsg!.id };
+      });
+
+      handlers.publishUserMessage(
+        sessionId,
+        chat.id,
+        result.user_message_id,
+        parsed.data.content
+      );
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
+
+      reply.code(202);
+      return result;
+    }
+  );
 }

apps/server/src/routes/panes.ts

@@ -1,217 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import type { TransactionSql } from 'postgres';
-import type { Sql } from '../db.js';
-import type { Pane, PaneCreateRequest, PaneUpdateRequest } from '../types/api.js';
-
-const VALID_KINDS = new Set(['chat', 'file_browser']);
-const MAX_PANES = 5;
-
-async function movePane(
-  tx: TransactionSql,
-  paneId: string,
-  sid: string,
-  oldPos: number,
-  newPos: number
-): Promise<void> {
-  if (oldPos === newPos) return;
-  // Move target pane to a sentinel well outside the negate range [-MAX_PANES, -1]
-  // so it never collides with negated rows during the shift steps.
-  await tx`UPDATE session_panes SET position = -100 WHERE id = ${paneId}`;
-  if (newPos > oldPos) {
-    await tx`UPDATE session_panes SET position = -position
-              WHERE session_id = ${sid} AND position > ${oldPos} AND position <= ${newPos}`;
-    await tx`UPDATE session_panes SET position = -position - 1
-              WHERE session_id = ${sid} AND position < 0 AND id != ${paneId}`;
-  } else {
-    await tx`UPDATE session_panes SET position = -position - 2
-              WHERE session_id = ${sid} AND position >= ${newPos} AND position < ${oldPos}`;
-    await tx`UPDATE session_panes SET position = -position - 1
-              WHERE session_id = ${sid} AND position < 0 AND id != ${paneId}`;
-  }
-  await tx`UPDATE session_panes SET position = ${newPos} WHERE id = ${paneId}`;
-}
-
-export function registerPaneRoutes(app: FastifyInstance, sql: Sql): void {
-  // GET /api/sessions/:id/panes — list panes ordered by position ASC
-  app.get<{ Params: { id: string } }>(
-    '/api/sessions/:id/panes',
-    async (req, reply) => {
-      const sessionRows = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
-      if (sessionRows.length === 0) {
-        reply.code(404);
-        return { error: 'session not found' };
-      }
-      const panes = await sql<Pane[]>`
-        SELECT id, session_id, position, kind, state, created_at
-        FROM session_panes
-        WHERE session_id = ${req.params.id}
-        ORDER BY position ASC
-      `;
-      return { panes };
-    }
-  );
-
-  // POST /api/sessions/:id/panes — create a new pane
-  app.post<{ Params: { id: string } }>(
-    '/api/sessions/:id/panes',
-    async (req, reply) => {
-      const body = (req.body ?? {}) as PaneCreateRequest;
-      const { kind, position } = body;
-
-      if (!kind || !VALID_KINDS.has(kind)) {
-        reply.code(400);
-        return { error: 'kind must be "chat" or "file_browser"' };
-      }
-
-      const sessionRows = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
-      if (sessionRows.length === 0) {
-        reply.code(404);
-        return { error: 'session not found' };
-      }
-
-      const sid = req.params.id;
-      const state = {};
-
-      let insertError: string | null = null;
-      const inserted = await sql.begin(async (tx) => {
-        const countResult = await tx<{ n: number }[]>`
-          SELECT COUNT(*)::int AS n FROM session_panes WHERE session_id = ${sid}
-        `;
-        const n = countResult[0]!.n;
-        if (n >= MAX_PANES) {
-          throw new Error('MAX_PANES_EXCEEDED');
-        }
-        let insertPos: number;
-        if (position === undefined || position === null) {
-          insertPos = n;
-        } else {
-          if (position < 0 || position > n) {
-            throw new Error('OUT_OF_BOUNDS');
-          }
-          insertPos = position;
-        }
-        await tx`UPDATE session_panes SET position = -position - 1
-                  WHERE session_id = ${sid} AND position >= ${insertPos}`;
-        const [row] = await tx<Pane[]>`
-          INSERT INTO session_panes (session_id, position, kind, state)
-          VALUES (${sid}, ${insertPos}, ${kind}, ${JSON.stringify(state)}::jsonb)
-          RETURNING id, session_id, position, kind, state, created_at
-        `;
-        await tx`UPDATE session_panes SET position = -position
-                  WHERE session_id = ${sid} AND position < 0`;
-        return row;
-      }).catch((err: Error) => {
-        insertError = err.message;
-        return null;
-      });
-
-      if (insertError === 'MAX_PANES_EXCEEDED') {
-        reply.code(400);
-        return { error: `session already has ${MAX_PANES} panes (maximum)` };
-      }
-      if (insertError === 'OUT_OF_BOUNDS') {
-        reply.code(400);
-        return { error: `position out of bounds` };
-      }
-      if (insertError) {
-        reply.code(500);
-        return { error: 'internal error' };
-      }
-
-      reply.code(201);
-      return inserted as Pane;
-    }
-  );
-
-  // PATCH /api/panes/:id — update state and/or position
-  app.patch<{ Params: { id: string } }>(
-    '/api/panes/:id',
-    async (req, reply) => {
-      const body = (req.body ?? {}) as PaneUpdateRequest;
-      const { state, position } = body;
-
-      if (state === undefined && position === undefined) {
-        reply.code(400);
-        return { error: 'must provide at least one of: state, position' };
-      }
-
-      const paneRows = await sql<Pane[]>`
-        SELECT id, session_id, position, kind, state, created_at
-        FROM session_panes WHERE id = ${req.params.id}
-      `;
-      if (paneRows.length === 0) {
-        reply.code(404);
-        return { error: 'pane not found' };
-      }
-      const pane = paneRows[0]!;
-      const sid = pane.session_id;
-      const oldPos = pane.position;
-
-      // Apply position and/or state changes atomically
-      let patchError: string | null = null;
-      await sql.begin(async (tx) => {
-        if (position !== undefined) {
-          const countRows = await tx<{ n: number }[]>`
-            SELECT COUNT(*)::int AS n FROM session_panes WHERE session_id = ${sid}
-          `;
-          const count = countRows[0]?.n ?? 0;
-          if (position < 0 || position >= count) {
-            throw `position must be between 0 and ${count - 1}`;
-          }
-        }
-        if (position !== undefined && position !== oldPos) {
-          await movePane(tx, req.params.id, sid, oldPos, position);
-        }
-        if (state !== undefined) {
-          await tx`
-            UPDATE session_panes SET state = ${JSON.stringify(state)}::jsonb
-            WHERE id = ${req.params.id}
-          `;
-        }
-      }).catch((err: unknown) => {
-        if (typeof err === 'string') {
-          patchError = err;
-        } else {
-          throw err;
-        }
-      });
-
-      if (patchError !== null) {
-        reply.code(400);
-        return { error: patchError };
-      }
-
-      const [updated] = await sql<Pane[]>`
-        SELECT id, session_id, position, kind, state, created_at
-        FROM session_panes WHERE id = ${req.params.id}
-      `;
-      return updated as Pane;
-    }
-  );
-
-  // DELETE /api/panes/:id — delete a pane, shift remaining down
-  app.delete<{ Params: { id: string } }>(
-    '/api/panes/:id',
-    async (req, reply) => {
-      const paneRows = await sql<{ id: string; session_id: string; position: number }[]>`
-        SELECT id, session_id, position FROM session_panes WHERE id = ${req.params.id}
-      `;
-      if (paneRows.length === 0) {
-        reply.code(404);
-        return { error: 'pane not found' };
-      }
-      const { session_id: sid, position: P } = paneRows[0]!;
-
-      await sql.begin(async (tx) => {
-        await tx`DELETE FROM session_panes WHERE id = ${req.params.id}`;
-        await tx`UPDATE session_panes SET position = -position
-                  WHERE session_id = ${sid} AND position > ${P}`;
-        await tx`UPDATE session_panes SET position = -position - 1
-                  WHERE session_id = ${sid} AND position < 0`;
-      });
-
-      reply.code(204);
-      return null;
-    }
-  );
-}

apps/server/src/routes/projects.ts

@@ -6,16 +6,39 @@ import type { Sql } from '../db.js';
 import type { Config } from '../config.js';
 import type { Broker } from '../services/broker.js';
 import type { Project, AvailableProject } from '../types/api.js';
-import { requireUser } from '../auth.js';
 import { resolveProjectRoot, PathScopeError } from '../services/path_guard.js';
 import { listDir, viewFile } from '../services/file_ops.js';
 import { getProjectFiles } from '../services/file_index.js';
+import { getGitMeta } from '../services/git_meta.js';
+import {
+  bootstrapProject,
+  BootstrapNameError,
+  BootstrapCollisionError,
+  BootstrapPathError,
+} from '../services/project_bootstrap.js';
 
 const AddProjectBody = z.object({
   path: z.string().min(1),
   name: z.string().min(1).optional(),
 });
 
+// v1.9: PATCH accepts the new per-project defaults. All fields optional so
+// the existing rename-only callers keep working. Empty string on
+// default_system_prompt is the "no override" sentinel — same convention as
+// sessions.system_prompt.
+const PatchProjectBody = z.object({
+  name: z.string().min(1).max(200).optional(),
+  default_system_prompt: z.string().max(8000).optional(),
+  default_web_search_enabled: z.boolean().optional(),
+});
+
+const CreateProjectBody = z.object({
+  name: z.string().min(1).max(64),
+  commit_message: z.string().min(1).max(200).optional(),
+  visibility: z.enum(['private', 'public']).optional(),
+  create_gitea_remote: z.boolean().optional(),
+});
+
 async function isDir(path: string): Promise<boolean> {
   try {
     const s = await stat(path);
@@ -25,7 +48,7 @@ async function isDir(path: string): Promise<boolean> {
   }
 }
 
-async function resolveProjectPath(
+export async function resolveProjectPath(
   raw: string,
   whitelist: string
 ): Promise<{ real: string; name: string } | { error: string }> {
@@ -37,7 +60,7 @@ async function resolveProjectPath(
     return { error: 'path does not exist' };
   }
   const whitelistReal = await realpath(whitelist);
-  if (real !== whitelistReal && !real.startsWith(whitelistReal + sep)) {
+  if (!real.startsWith(whitelistReal + sep)) {
     return { error: `path must be under ${whitelist}` };
   }
   if (!(await isDir(real))) return { error: 'path is not a directory' };
@@ -50,15 +73,85 @@ export function registerProjectRoutes(
   config: Config,
   broker: Broker
 ): void {
-  app.get('/api/projects', async () => {
+  app.get<{ Querystring: { status?: string } }>('/api/projects', async (req) => {
+    const status = req.query.status === 'archived' ? 'archived' : 'open';
     const rows = await sql<Project[]>`
-      SELECT id, name, path, added_at, last_session_id
+      SELECT id, name, path, added_at, last_session_id, status, gitea_remote,
+             default_system_prompt, default_web_search_enabled
       FROM projects
+      WHERE status = ${status}
       ORDER BY added_at DESC
     `;
     return rows;
   });
 
+  app.post('/api/projects/create', async (req, reply) => {
+    const parsed = CreateProjectBody.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400);
+      return { error: 'invalid body', details: parsed.error.flatten() };
+    }
+    const visibility = parsed.data.visibility ?? 'private';
+    const createRemote = parsed.data.create_gitea_remote ?? true;
+    const commitMessage = parsed.data.commit_message ?? 'Initial commit';
+
+    let bootstrap;
+    try {
+      bootstrap = await bootstrapProject(config, app.log, {
+        name: parsed.data.name,
+        commitMessage,
+        visibility,
+        createGiteaRemote: createRemote,
+      });
+    } catch (err) {
+      if (err instanceof BootstrapNameError) {
+        reply.code(400);
+        return { error: `invalid project name: ${err.message}` };
+      }
+      if (err instanceof BootstrapCollisionError) {
+        reply.code(409);
+        return { error: err.message };
+      }
+      if (err instanceof BootstrapPathError) {
+        reply.code(400);
+        return { error: err.message };
+      }
+      app.log.error({ err }, 'bootstrap failed');
+      reply.code(500);
+      return { error: err instanceof Error ? err.message : 'bootstrap failed' };
+    }
+
+    // Insert into projects table only after bootstrap succeeded.
+    try {
+      const [row] = await sql<Project[]>`
+        INSERT INTO projects (name, path, gitea_remote)
+        VALUES (${parsed.data.name}, ${bootstrap.folder_real_path}, ${bootstrap.gitea_remote_url})
+        RETURNING id, name, path, added_at, last_session_id, status, gitea_remote,
+                  default_system_prompt, default_web_search_enabled
+      `;
+      broker.publishUser('default', { type: 'project_created', project: row as unknown as Project });
+      reply.code(201);
+      return {
+        project: row,
+        bootstrap: {
+          folder_created: bootstrap.folder_created,
+          git_initialized: bootstrap.git_initialized,
+          first_commit: bootstrap.first_commit,
+          gitea_remote_created: bootstrap.gitea_remote_created,
+          gitea_pushed: bootstrap.gitea_pushed,
+          warnings: bootstrap.warnings,
+        },
+      };
+    } catch (err) {
+      app.log.error({ err, folder: bootstrap.folder_real_path }, 'project insert failed after bootstrap');
+      reply.code(500);
+      return {
+        error: 'project created on disk but DB insert failed',
+        folder: bootstrap.folder_real_path,
+      };
+    }
+  });
+
   app.post('/api/projects', async (req, reply) => {
     const parsed = AddProjectBody.safeParse(req.body);
     if (!parsed.success) {
@@ -71,22 +164,121 @@ export function registerProjectRoutes(
       return { error: resolved.error };
     }
     const name = parsed.data.name?.trim() || resolved.name;
-    try {
-      const [row] = await sql<Project[]>`
-        INSERT INTO projects (name, path)
-        VALUES (${name}, ${resolved.real})
-        RETURNING id, name, path, added_at, last_session_id
-      `;
-      broker.publishUser(requireUser(req), { type: 'project_created', project: row as unknown as Project });
-      reply.code(201);
-      return row;
-    } catch (err) {
-      if (err instanceof Error && err.message.includes('duplicate key')) {
-        reply.code(409);
-        return { error: 'project already exists' };
-      }
-      throw err;
+
+    // Pre-check the current row (if any) so we can distinguish three cases:
+    //   - no row            → INSERT fresh, 201, project_created
+    //   - row archived      → ON CONFLICT UPDATE flips to 'open', 200, project_unarchived
+    //   - row already open  → 409 (true duplicate)
+    const existing = await sql<{ status: string }[]>`
+      SELECT status FROM projects WHERE path = ${resolved.real}
+    `;
+    if (existing.length > 0 && existing[0]!.status === 'open') {
+      reply.code(409);
+      return { error: 'project already exists' };
     }
+
+    const [row] = await sql<Project[]>`
+      INSERT INTO projects (name, path)
+      VALUES (${name}, ${resolved.real})
+      ON CONFLICT (path) DO UPDATE SET status = 'open'
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote,
+                default_system_prompt, default_web_search_enabled
+    `;
+
+    if (existing.length === 0) {
+      broker.publishUser('default', { type: 'project_created', project: row as unknown as Project });
+      reply.code(201);
+    } else {
+      // existing.status was 'archived' — row has been restored.
+      broker.publishUser('default', { type: 'project_unarchived', project: row as unknown as Project });
+      reply.code(200);
+    }
+    return row;
+  });
+
+  // v1.9: single-project fetch so the settings pane can refetch on
+  // project_updated without pulling the whole project list.
+  app.get<{ Params: { id: string } }>('/api/projects/:id', async (req, reply) => {
+    const rows = await sql<Project[]>`
+      SELECT id, name, path, added_at, last_session_id, status, gitea_remote,
+             default_system_prompt, default_web_search_enabled
+      FROM projects WHERE id = ${req.params.id}
+    `;
+    if (rows.length === 0) {
+      reply.code(404);
+      return { error: 'not found' };
+    }
+    return rows[0];
+  });
+
+  app.patch<{ Params: { id: string } }>('/api/projects/:id', async (req, reply) => {
+    const parsed = PatchProjectBody.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400);
+      return { error: 'invalid body', details: parsed.error.flatten() };
+    }
+    const { name, default_system_prompt, default_web_search_enabled } = parsed.data;
+    // v1.9: every field optional. COALESCE on the bind keeps the prior value
+    // when the caller omits it. Boolean has its own branch since COALESCE
+    // can't disambiguate "omitted" from "explicitly false" via a single
+    // nullable parameter.
+    const dwsProvided = default_web_search_enabled !== undefined;
+    const rows = await sql<Project[]>`
+      UPDATE projects
+      SET
+        name = COALESCE(${name ?? null}, name),
+        default_system_prompt = COALESCE(${default_system_prompt ?? null}, default_system_prompt),
+        default_web_search_enabled = CASE WHEN ${dwsProvided}
+          THEN ${default_web_search_enabled ?? false}
+          ELSE default_web_search_enabled END
+      WHERE id = ${req.params.id}
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote,
+                default_system_prompt, default_web_search_enabled
+    `;
+    if (rows.length === 0) {
+      reply.code(404);
+      return { error: 'not found' };
+    }
+    const project = rows[0]!;
+    // v1.9: the project_updated frame still only carries id + name. Clients
+    // that need the new fields refetch via api.projects.list() — keeps the
+    // frame payload lean, per the locked recon decision (d).
+    broker.publishUser('default', {
+      type: 'project_updated',
+      project_id: project.id,
+      name: project.name,
+    });
+    return project;
+  });
+
+  app.post<{ Params: { id: string } }>('/api/projects/:id/archive', async (req, reply) => {
+    const result = await sql`
+      UPDATE projects SET status = 'archived'
+      WHERE id = ${req.params.id} AND status = 'open'
+    `;
+    if (result.count === 0) {
+      reply.code(404);
+      return { error: 'not found or already archived' };
+    }
+    broker.publishUser('default', { type: 'project_archived', project_id: req.params.id });
+    reply.code(204);
+    return null;
+  });
+
+  app.post<{ Params: { id: string } }>('/api/projects/:id/unarchive', async (req, reply) => {
+    const rows = await sql<Project[]>`
+      UPDATE projects SET status = 'open'
+      WHERE id = ${req.params.id} AND status = 'archived'
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote,
+                default_system_prompt, default_web_search_enabled
+    `;
+    if (rows.length === 0) {
+      reply.code(404);
+      return { error: 'not found or not archived' };
+    }
+    const project = rows[0]!;
+    broker.publishUser('default', { type: 'project_unarchived', project });
+    return project;
   });
 
   app.delete<{ Params: { id: string } }>('/api/projects/:id', async (req, reply) => {
@@ -96,7 +288,7 @@ export function registerProjectRoutes(
       reply.code(404);
       return { error: 'not found' };
     }
-    broker.publishUser(requireUser(req), { type: 'project_deleted', project_id: id });
+    broker.publishUser('default', { type: 'project_deleted', project_id: id });
     reply.code(204);
     return null;
   });
@@ -110,7 +302,12 @@ export function registerProjectRoutes(
       return [] as AvailableProject[];
     }
 
-    const existing = await sql<{ path: string }[]>`SELECT path FROM projects`;
+    // Only exclude paths registered with status='open'. Archived projects'
+    // folders should reappear as available so re-add via the picker restores
+    // the existing row (see POST /api/projects ON CONFLICT below).
+    const existing = await sql<{ path: string }[]>`
+      SELECT path FROM projects WHERE status = 'open'
+    `;
     const existingSet = new Set(existing.map((r) => r.path));
 
     const out: AvailableProject[] = [];
@@ -144,7 +341,7 @@ export function registerProjectRoutes(
       const relPath = req.query.path ?? '.';
 
       const rows = await sql<Project[]>`
-        SELECT id, name, path, added_at, last_session_id
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
         FROM projects WHERE id = ${id}
       `;
       if (rows.length === 0) {
@@ -189,7 +386,7 @@ export function registerProjectRoutes(
       }
 
       const rows = await sql<Project[]>`
-        SELECT id, name, path, added_at, last_session_id
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
         FROM projects WHERE id = ${id}
       `;
       if (rows.length === 0) {
@@ -226,6 +423,38 @@ export function registerProjectRoutes(
     }
   );
 
+  // GET /api/projects/:id/git
+  // v1.8 mobile-tabs: feeds the header branch indicator and is the same
+  // resolver the model's git_status tool uses. Returns 200 with branch=null
+  // for non-git directories (not 404) so the UI can degrade gracefully.
+  app.get<{ Params: { id: string } }>(
+    '/api/projects/:id/git',
+    async (req, reply) => {
+      const { id } = req.params;
+      const rows = await sql<Project[]>`
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
+        FROM projects WHERE id = ${id}
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'not found' };
+      }
+      const project = rows[0]!;
+      let projectRoot: string;
+      try {
+        projectRoot = await resolveProjectRoot(project.path);
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(404);
+          return { error: err.message };
+        }
+        throw err;
+      }
+      const meta = await getGitMeta(projectRoot);
+      return meta ?? { branch: null, is_dirty: false, ahead: 0, behind: 0 };
+    }
+  );
+
   // GET /api/projects/:id/files
   app.get<{ Params: { id: string } }>(
     '/api/projects/:id/files',
@@ -233,7 +462,7 @@ export function registerProjectRoutes(
       const { id } = req.params;
 
       const rows = await sql<Project[]>`
-        SELECT id, name, path, added_at, last_session_id
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
         FROM projects WHERE id = ${id}
       `;
       if (rows.length === 0) {

apps/server/src/routes/sessions.ts

@@ -5,18 +5,22 @@ import type { Config } from '../config.js';
 import type { Broker } from '../services/broker.js';
 import type { Session } from '../types/api.js';
 import { getSetting } from './settings.js';
-import { requireUser } from '../auth.js';
+import { getAgentsForProject } from '../services/agents.js';
 
 const CreateBody = z.object({
   name: z.string().min(1).max(200).optional(),
   model: z.string().min(1).max(200).optional(),
   system_prompt: z.string().max(8000).optional(),
+  agent_id: z.string().min(1).max(200).nullable().optional(),
 });
 
 const PatchBody = z.object({
   name: z.string().min(1).max(200).optional(),
   model: z.string().min(1).max(200).optional(),
   system_prompt: z.string().max(8000).optional(),
+  agent_id: z.string().min(1).max(200).nullable().optional(),
+  // v1.9: null = inherit from project default; true/false = explicit override.
+  web_search_enabled: z.boolean().nullable().optional(),
 });
 
 async function resolveDefaultModel(sql: Sql, config: Config): Promise<string> {
@@ -25,13 +29,20 @@ async function resolveDefaultModel(sql: Sql, config: Config): Promise<string> {
   return config.DEFAULT_MODEL;
 }
 
+// First agent in the project's effective list (file-defined or builtin),
+// or null if somehow none exist.
+async function resolveDefaultAgent(projectPath: string): Promise<string | null> {
+  const { agents } = await getAgentsForProject(projectPath);
+  return agents[0]?.id ?? null;
+}
+
 export function registerSessionRoutes(
   app: FastifyInstance,
   sql: Sql,
   config: Config,
   broker: Broker
 ): void {
-  app.get<{ Params: { id: string } }>(
+  app.get<{ Params: { id: string }; Querystring: { status?: string } }>(
     '/api/projects/:id/sessions',
     async (req, reply) => {
       const project = await sql`SELECT id FROM projects WHERE id = ${req.params.id}`;
@@ -39,10 +50,11 @@ export function registerSessionRoutes(
         reply.code(404);
         return { error: 'project not found' };
       }
+      const status = req.query.status === 'archived' ? 'archived' : 'open';
       const rows = await sql<Session[]>`
-        SELECT id, project_id, name, model, system_prompt, created_at, updated_at
+        SELECT id, project_id, name, model, system_prompt, status, created_at, updated_at, agent_id, web_search_enabled
         FROM sessions
-        WHERE project_id = ${req.params.id}
+        WHERE project_id = ${req.params.id} AND status = ${status}
         ORDER BY updated_at DESC
       `;
       return rows;
@@ -57,11 +69,14 @@ export function registerSessionRoutes(
         reply.code(400);
         return { error: 'invalid body', details: parsed.error.flatten() };
       }
-      const project = await sql`SELECT id FROM projects WHERE id = ${req.params.id}`;
+      const project = await sql<{ id: string; path: string }[]>`
+        SELECT id, path FROM projects WHERE id = ${req.params.id}
+      `;
       if (project.length === 0) {
         reply.code(404);
         return { error: 'project not found' };
       }
+      const projectPath = project[0]!.path;
 
       let model = parsed.data.model;
       if (!model) {
@@ -76,20 +91,26 @@ export function registerSessionRoutes(
 
       const name = parsed.data.name ?? 'New session';
       const systemPrompt = parsed.data.system_prompt ?? '';
+      // If the client provided agent_id (string or null), use it; otherwise
+      // resolve to the project's first agent (file-defined or builtin), or null.
+      const agentId =
+        parsed.data.agent_id !== undefined
+          ? parsed.data.agent_id
+          : await resolveDefaultAgent(projectPath);
 
       const row = await sql.begin(async (tx) => {
         const [session] = await tx<Session[]>`
-          INSERT INTO sessions (project_id, name, model, system_prompt)
-          VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt})
-          RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
+          INSERT INTO sessions (project_id, name, model, system_prompt, agent_id)
+          VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt}, ${agentId})
+          RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at, agent_id, web_search_enabled
         `;
         await tx`
-          INSERT INTO session_panes (session_id, position, kind, state)
-          VALUES (${session!.id}, 0, 'chat', '{}'::jsonb)
+          INSERT INTO chats (session_id, name, status)
+          VALUES (${session!.id}, NULL, 'open')
         `;
         return session!;
       });
-      broker.publishUser(requireUser(req), {
+      broker.publishUser('default', {
         type: 'session_created',
         session: row,
         project_id: row.project_id,
@@ -101,7 +122,7 @@ export function registerSessionRoutes(
 
   app.get<{ Params: { id: string } }>('/api/sessions/:id', async (req, reply) => {
     const rows = await sql<Session[]>`
-      SELECT id, project_id, name, model, system_prompt, created_at, updated_at
+      SELECT id, project_id, name, model, system_prompt, status, created_at, updated_at, agent_id, web_search_enabled
       FROM sessions WHERE id = ${req.params.id}
     `;
     if (rows.length === 0) {
@@ -120,21 +141,152 @@ export function registerSessionRoutes(
         return { error: 'invalid body', details: parsed.error.flatten() };
       }
       const { name, model, system_prompt } = parsed.data;
+      // agent_id and web_search_enabled are both tri-state on the wire: omitted
+      // = no change, null = clear/inherit, value = set. CASE WHEN inside SET
+      // handles all three atomically.
+      const agentIdProvided = parsed.data.agent_id !== undefined;
+      const newAgentId = parsed.data.agent_id ?? null;
+      const wseProvided = parsed.data.web_search_enabled !== undefined;
+      const newWse = parsed.data.web_search_enabled ?? null;
+      // Read the prior name so the post-update publish can skip no-op renames
+      // (PATCH { name: "Foo" } where the session is already "Foo"). The window
+      // between SELECT and UPDATE is sub-millisecond in the same request handler;
+      // a concurrent rename in that gap would just mean one stale publish, which
+      // existing clients dedup by id.
+      const before = await sql<{ name: string }[]>`
+        SELECT name FROM sessions WHERE id = ${req.params.id}
+      `;
+      const priorName = before[0]?.name;
       const rows = await sql<Session[]>`
         UPDATE sessions
         SET
           name = COALESCE(${name ?? null}, name),
           model = COALESCE(${model ?? null}, model),
           system_prompt = COALESCE(${system_prompt ?? null}, system_prompt),
+          agent_id = CASE WHEN ${agentIdProvided} THEN ${newAgentId} ELSE agent_id END,
+          web_search_enabled = CASE WHEN ${wseProvided} THEN ${newWse} ELSE web_search_enabled END,
           updated_at = clock_timestamp()
         WHERE id = ${req.params.id}
-        RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
+        RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at,
+                  agent_id, web_search_enabled
       `;
       if (rows.length === 0) {
         reply.code(404);
         return { error: 'session not found' };
       }
-      return rows[0];
+      const session = rows[0]!;
+      if (name !== undefined && session.name !== priorName) {
+        broker.publishUser('default', {
+          type: 'session_renamed',
+          session_id: session.id,
+          name: session.name,
+        });
+      }
+      // v1.9: any successful PATCH broadcasts session_updated so listeners
+      // (notably the SettingsPane open in another tab) can refetch and pick
+      // up the new fields. Frame stays lean (decision d) — payload is just
+      // ids + name + updated_at, the client refetches via api.sessions.get.
+      broker.publishUser('default', {
+        type: 'session_updated',
+        session_id: session.id,
+        project_id: session.project_id,
+        name: session.name,
+        updated_at: session.updated_at,
+      });
+      return session;
+    }
+  );
+
+  // v1.9: bulk-archive every open session in a project. Mirrors the
+  // single-archive shape (same broker frame type) so the existing useSidebar
+  // reducer cases handle it without changes — just N frames instead of 1.
+  app.post<{ Params: { id: string } }>(
+    '/api/projects/:id/sessions/archive-all',
+    async (req, reply) => {
+      const project = await sql`SELECT id FROM projects WHERE id = ${req.params.id}`;
+      if (project.length === 0) {
+        reply.code(404);
+        return { error: 'project not found' };
+      }
+      const rows = await sql<{ id: string }[]>`
+        UPDATE sessions
+           SET status = 'archived', updated_at = clock_timestamp()
+         WHERE project_id = ${req.params.id} AND status = 'open'
+         RETURNING id
+      `;
+      const ids = rows.map((r) => r.id);
+      for (const id of ids) {
+        broker.publishUser('default', {
+          type: 'session_archived',
+          session_id: id,
+          project_id: req.params.id,
+        });
+      }
+      return { archived: ids.length, ids };
+    }
+  );
+
+  // v1.9: count helper for the confirm dialog. Cheap COUNT(*) — the settings
+  // pane calls it on click, not on render.
+  app.get<{ Params: { id: string } }>(
+    '/api/projects/:id/sessions/open-count',
+    async (req, reply) => {
+      const project = await sql`SELECT id FROM projects WHERE id = ${req.params.id}`;
+      if (project.length === 0) {
+        reply.code(404);
+        return { error: 'project not found' };
+      }
+      const rows = await sql<{ count: number }[]>`
+        SELECT COUNT(*)::int AS count
+          FROM sessions
+         WHERE project_id = ${req.params.id} AND status = 'open'
+      `;
+      return { count: rows[0]?.count ?? 0 };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/archive',
+    async (req, reply) => {
+      const rows = await sql<{ id: string; project_id: string }[]>`
+        UPDATE sessions SET status = 'archived', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'open'
+        RETURNING id, project_id
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'session not found or already archived' };
+      }
+      broker.publishUser('default', {
+        type: 'session_archived',
+        session_id: rows[0]!.id,
+        project_id: rows[0]!.project_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/unarchive',
+    async (req, reply) => {
+      const rows = await sql<Session[]>`
+        UPDATE sessions SET status = 'open', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'archived'
+        RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at, agent_id, web_search_enabled
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'session not found or not archived' };
+      }
+      const session = rows[0]!;
+      broker.publishUser('default', {
+        type: 'session_created',
+        session: session,
+        project_id: session.project_id,
+      });
+      reply.code(200);
+      return session;
     }
   );
 
@@ -150,7 +302,7 @@ export function registerSessionRoutes(
         return { error: 'not found' };
       }
       const project_id = deleted[0]!.project_id;
-      broker.publishUser(requireUser(req), { type: 'session_deleted', session_id: id, project_id });
+      broker.publishUser('default', { type: 'session_deleted', session_id: id, project_id });
       reply.code(204);
       return null;
     }

apps/server/src/routes/settings.ts

@@ -22,6 +22,50 @@ export async function setSetting(
   `;
 }
 
+// themes-v1: whitelist of the 18 preset theme ids. Kept in sync with
+// docs/themes_v1.md §1 and apps/web/src/lib/theme.ts THEMES.
+const THEME_IDS = [
+  'obsidian',
+  'gunmetal',
+  'espresso',
+  'volcanic-brown',
+  'copper',
+  'gold',
+  'oxblood',
+  'crimson',
+  'elderflower',
+  'plum',
+  'steel-pink',
+  'fuchsia-noir',
+  'matrix',
+  'sage',
+  'ivory',
+  'chalk',
+  'cobalt',
+  'midnight-sapphire',
+] as const;
+
+const THEME_MODES = ['dark', 'light', 'system'] as const;
+
+// PATCH body is still a free-form key/value bag for everything except the
+// two theme keys, which carry strict per-key validation. Anything outside
+// THEME_IDS / THEME_MODES on those keys is rejected with 400.
+function validateThemeKeys(body: Record<string, unknown>): string | null {
+  if ('theme_id' in body) {
+    const v = body.theme_id;
+    if (typeof v !== 'string' || !(THEME_IDS as readonly string[]).includes(v)) {
+      return `theme_id must be one of: ${THEME_IDS.join(', ')}`;
+    }
+  }
+  if ('theme_mode' in body) {
+    const v = body.theme_mode;
+    if (typeof v !== 'string' || !(THEME_MODES as readonly string[]).includes(v)) {
+      return `theme_mode must be one of: ${THEME_MODES.join(', ')}`;
+    }
+  }
+  return null;
+}
+
 const PatchBody = z.record(z.string(), z.unknown());
 
 export function registerSettingsRoutes(app: FastifyInstance, sql: Sql): void {
@@ -38,6 +82,11 @@ export function registerSettingsRoutes(app: FastifyInstance, sql: Sql): void {
       reply.code(400);
       return { error: 'invalid body', details: parsed.error.flatten() };
     }
+    const themeError = validateThemeKeys(parsed.data);
+    if (themeError) {
+      reply.code(400);
+      return { error: themeError };
+    }
     for (const [k, v] of Object.entries(parsed.data)) {
       await setSetting(sql, k, v);
     }

apps/server/src/routes/sidebar.ts

@@ -8,9 +8,10 @@ import type {
 
 export function registerSidebarRoutes(app: FastifyInstance, sql: Sql): void {
   app.get('/api/sidebar', async (): Promise<SidebarResponse> => {
-    const projects = await sql<{ id: string; name: string }[]>`
-      SELECT id, name
+    const projects = await sql<{ id: string; name: string; path: string; gitea_remote: string | null }[]>`
+      SELECT id, name, path, gitea_remote
       FROM projects
+      WHERE status = 'open'
       ORDER BY added_at DESC
     `;
 
@@ -20,19 +21,21 @@ export function registerSidebarRoutes(app: FastifyInstance, sql: Sql): void {
           sql<SidebarSession[]>`
             SELECT id, project_id, name, model, updated_at
             FROM sessions
-            WHERE project_id = ${p.id}
+            WHERE project_id = ${p.id} AND status = 'open'
             ORDER BY updated_at DESC
             LIMIT 6
           `,
           sql<{ n: number }[]>`
             SELECT COUNT(*)::int AS n
             FROM sessions
-            WHERE project_id = ${p.id}
+            WHERE project_id = ${p.id} AND status = 'open'
           `,
         ]);
         return {
           id: p.id,
           name: p.name,
+          path: p.path,
+          gitea_remote: p.gitea_remote,
           recent_sessions,
           total_sessions: countRows[0]?.n ?? 0,
         };

apps/server/src/routes/skills.ts

@@ -0,0 +1,156 @@
+import { randomUUID } from 'node:crypto';
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import type { Sql } from '../db.js';
+import type { Chat } from '../types/api.js';
+import { getSkillBody, listSkills } from '../services/skills.js';
+
+// Batch 9.6 slash-invoke handlers. Mirrors the MessageHandlers shape in
+// routes/messages.ts so index.ts can pass thin adapters around broker +
+// inference runner without skills.ts importing them directly.
+export interface SkillInvokeHandlers {
+  enqueueInference: (
+    sessionId: string,
+    chatId: string,
+    assistantMessageId: string,
+    user: string,
+  ) => void;
+  publishUserMessage: (
+    sessionId: string,
+    chatId: string,
+    userMessageId: string,
+    content: string,
+  ) => void;
+  publishSessionFrame: (
+    sessionId: string,
+    frame: Record<string, unknown> & { type: string },
+  ) => void;
+}
+
+const SkillInvokeBody = z.object({
+  skill_name: z.string().min(1),
+  // Optional — server fills in a default if absent or whitespace-only so the
+  // model always has something to act on (matches the spec's "Apply this
+  // skill." filler).
+  user_message: z.string().max(64_000).nullable().optional(),
+});
+
+const DEFAULT_USER_MESSAGE = 'Apply this skill.';
+
+export function registerSkillsRoutes(
+  app: FastifyInstance,
+  sql: Sql,
+  handlers: SkillInvokeHandlers,
+): void {
+  // Debug/admin surface — the model interacts with skills via the three
+  // skill_* tools, not through this endpoint.
+  app.get('/api/skills', async () => {
+    return { skills: await listSkills() };
+  });
+
+  // POST /api/chats/:id/skill_invoke — slash-command entry point. Loads the
+  // skill body server-side (clients never get to forge file content),
+  // persists 4 messages in one transaction (synthetic assistant tool_use,
+  // synthetic tool result, real user message, streaming assistant), and
+  // enqueues inference against the updated history.
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/skill_invoke',
+    async (req, reply) => {
+      const parsed = SkillInvokeBody.safeParse(req.body);
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+      const { skill_name } = parsed.data;
+      const userText = parsed.data.user_message?.trim() ? parsed.data.user_message : DEFAULT_USER_MESSAGE;
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      const body = await getSkillBody(skill_name);
+      if (body === null) {
+        reply.code(404);
+        return { error: 'unknown_skill', message: `unknown skill: ${skill_name}` };
+      }
+
+      const toolCallId = randomUUID();
+      const toolCalls = [{ id: toolCallId, name: 'skill_use', args: { name: skill_name } }];
+      const toolResults = { tool_call_id: toolCallId, output: body, truncated: false };
+
+      const result = await sql.begin(async (tx) => {
+        const [synthAssistant] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, tool_calls, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', ${sql.json(toolCalls as never)}, 'complete', clock_timestamp())
+          RETURNING id
+        `;
+        const [toolMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, tool_results, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'tool', '', ${sql.json(toolResults as never)}, 'complete', clock_timestamp())
+          RETURNING id
+        `;
+        const [userMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'user', ${userText}, 'complete', clock_timestamp())
+          RETURNING id
+        `;
+        const [assistantMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
+          RETURNING id
+        `;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
+        return {
+          synth_assistant_id: synthAssistant!.id,
+          tool_message_id: toolMsg!.id,
+          user_message_id: userMsg!.id,
+          assistant_message_id: assistantMsg!.id,
+        };
+      });
+
+      // Synthetic frames so useSessionStream's reducer reflects the new
+      // history without a refetch. Frame shapes match the streaming-inference
+      // protocol (see services/inference.ts InferenceFrame).
+      handlers.publishSessionFrame(sessionId, {
+        type: 'message_started',
+        message_id: result.synth_assistant_id,
+        chat_id: chat.id,
+        role: 'assistant',
+      });
+      handlers.publishSessionFrame(sessionId, {
+        type: 'tool_call',
+        message_id: result.synth_assistant_id,
+        chat_id: chat.id,
+        tool_call: toolCalls[0]!,
+      });
+      handlers.publishSessionFrame(sessionId, {
+        type: 'message_complete',
+        message_id: result.synth_assistant_id,
+        chat_id: chat.id,
+      });
+      // The tool_result frame's reducer branch creates the tool-role message
+      // in-place when it doesn't already exist — no separate message_started
+      // is needed for the tool side.
+      handlers.publishSessionFrame(sessionId, {
+        type: 'tool_result',
+        tool_message_id: result.tool_message_id,
+        tool_call_id: toolCallId,
+        chat_id: chat.id,
+        output: body,
+        truncated: false,
+      });
+      handlers.publishUserMessage(sessionId, chat.id, result.user_message_id, userText);
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
+
+      reply.code(202);
+      return result;
+    },
+  );
+}

apps/server/src/routes/ws.ts

@@ -22,8 +22,8 @@ export function registerWebSocket(
       }
 
       const messages = await sql<Message[]>`
-        SELECT id, session_id, role, content, tool_calls, tool_results, status, last_seq,
-               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
+               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at, metadata
         FROM messages
         WHERE session_id = ${sessionId}
         ORDER BY created_at ASC, id ASC
@@ -44,15 +44,8 @@ export function registerWebSocket(
     }
   );
 
-  app.get('/api/ws/user', { websocket: true }, async (socket, req) => {
-    const user = req.user;
-    // defensive: global auth hook (auth.ts) already rejects unauthenticated /api/* requests;
-    // keep the explicit check here to close the WS cleanly (1008) rather than throwing.
-    if (!user) {
-      socket.close(1008, 'unauthenticated');
-      return;
-    }
-    // No snapshot — user channel is purely live updates.
+  app.get('/api/ws/user', { websocket: true }, async (socket) => {
+    const user = 'default';
     const unsubscribe = broker.subscribeUser(user, (frame) => {
       if (socket.readyState !== socket.OPEN) return;
       try {

apps/server/src/schema.sql

@@ -2,7 +2,7 @@ CREATE TABLE IF NOT EXISTS projects (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   name TEXT NOT NULL,
   path TEXT NOT NULL UNIQUE,
-  added_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  added_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
   last_session_id UUID
 );
 
@@ -12,8 +12,8 @@ CREATE TABLE IF NOT EXISTS sessions (
   name TEXT NOT NULL,
   model TEXT NOT NULL,
   system_prompt TEXT NOT NULL DEFAULT '',
-  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
 );
 
 CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id, updated_at DESC);
@@ -21,13 +21,13 @@ CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id, updated_
 CREATE TABLE IF NOT EXISTS messages (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   session_id UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  role TEXT NOT NULL CHECK (role IN ('user', 'assistant', 'tool')),
+  role TEXT NOT NULL,
   content TEXT NOT NULL DEFAULT '',
   tool_calls JSONB,
   tool_results JSONB,
-  status TEXT NOT NULL DEFAULT 'complete' CHECK (status IN ('streaming', 'complete', 'failed')),
+  status TEXT NOT NULL DEFAULT 'complete',
   last_seq INT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
 );
 
 CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, created_at);
@@ -47,6 +47,8 @@ CREATE TABLE IF NOT EXISTS settings (
 
 INSERT INTO settings (key, value) VALUES ('default_model', '"qwen3.6-35b-a3b-mxfp4"') ON CONFLICT (key) DO NOTHING;
 
+-- DEPRECATED: client-side pane state as of v1.2-batch4. Table retained per
+-- additive schema rule; no writes. Drop in a future destructive migration.
 CREATE TABLE IF NOT EXISTS session_panes (
   id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   session_id   UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
@@ -58,11 +60,122 @@ CREATE TABLE IF NOT EXISTS session_panes (
 );
 CREATE INDEX IF NOT EXISTS idx_session_panes_session ON session_panes (session_id);
 
--- Backfill: ensure every session has at least one pane (default Chat).
--- Idempotent: skipped on subsequent runs because session_panes rows already exist.
-INSERT INTO session_panes (session_id, position, kind, state)
-SELECT s.id, 0, 'chat', '{}'::jsonb
+-- v1.4: backfill removed. Pane layout is client-side (localStorage) since v1.2-batch4.
+-- The CREATE TABLE above is retained for additive-schema discipline; drop is a
+-- future destructive migration.
+
+-- v1.2: sessions.status (open | archived)
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'open';
+
+-- v1.2: chats table
+CREATE TABLE IF NOT EXISTS chats (
+  id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  session_id   UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  name         TEXT,
+  status       TEXT NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'archived')),
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
+);
+CREATE INDEX IF NOT EXISTS idx_chats_session_status ON chats (session_id, status, updated_at DESC);
+
+-- v1.2: messages.chat_id + messages.kind
+ALTER TABLE messages ADD COLUMN IF NOT EXISTS chat_id UUID REFERENCES chats(id) ON DELETE CASCADE;
+ALTER TABLE messages ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'message';
+CREATE INDEX IF NOT EXISTS idx_messages_chat ON messages (chat_id, created_at);
+
+-- Backfill: one chat per existing session that has none yet
+INSERT INTO chats (session_id, name, status, created_at, updated_at)
+SELECT s.id, s.name, 'open', s.created_at, s.updated_at
 FROM sessions s
 WHERE NOT EXISTS (
-  SELECT 1 FROM session_panes p WHERE p.session_id = s.id
+  SELECT 1 FROM chats c WHERE c.session_id = s.id
 );
+
+-- Backfill: link orphaned messages to their session's first chat
+UPDATE messages SET chat_id = (
+  SELECT c.id FROM chats c WHERE c.session_id = messages.session_id ORDER BY c.created_at ASC LIMIT 1
+)
+WHERE chat_id IS NULL;
+
+-- Enforce NOT NULL on chat_id once all rows are backfilled
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_name = 'messages' AND column_name = 'chat_id' AND is_nullable = 'YES'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM messages WHERE chat_id IS NULL
+  ) THEN
+    ALTER TABLE messages ALTER COLUMN chat_id SET NOT NULL;
+  END IF;
+END $$;
+
+-- v1.2.1: CHECK constraints for sessions.status and messages (role, status)
+-- KEEP IN SYNC: apps/server/src/types/api.ts (MESSAGE_ROLES, MESSAGE_STATUSES, SessionStatus)
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'sessions_status_chk') THEN
+    ALTER TABLE sessions ADD CONSTRAINT sessions_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'messages_role_chk') THEN
+    ALTER TABLE messages ADD CONSTRAINT messages_role_chk
+      CHECK (role IN ('user', 'assistant', 'system', 'tool'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'messages_status_chk') THEN
+    ALTER TABLE messages ADD CONSTRAINT messages_status_chk
+      CHECK (status IN ('streaming', 'complete', 'failed', 'cancelled'));
+  END IF;
+END $$;
+
+-- v1.2-project-ux: projects.status + projects.gitea_remote
+-- KEEP IN SYNC: apps/server/src/types/api.ts PROJECT_STATUSES
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'open';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS gitea_remote TEXT;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'projects_status_chk') THEN
+    ALTER TABLE projects ADD CONSTRAINT projects_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+END $$;
+
+-- v1.3-tab-close-chat-archive: align chats.status vocabulary with projects ('archived' not 'closed')
+-- KEEP IN SYNC: apps/server/src/types/api.ts CHAT_STATUSES
+-- Order matters: (1) drop the OLD inline CHECK that only allowed ('open','closed');
+-- (2) migrate existing rows; (3) add new named CHECK allowing ('open','archived').
+ALTER TABLE chats DROP CONSTRAINT IF EXISTS chats_status_check;
+UPDATE chats SET status = 'archived' WHERE status = 'closed';
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'chats_status_chk') THEN
+    ALTER TABLE chats ADD CONSTRAINT chats_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+END $$;
+
+-- v1.x-batch9: per-session agent reference. Agent definitions are not stored in
+-- the DB; they live in builtins (services/agents.ts) and a per-project AGENTS.md.
+-- agent_id is the slugified agent name. NULL means "use BooCode defaults".
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS agent_id TEXT;
+
+-- v1.8.2: per-message metadata for sentinels (cap-hit) and structured error
+-- reasons. JSONB so future kinds can extend without further schema churn.
+-- Shape for cap_hit:  { kind: 'cap_hit', used: number, limit: number,
+--                       agent_name: string|null, can_continue: boolean }
+-- Shape for errors:   { error_reason: 'llm_provider_error'|..., error_text: string }
+ALTER TABLE messages ADD COLUMN IF NOT EXISTS metadata JSONB;
+
+-- themes-v1: idempotent seeds for the two theme preference keys. The settings
+-- table is a key/value store (see line 43) so theme prefs live as two rows,
+-- not new columns. Defaults match docs/themes_v1.md: obsidian (dark).
+INSERT INTO settings (key, value) VALUES ('theme_id', '"obsidian"') ON CONFLICT (key) DO NOTHING;
+INSERT INTO settings (key, value) VALUES ('theme_mode', '"dark"') ON CONFLICT (key) DO NOTHING;
+
+-- v1.9: per-project defaults that new sessions inherit, plus a per-session
+-- web-search override. Empty string on either prompt column means "inherit"
+-- (resolved in inference.ts buildSystemPrompt). web_search_enabled is the
+-- only tri-state field: null on session = inherit from project default.
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS default_system_prompt TEXT NOT NULL DEFAULT '';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS default_web_search_enabled BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS web_search_enabled BOOLEAN;

apps/server/src/services/__tests__/inference.test.ts

@@ -0,0 +1,242 @@
+import { describe, it, expect } from 'vitest';
+import { buildMessagesPayload } from '../inference.js';
+import type {
+  Message,
+  MessageRole,
+  Project,
+  Session,
+  ToolCall,
+  ToolResult,
+} from '../../types/api.js';
+
+// ---- fixtures ---------------------------------------------------------------
+
+function makeSession(overrides: Partial<Session> = {}): Session {
+  return {
+    id: 'sess',
+    project_id: 'proj',
+    name: 'test session',
+    model: 'test-model',
+    system_prompt: '',
+    status: 'open',
+    created_at: new Date(0).toISOString(),
+    updated_at: new Date(0).toISOString(),
+    agent_id: null,
+    web_search_enabled: null,
+    ...overrides,
+  };
+}
+
+function makeProject(overrides: Partial<Project> = {}): Project {
+  return {
+    id: 'proj',
+    name: 'test project',
+    path: '/tmp/proj',
+    added_at: new Date(0).toISOString(),
+    last_session_id: null,
+    status: 'open',
+    gitea_remote: null,
+    default_system_prompt: '',
+    default_web_search_enabled: false,
+    ...overrides,
+  };
+}
+
+let counter = 0;
+function makeMessage(
+  role: MessageRole,
+  content: string,
+  overrides: Partial<Message> = {}
+): Message {
+  counter += 1;
+  return {
+    id: `m${counter}`,
+    session_id: 'sess',
+    chat_id: 'chat',
+    role,
+    content,
+    kind: 'message',
+    tool_calls: null,
+    tool_results: null,
+    status: 'complete',
+    last_seq: 0,
+    tokens_used: null,
+    ctx_used: null,
+    ctx_max: null,
+    started_at: null,
+    finished_at: null,
+    created_at: new Date(counter * 1000).toISOString(),
+    metadata: null,
+    ...overrides,
+  };
+}
+
+// ---- tests ------------------------------------------------------------------
+
+describe('buildMessagesPayload', () => {
+  it('prepends a system prompt containing the project path', () => {
+    const session = makeSession();
+    const project = makeProject({ path: '/tmp/my-proj' });
+    const result = buildMessagesPayload(session, project, []);
+    expect(result).toHaveLength(1);
+    expect(result[0]!.role).toBe('system');
+    expect(result[0]!.content).toContain('/tmp/my-proj');
+  });
+
+  it('appends session.system_prompt to the system message when set', () => {
+    const session = makeSession({ system_prompt: 'Be terse.' });
+    const project = makeProject();
+    const result = buildMessagesPayload(session, project, []);
+    expect(result).toHaveLength(1);
+    expect(result[0]!.role).toBe('system');
+    expect(result[0]!.content).toContain('Be terse.');
+  });
+
+  it('returns user/assistant messages in order when no compact marker is present', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'hi'),
+      makeMessage('assistant', 'hello'),
+      makeMessage('user', 'how are you'),
+      makeMessage('assistant', 'great'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 4 history messages
+    expect(result).toHaveLength(5);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({ role: 'user', content: 'hi' });
+    expect(result[2]).toMatchObject({ role: 'assistant', content: 'hello' });
+    expect(result[3]).toMatchObject({ role: 'user', content: 'how are you' });
+    expect(result[4]).toMatchObject({ role: 'assistant', content: 'great' });
+  });
+
+  it('starts from the latest compact marker, emitting it as a system message', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'old1'),
+      makeMessage('assistant', 'oldreply1'),
+      makeMessage('user', 'old2'),
+      makeMessage('assistant', 'compacted summary text', { kind: 'compact' }),
+      makeMessage('user', 'new1'),
+      makeMessage('assistant', 'newreply1'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // Expect: leading base-system prompt, then the compact as system, then
+    // the user/assistant pair following it.
+    expect(result).toHaveLength(4);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({
+      role: 'system',
+      content: 'compacted summary text',
+    });
+    expect(result[2]).toMatchObject({ role: 'user', content: 'new1' });
+    expect(result[3]).toMatchObject({ role: 'assistant', content: 'newreply1' });
+  });
+
+  it('uses only the most recent compact when multiple are present', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'u1'),
+      makeMessage('assistant', 'first compact summary', { kind: 'compact' }),
+      makeMessage('user', 'u2'),
+      makeMessage('assistant', 'second compact summary', { kind: 'compact' }),
+      makeMessage('user', 'u3'),
+      makeMessage('assistant', 'final reply'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // Expect: base system + latest compact as system + the two messages
+    // following it. The earlier compact and pre-compact history are dropped.
+    expect(result).toHaveLength(4);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({
+      role: 'system',
+      content: 'second compact summary',
+    });
+    expect(result[2]).toMatchObject({ role: 'user', content: 'u3' });
+    expect(result[3]).toMatchObject({ role: 'assistant', content: 'final reply' });
+    // None of the earlier content should leak through
+    const concatenated = result.map((m) => m.content ?? '').join(' ');
+    expect(concatenated).not.toContain('first compact summary');
+    expect(concatenated).not.toContain('u1');
+    expect(concatenated).not.toContain('u2');
+  });
+
+  it('skips streaming and cancelled assistant rows', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'hi'),
+      makeMessage('assistant', 'partial...', { status: 'streaming' }),
+      makeMessage('assistant', 'cancelled fragment', { status: 'cancelled' }),
+      makeMessage('assistant', 'final answer'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant (only the complete one)
+    expect(result).toHaveLength(3);
+    expect(result[1]).toMatchObject({ role: 'user', content: 'hi' });
+    expect(result[2]).toMatchObject({ role: 'assistant', content: 'final answer' });
+  });
+
+  it('round-trips an assistant-with-tool_calls followed by its tool result', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const toolCall: ToolCall = {
+      id: 'call_abc',
+      name: 'view_file',
+      args: { path: 'src/index.ts' },
+    };
+    const toolResult: ToolResult = {
+      tool_call_id: 'call_abc',
+      output: { contents: 'console.log(1)' },
+      truncated: false,
+    };
+    const history: Message[] = [
+      makeMessage('user', 'show me the file'),
+      makeMessage('assistant', '', { tool_calls: [toolCall] }),
+      makeMessage('tool', '', { tool_results: toolResult }),
+      makeMessage('assistant', 'here it is'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant(tool_calls) + 1 tool + 1 assistant
+    expect(result).toHaveLength(5);
+    expect(result[1]).toMatchObject({ role: 'user', content: 'show me the file' });
+    expect(result[2]!.role).toBe('assistant');
+    expect(result[2]!.tool_calls).toBeDefined();
+    expect(result[2]!.tool_calls).toHaveLength(1);
+    expect(result[2]!.tool_calls![0]).toMatchObject({
+      id: 'call_abc',
+      type: 'function',
+      function: { name: 'view_file' },
+    });
+    // The OpenAI shape stringifies args.
+    expect(result[2]!.tool_calls![0]!.function.arguments).toBe(
+      JSON.stringify({ path: 'src/index.ts' })
+    );
+    // assistant with empty content should be serialized as content: null
+    expect(result[2]!.content).toBeNull();
+    expect(result[3]).toMatchObject({
+      role: 'tool',
+      tool_call_id: 'call_abc',
+    });
+    // Non-string tool output is JSON-stringified.
+    expect(result[3]!.content).toBe(JSON.stringify({ contents: 'console.log(1)' }));
+    expect(result[4]).toMatchObject({ role: 'assistant', content: 'here it is' });
+  });
+
+  it('skips tool rows with no tool_results', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'do it'),
+      makeMessage('tool', '', { tool_results: null }),
+      makeMessage('assistant', 'done'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant; the empty tool row is dropped.
+    expect(result).toHaveLength(3);
+    expect(result.find((m) => m.role === 'tool')).toBeUndefined();
+  });
+});

apps/server/src/services/__tests__/project_bootstrap.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeFolderName } from '../project_bootstrap.js';
+
+describe('sanitizeFolderName', () => {
+  it('passes through a normal slug-like name', () => {
+    expect(sanitizeFolderName('my-project')).toBe('my-project');
+  });
+
+  it('lowercases and replaces whitespace with hyphens', () => {
+    expect(sanitizeFolderName('Hello World')).toBe('hello-world');
+  });
+
+  it('strips path-traversal characters', () => {
+    // dots and slashes fall outside [a-z0-9-] and are removed entirely.
+    expect(sanitizeFolderName('../etc/passwd')).toBe('etcpasswd');
+  });
+
+  it('strips trailing and leading dots and slashes', () => {
+    expect(sanitizeFolderName('./foo/')).toBe('foo');
+  });
+
+  it('collapses runs of hyphens and strips leading/trailing ones', () => {
+    expect(sanitizeFolderName('---foo---')).toBe('foo');
+  });
+
+  it('returns empty string when nothing survives sanitization', () => {
+    // NOTE: sanitizeFolderName itself does NOT throw — it returns ''. The
+    // BootstrapNameError is raised by the caller (bootstrapProject) when the
+    // sanitized result fails the SAFE_NAME regex. The spec's "throws" phrasing
+    // refers to that caller-level validation, not this pure function.
+    expect(sanitizeFolderName('...')).toBe('');
+    expect(sanitizeFolderName('   ')).toBe('');
+  });
+
+  it('strips control characters and null bytes', () => {
+    // Null bytes and control characters are not in [a-z0-9-] so they're
+    // filtered out (effectively rejected as folder-name content).
+    expect(sanitizeFolderName('my\x00proj\x01')).toBe('myproj');
+    expect(sanitizeFolderName('foo\x00bar')).toBe('foobar');
+  });
+
+  it('truncates names longer than 64 characters', () => {
+    const long = 'a'.repeat(100);
+    expect(sanitizeFolderName(long)).toBe('a'.repeat(64));
+    expect(sanitizeFolderName(long)).toHaveLength(64);
+  });
+});

apps/server/src/services/agents.ts

@@ -0,0 +1,327 @@
+import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
+import type { Agent, AgentsResponse, AgentParseError } from '../types/api.js';
+
+// v1.8.1: global agents live at /data/AGENTS.md inside the container
+// (./data:/data:ro mount on the host). Per-project AGENTS.md at the project
+// root overrides global by name. In-code builtins are gone — the seed file is
+// the contents of the previous BUILTIN_AGENTS list, copied into /data/AGENTS.md
+// once on first deploy.
+const GLOBAL_AGENTS_PATH = '/data/AGENTS.md';
+const CACHE_TTL_MS = 60_000;
+
+// Tools whitelist universe matches services/tools.ts ALL_TOOLS. Keep in sync.
+// Batch 9.6: skill_find / skill_use / skill_resource added. Agents without an
+// explicit `tools:` field inherit the full default set (which now includes
+// the skill tools); agents with an explicit `tools:` array must list any
+// skill tool they want to use — strict opt-in.
+const ALL_TOOL_NAMES = [
+  'view_file', 'list_dir', 'grep', 'find_files', 'git_status',
+  'skill_find', 'skill_use', 'skill_resource',
+] as const;
+const DEFAULT_TOOLS: string[] = [...ALL_TOOL_NAMES];
+const DEFAULT_TEMPERATURE = 0.7;
+
+export function slugify(name: string): string {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+// ---- AGENTS.md parser ------------------------------------------------------
+
+interface ParsedFrontmatter {
+  temperature?: number;
+  tools?: string[];
+  description?: string;
+  model?: string;
+  // v1.8.2: optional per-agent tool-loop budget. Absent → inference resolves
+  // from the agent's toolset at runtime.
+  max_tool_calls?: number;
+}
+
+function stripQuotes(s: string): string {
+  if (
+    s.length >= 2 &&
+    (s[0] === '"' || s[0] === "'") &&
+    s[0] === s[s.length - 1]
+  ) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+function parseFrontmatter(yaml: string): { data: ParsedFrontmatter; errors: string[] } {
+  const data: ParsedFrontmatter = {};
+  const errors: string[] = [];
+  const lines = yaml.split('\n');
+  let arrayKey: 'tools' | null = null;
+
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (line.length === 0) continue;
+
+    // Block-list continuation: "- value" under a key that was set to empty
+    if (arrayKey && line.startsWith('- ')) {
+      data[arrayKey]!.push(line.slice(2).trim());
+      continue;
+    }
+    arrayKey = null;
+
+    const colonIdx = line.indexOf(':');
+    if (colonIdx < 0) continue;
+    const key = line.slice(0, colonIdx).trim();
+    const valueRaw = line.slice(colonIdx + 1).trim();
+
+    if (key === 'temperature') {
+      const n = Number(valueRaw);
+      if (Number.isFinite(n)) data.temperature = n;
+      else errors.push(`temperature must be a number (got "${valueRaw}")`);
+    } else if (key === 'tools') {
+      if (valueRaw === '') {
+        data.tools = [];
+        arrayKey = 'tools';
+      } else if (valueRaw.startsWith('[') && valueRaw.endsWith(']')) {
+        const inner = valueRaw.slice(1, -1);
+        data.tools = inner
+          .split(',')
+          .map((s) => stripQuotes(s.trim()))
+          .filter((s) => s.length > 0);
+      } else {
+        // Loose form: "tools: a, b, c"
+        data.tools = valueRaw
+          .split(',')
+          .map((s) => stripQuotes(s.trim()))
+          .filter((s) => s.length > 0);
+      }
+    } else if (key === 'description') {
+      data.description = stripQuotes(valueRaw);
+    } else if (key === 'model') {
+      data.model = stripQuotes(valueRaw);
+    } else if (key === 'max_tool_calls') {
+      // v1.8.2: 1..100 inclusive integer. Out-of-range values are skipped
+      // with a warning rather than throwing — agents shouldn't be unusable
+      // because of a typo on a defaulted field. Non-numeric or non-integer
+      // still hard-fails the block, matching `temperature` behavior.
+      const n = Number(valueRaw);
+      if (Number.isInteger(n) && n >= 1 && n <= 100) {
+        data.max_tool_calls = n;
+      } else if (Number.isInteger(n)) {
+        console.warn(
+          `agents: max_tool_calls ${n} out of range 1-100, ignoring (falling back to default)`,
+        );
+      } else {
+        errors.push(`max_tool_calls must be an integer 1-100 (got "${valueRaw}")`);
+      }
+    }
+    // Unknown keys silently ignored — forward-compat.
+  }
+
+  return { data, errors };
+}
+
+interface RawSection {
+  name: string;
+  body: string;
+}
+
+function splitSections(content: string): RawSection[] {
+  // Split by lines matching exactly "## <name>". Level-3+ headings are body content.
+  const sections: RawSection[] = [];
+  let currentName: string | null = null;
+  let currentLines: string[] = [];
+
+  for (const line of content.split('\n')) {
+    const h2 = /^##\s+(.+?)\s*$/.exec(line);
+    const h3 = line.startsWith('### ');
+    if (h2 && !h3) {
+      if (currentName !== null) {
+        sections.push({ name: currentName, body: currentLines.join('\n') });
+      }
+      currentName = h2[1]!.trim();
+      currentLines = [];
+      continue;
+    }
+    if (currentName !== null) {
+      currentLines.push(line);
+    }
+  }
+  if (currentName !== null) {
+    sections.push({ name: currentName, body: currentLines.join('\n') });
+  }
+  return sections;
+}
+
+// Throws on malformed section — caller handles per-block error collection.
+function parseAgentSection(section: RawSection): Omit<Agent, 'source'> {
+  const lines = section.body.split('\n');
+
+  // Opening "---" fence must be the first non-empty line.
+  let openIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i]!.trim();
+    if (t === '') continue;
+    if (t === '---') {
+      openIdx = i;
+    }
+    break;
+  }
+  if (openIdx < 0) {
+    throw new Error('missing opening --- fence after heading');
+  }
+  let closeIdx = -1;
+  for (let i = openIdx + 1; i < lines.length; i++) {
+    if (lines[i]!.trim() === '---') {
+      closeIdx = i;
+      break;
+    }
+  }
+  if (closeIdx < 0) {
+    throw new Error('missing closing --- fence');
+  }
+  const yamlText = lines.slice(openIdx + 1, closeIdx).join('\n');
+  const systemPrompt = lines.slice(closeIdx + 1).join('\n').trim();
+
+  const { data: fm, errors: fmErrors } = parseFrontmatter(yamlText);
+  if (fmErrors.length > 0) {
+    throw new Error(fmErrors.join('; '));
+  }
+
+  const filteredTools = Array.isArray(fm.tools)
+    ? fm.tools.filter((t): t is string =>
+        (ALL_TOOL_NAMES as readonly string[]).includes(t),
+      )
+    : DEFAULT_TOOLS;
+
+  return {
+    id: slugify(section.name),
+    name: section.name,
+    description: fm.description ?? '',
+    system_prompt: systemPrompt,
+    temperature: typeof fm.temperature === 'number' ? fm.temperature : DEFAULT_TEMPERATURE,
+    tools: filteredTools,
+    model: typeof fm.model === 'string' && fm.model.length > 0 ? fm.model : null,
+    max_tool_calls: typeof fm.max_tool_calls === 'number' ? fm.max_tool_calls : null,
+  };
+}
+
+interface ParseResult {
+  agents: Omit<Agent, 'source'>[];
+  errors: AgentParseError[];
+}
+
+// v1.8.1: parse each `## Name` block independently. A failure in one block
+// does not abort the rest of the file — we collect a per-agent error and
+// keep parsing. Server logs a console.warn for each skipped agent.
+export function parseAgentsMd(content: string): ParseResult {
+  const sections = splitSections(content);
+  const agents: Omit<Agent, 'source'>[] = [];
+  const errors: AgentParseError[] = [];
+
+  for (const section of sections) {
+    try {
+      agents.push(parseAgentSection(section));
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      console.warn(`agents: skipped "${section.name}" — ${reason}`);
+      errors.push({ agent_name: section.name, reason });
+    }
+  }
+
+  return { agents, errors };
+}
+
+// ---- mtime-keyed cache + public API ----------------------------------------
+
+interface CacheEntry {
+  globalMtime: number | null;
+  projectMtime: number | null;
+  cachedAt: number;
+  result: AgentsResponse;
+}
+
+// Keyed by projectPath ('' is fine — no project case, e.g. tests). Two files
+// participate in the cache key (global + project); editing either bumps the
+// corresponding mtime so the next read sees a miss without a watcher.
+const cache = new Map<string, CacheEntry>();
+
+export function invalidateAgentsCache(projectPath?: string): void {
+  if (projectPath === undefined) {
+    cache.clear();
+  } else {
+    cache.delete(projectPath);
+  }
+}
+
+async function safeStat(path: string): Promise<number | null> {
+  try {
+    const s = await fs.stat(path);
+    return s.mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+async function safeRead(path: string): Promise<string | null> {
+  try {
+    return await fs.readFile(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export async function getAgentsForProject(projectPath: string): Promise<AgentsResponse> {
+  const projectAgentsPath = projectPath ? join(projectPath, 'AGENTS.md') : null;
+
+  const [globalMtime, projectMtime] = await Promise.all([
+    safeStat(GLOBAL_AGENTS_PATH),
+    projectAgentsPath ? safeStat(projectAgentsPath) : Promise.resolve(null),
+  ]);
+
+  const cacheKey = projectPath || '__none__';
+  const cached = cache.get(cacheKey);
+  const now = Date.now();
+  if (
+    cached &&
+    cached.globalMtime === globalMtime &&
+    cached.projectMtime === projectMtime &&
+    now - cached.cachedAt < CACHE_TTL_MS
+  ) {
+    return cached.result;
+  }
+
+  const [globalContent, projectContent] = await Promise.all([
+    globalMtime !== null ? safeRead(GLOBAL_AGENTS_PATH) : Promise.resolve(null),
+    projectAgentsPath && projectMtime !== null ? safeRead(projectAgentsPath) : Promise.resolve(null),
+  ]);
+
+  const errors: AgentParseError[] = [];
+  const byName = new Map<string, Agent>();
+
+  if (globalContent !== null) {
+    const r = parseAgentsMd(globalContent);
+    for (const a of r.agents) byName.set(a.name, { ...a, source: 'global' });
+    errors.push(...r.errors);
+  }
+  if (projectContent !== null) {
+    const r = parseAgentsMd(projectContent);
+    for (const a of r.agents) byName.set(a.name, { ...a, source: 'project' });
+    errors.push(...r.errors);
+  }
+
+  const result: AgentsResponse = {
+    agents: Array.from(byName.values()),
+    errors,
+  };
+  cache.set(cacheKey, { globalMtime, projectMtime, cachedAt: now, result });
+  return result;
+}
+
+export async function getAgentById(
+  projectPath: string,
+  agentId: string,
+): Promise<Agent | null> {
+  const { agents } = await getAgentsForProject(projectPath);
+  return agents.find((a) => a.id === agentId) ?? null;
+}

apps/server/src/services/auto_name.ts

@@ -5,31 +5,12 @@ const NAMING_SYSTEM_PROMPT =
 
 const MAX_TITLE_CHARS = 60;
 
-// QWEN3 NON-STREAMING UTILITY-CALL PATTERN
-// ----------------------------------------
-// Qwen3-family chat templates default to chain-of-thought reasoning: the
-// model emits a long <think>…</think> block into `reasoning_content` and
-// only finalizes a real reply in `content`. For short utility calls
-// (naming, classification, routing, summarization) with a tight token
-// budget, the model burns the entire budget on reasoning and returns:
-//   - content: ""
-//   - reasoning_content: "Thinking Process: 1. ..." (mid-thought, truncated)
-//   - finish_reason: "length"
-// Fix: pass `chat_template_kwargs: { enable_thinking: false }` to skip the
-// thinking block, and keep `max_tokens` low (~30 is plenty for a 4-word
-// title). The kwarg is a no-op for non-Qwen chat templates, so it's safe
-// to apply unconditionally for any short non-streaming model call.
-// Apply this same pattern to: fork-message (planned), agent-routing
-// (planned), web-search summarization (planned).
-
 function cleanTitle(raw: string): string {
   let name = raw.trim();
-  // Strip surrounding straight or smart quotes (one layer).
   const quotes = ['"', "'", '`', '‘', '’', '“', '”'];
   while (name.length >= 2 && quotes.includes(name[0]!) && quotes.includes(name[name.length - 1]!)) {
     name = name.slice(1, -1).trim();
   }
-  // Drop a leading "Title:" prefix if the model added one despite instructions.
   name = name.replace(/^title\s*:\s*/i, '').trim();
   if (name.length > MAX_TITLE_CHARS) {
     name = name.slice(0, MAX_TITLE_CHARS).trim();
@@ -46,13 +27,10 @@ interface NamingResponse {
   }>;
 }
 
-// Some Qwen-family models emit "thinking" tokens into reasoning_content and
-// only finalize a real reply in content. Pull a sensible candidate string.
 function pickTitleSource(data: NamingResponse): string {
   const choice = data.choices?.[0]?.message;
   if (!choice) return '';
   if (choice.content && choice.content.trim().length > 0) return choice.content;
-  // Fallback: try to extract a last-line title from reasoning, if present.
   const reasoning = choice.reasoning_content ?? '';
   if (reasoning.length === 0) return '';
   const lines = reasoning
@@ -62,40 +40,48 @@ function pickTitleSource(data: NamingResponse): string {
   return lines[lines.length - 1] ?? '';
 }
 
-export async function maybeAutoNameSession(
+export async function maybeAutoNameChat(
   ctx: InferenceContext,
+  chatId: string,
   sessionId: string
 ): Promise<void> {
   const counts = await ctx.sql<{ n: number }[]>`
     SELECT COUNT(*)::int AS n
     FROM messages
-    WHERE session_id = ${sessionId}
+    WHERE chat_id = ${chatId}
       AND role = 'assistant'
       AND status = 'complete'
+      AND content <> ''
   `;
-  if (counts[0]?.n !== 1) return;
+  if ((counts[0]?.n ?? 0) < 1) return;
 
-  const sessionRows = await ctx.sql<
-    { id: string; name: string; model: string }[]
+  const chatRows = await ctx.sql<
+    { id: string; name: string | null; session_id: string }[]
   >`
-    SELECT id, name, model FROM sessions WHERE id = ${sessionId}
+    SELECT id, name, session_id FROM chats WHERE id = ${chatId}
   `;
-  const session = sessionRows[0];
-  if (!session) return;
-  const existingName = session.name ?? '';
-  if (existingName !== '' && existingName !== 'New session') return;
+  const chat = chatRows[0];
+  if (!chat) return;
+  if (chat.name !== null && chat.name !== '') return;
+
+  const sessionRows = await ctx.sql<{ model: string }[]>`
+    SELECT model FROM sessions WHERE id = ${sessionId}
+  `;
+  const model = sessionRows[0]?.model;
+  if (!model) return;
 
   const userMsg = await ctx.sql<{ content: string }[]>`
     SELECT content FROM messages
-    WHERE session_id = ${sessionId} AND role = 'user'
+    WHERE chat_id = ${chatId} AND role = 'user'
     ORDER BY created_at ASC
     LIMIT 1
   `;
   const assistantMsg = await ctx.sql<{ content: string }[]>`
     SELECT content FROM messages
-    WHERE session_id = ${sessionId}
+    WHERE chat_id = ${chatId}
       AND role = 'assistant'
       AND status = 'complete'
+      AND content <> ''
     ORDER BY created_at ASC
     LIMIT 1
   `;
@@ -105,7 +91,7 @@ export async function maybeAutoNameSession(
   const assistantText = assistantMsg[0].content.slice(0, 2000);
 
   const body = {
-    model: session.model,
+    model,
     messages: [
       { role: 'system', content: NAMING_SYSTEM_PROMPT },
       {
@@ -116,9 +102,6 @@ export async function maybeAutoNameSession(
     max_tokens: 30,
     temperature: 0.3,
     stream: false,
-    // Qwen-family models default to chain-of-thought; this template kwarg
-    // tells llama.cpp's chat template renderer to skip the thinking block.
-    // Harmless for non-Qwen models.
     chat_template_kwargs: { enable_thinking: false },
   };
 
@@ -135,23 +118,49 @@ export async function maybeAutoNameSession(
   const raw = pickTitleSource(data);
   const name = cleanTitle(raw);
   if (!name) {
-    ctx.log.warn({ sessionId, raw }, 'auto-name: empty title from model');
+    ctx.log.warn({ chatId, raw }, 'auto-name: empty title from model');
     return;
   }
 
-  const updated = await ctx.sql<{ id: string; name: string }[]>`
-    UPDATE sessions
-    SET name = ${name}, updated_at = NOW()
-    WHERE id = ${sessionId}
-      AND (name IS NULL OR name = '' OR name = 'New session')
-    RETURNING id, name
+  const updated = await ctx.sql<{ id: string; name: string; session_id: string; updated_at: string }[]>`
+    UPDATE chats
+    SET name = ${name}, updated_at = clock_timestamp()
+    WHERE id = ${chatId}
+      AND (name IS NULL OR name = '')
+    RETURNING id, name, session_id, updated_at
   `;
   if (updated.length === 0) return;
 
   ctx.publish(sessionId, {
-    type: 'session_renamed',
-    session_id: sessionId,
+    type: 'chat_renamed',
+    chat_id: chatId,
     name,
   });
-  ctx.log.info({ sessionId, name }, 'session auto-named');
+  ctx.publishUser({
+    type: 'chat_updated',
+    chat_id: chatId,
+    session_id: sessionId,
+    name,
+    updated_at: updated[0]!.updated_at,
+  });
+  ctx.log.info({ chatId, name }, 'chat auto-named');
+
+  // Propagate to the parent session if it's still on its default name.
+  // The WHERE guard makes the check atomic — if the user has already
+  // renamed (or a prior chat already propagated), this UPDATE matches
+  // zero rows and we do nothing. First chat wins; manual renames win.
+  const renamedSession = await ctx.sql<{ id: string; name: string }[]>`
+    UPDATE sessions
+    SET name = ${name}
+    WHERE id = ${sessionId} AND name = 'New session'
+    RETURNING id, name
+  `;
+  if (renamedSession.length > 0) {
+    ctx.publishUser({
+      type: 'session_renamed',
+      session_id: sessionId,
+      name,
+    });
+    ctx.log.info({ sessionId, name }, 'session auto-named from chat');
+  }
 }

apps/server/src/services/file_index.ts

@@ -33,6 +33,7 @@ async function snapMtimes(root: string): Promise<MtimeSnap> {
   const rootStat = await fs.stat(root);
   let gitHead: number | null = null;
   let gitIndex: number | null = null;
+  // best-effort; ignore failure because the project may not be a git repo
   try { gitHead = (await fs.stat(path.join(root, '.git', 'HEAD'))).mtimeMs; } catch {}
   try { gitIndex = (await fs.stat(path.join(root, '.git', 'index'))).mtimeMs; } catch {}
   return { root: rootStat.mtimeMs, gitHead, gitIndex };

apps/server/src/services/git_meta.ts

@@ -0,0 +1,92 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+const CACHE_TTL_MS = 30_000;
+const GIT_TIMEOUT_MS = 2_000;
+// Cap stdout size so a pathological repo can't blow the buffer. Branch + status
+// porcelain + diverge counts never approach this on a real repo.
+const GIT_MAX_BUFFER = 1024 * 1024;
+
+export interface GitMeta {
+  branch: string | null;
+  is_dirty: boolean;
+  ahead: number;
+  behind: number;
+}
+
+interface CacheEntry {
+  at: number;
+  value: GitMeta | null;
+}
+
+const cache = new Map<string, CacheEntry>();
+
+// Runs a single git invocation with a hard 2s timeout. Returns null on any
+// failure (non-zero exit, timeout, git not installed) so callers can decide
+// how to degrade. Stderr is intentionally swallowed; we don't surface git's
+// error text to the model or UI.
+async function runGit(args: string[], cwd: string): Promise<string | null> {
+  try {
+    const { stdout } = await execFileAsync('git', args, {
+      cwd,
+      timeout: GIT_TIMEOUT_MS,
+      windowsHide: true,
+      maxBuffer: GIT_MAX_BUFFER,
+    });
+    return stdout.toString();
+  } catch {
+    return null;
+  }
+}
+
+export async function getGitMeta(rootPath: string): Promise<GitMeta | null> {
+  const cached = cache.get(rootPath);
+  const now = Date.now();
+  if (cached && now - cached.at < CACHE_TTL_MS) {
+    return cached.value;
+  }
+
+  // Three calls in parallel. rev-parse establishes repo + branch name;
+  // status --porcelain detects dirtiness with no false-positives from formatting;
+  // rev-list --left-right --count compares HEAD to upstream and is allowed to
+  // fail silently (returns null → ahead/behind = 0) when no upstream is set.
+  const [branchOut, statusOut, divergedOut] = await Promise.all([
+    runGit(['rev-parse', '--abbrev-ref', 'HEAD'], rootPath),
+    runGit(['status', '--porcelain'], rootPath),
+    runGit(['rev-list', '--left-right', '--count', 'HEAD...@{upstream}'], rootPath),
+  ]);
+
+  // If rev-parse fails, this isn't a git repo (or git isn't installed). Cache
+  // the null result so the next 30s of requests don't re-probe.
+  if (branchOut === null) {
+    cache.set(rootPath, { at: now, value: null });
+    return null;
+  }
+
+  const branch = branchOut.trim() || null;
+  const is_dirty = statusOut !== null && statusOut.trim().length > 0;
+
+  let ahead = 0;
+  let behind = 0;
+  if (divergedOut !== null) {
+    const match = divergedOut.trim().match(/^(\d+)\s+(\d+)/);
+    if (match) {
+      ahead = Number(match[1]);
+      behind = Number(match[2]);
+    }
+  }
+
+  const value: GitMeta = { branch, is_dirty, ahead, behind };
+  cache.set(rootPath, { at: now, value });
+  return value;
+}
+
+export function invalidateGitMetaCache(rootPath?: string): void {
+  if (rootPath) {
+    cache.delete(rootPath);
+  } else {
+    cache.clear();
+  }
+}

apps/server/src/services/gitea.ts

@@ -0,0 +1,50 @@
+export interface GiteaConfig {
+  baseUrl: string;
+  user: string;
+  token: string;
+}
+
+export interface GiteaRepo {
+  clone_url: string;
+  ssh_url: string;
+  html_url: string;
+}
+
+export class GiteaRepoExistsError extends Error {
+  constructor() {
+    super('gitea-repo-exists');
+  }
+}
+
+export async function createGiteaRepo(
+  cfg: GiteaConfig,
+  name: string,
+  options: { private: boolean }
+): Promise<GiteaRepo> {
+  const res = await fetch(`${cfg.baseUrl}/api/v1/user/repos`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `token ${cfg.token}`,
+    },
+    body: JSON.stringify({
+      name,
+      private: options.private,
+      auto_init: false,
+    }),
+  });
+  if (res.status === 409) throw new GiteaRepoExistsError();
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`gitea-api-${res.status}: ${text.slice(0, 200)}`);
+  }
+  const body = (await res.json()) as { ssh_url?: string; clone_url?: string; html_url?: string };
+  if (!body.ssh_url || !body.html_url || !body.clone_url) {
+    throw new Error(`gitea-api-unexpected-shape: ${JSON.stringify(body).slice(0, 200)}`);
+  }
+  return {
+    ssh_url: body.ssh_url,
+    clone_url: body.clone_url,
+    html_url: body.html_url,
+  };
+}

apps/server/src/services/project_bootstrap.ts

@@ -0,0 +1,182 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdir, writeFile, realpath } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import type { FastifyBaseLogger } from 'fastify';
+import type { Config } from '../config.js';
+import { createGiteaRepo, GiteaRepoExistsError } from './gitea.js';
+
+const execFileAsync = promisify(execFile);
+
+const GITIGNORE_TEMPLATE = `# OS / editor
+.DS_Store
+*.swp
+*~
+
+# Node
+node_modules/
+dist/
+build/
+.env
+.env.local
+
+# Python
+__pycache__/
+*.pyc
+.venv/
+venv/
+
+# AI agents
+.claude/
+.opencode/
+
+# Backups
+*.bak*
+`;
+
+const GIT_USER_NAME = 'indifferentketchup';
+const GIT_USER_EMAIL = 'samkintop@gmail.com';
+
+export interface BootstrapResult {
+  folder_real_path: string;
+  folder_name: string;
+  gitea_remote_url: string | null;
+  folder_created: boolean;
+  git_initialized: boolean;
+  first_commit: boolean;
+  gitea_remote_created: boolean;
+  gitea_pushed: boolean;
+  warnings: string[];
+}
+
+const SAFE_NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+
+export function sanitizeFolderName(raw: string): string {
+  return raw
+    .toLowerCase()
+    .trim()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64);
+}
+
+export class BootstrapNameError extends Error {}
+export class BootstrapCollisionError extends Error {}
+export class BootstrapPathError extends Error {}
+
+export async function bootstrapProject(
+  config: Config,
+  log: FastifyBaseLogger,
+  options: {
+    name: string;
+    commitMessage: string;
+    visibility: 'private' | 'public';
+    createGiteaRemote: boolean;
+  }
+): Promise<BootstrapResult> {
+  const folder = sanitizeFolderName(options.name);
+  if (folder.length === 0 || !SAFE_NAME.test(folder)) {
+    throw new BootstrapNameError(`invalid name after sanitization: "${folder}"`);
+  }
+
+  // Bootstrap target resolution. Uses BOOTSTRAP_ROOT (writable), not
+  // PROJECT_ROOT_WHITELIST (which may be a wider read-only scope for
+  // add-existing flow).
+  const bootstrapReal = await realpath(config.BOOTSTRAP_ROOT);
+  const fullPath = resolve(bootstrapReal, folder);
+  if (!fullPath.startsWith(bootstrapReal + sep)) {
+    throw new BootstrapPathError('path escapes bootstrap root');
+  }
+  if (existsSync(fullPath)) {
+    throw new BootstrapCollisionError(`path already exists: ${fullPath}`);
+  }
+
+  const warnings: string[] = [];
+  let folder_created = false;
+  let git_initialized = false;
+  let first_commit = false;
+  let gitea_remote_created = false;
+  let gitea_pushed = false;
+  let gitea_remote_url: string | null = null;
+
+  // Step 1: mkdir
+  await mkdir(fullPath, { recursive: false });
+  folder_created = true;
+  log.info({ fullPath }, 'project_bootstrap: folder created');
+
+  // Step 2: write .gitignore
+  await writeFile(resolve(fullPath, '.gitignore'), GITIGNORE_TEMPLATE, 'utf8');
+
+  // Step 3: git init -b main
+  await execFileAsync('git', ['init', '-b', 'main'], { cwd: fullPath });
+  git_initialized = true;
+
+  // Step 4: git add + commit (per-command -c, no global config touch)
+  await execFileAsync('git', ['add', '.gitignore'], { cwd: fullPath });
+  await execFileAsync(
+    'git',
+    [
+      '-c', `user.name=${GIT_USER_NAME}`,
+      '-c', `user.email=${GIT_USER_EMAIL}`,
+      'commit',
+      '-m', options.commitMessage,
+    ],
+    { cwd: fullPath }
+  );
+  first_commit = true;
+  log.info({ folder }, 'project_bootstrap: initial commit');
+
+  // Step 5: optional Gitea remote
+  if (options.createGiteaRemote) {
+    if (!config.GITEA_TOKEN) {
+      warnings.push('Gitea remote skipped — token not configured');
+    } else {
+      try {
+        const repo = await createGiteaRepo(
+          { baseUrl: config.GITEA_BASE_URL, user: config.GITEA_USER, token: config.GITEA_TOKEN },
+          folder,
+          { private: options.visibility === 'private' }
+        );
+        gitea_remote_created = true;
+        gitea_remote_url = repo.html_url;
+        log.info({ folder, html_url: repo.html_url }, 'project_bootstrap: gitea repo created');
+
+        // Step 6: git remote add + push
+        try {
+          const sshUrl = repo.ssh_url.replace('git.indifferentketchup.com', '100.114.205.53');
+          await execFileAsync('git', ['remote', 'add', 'origin', sshUrl], { cwd: fullPath });
+          await execFileAsync('git', ['push', '-u', 'origin', 'main'], { cwd: fullPath });
+          gitea_pushed = true;
+          log.info({ folder }, 'project_bootstrap: pushed to gitea');
+        } catch (pushErr) {
+          const msg = pushErr instanceof Error ? pushErr.message : String(pushErr);
+          warnings.push(`Push to Gitea failed: ${msg.slice(0, 200)}`);
+          log.warn({ err: pushErr, folder }, 'project_bootstrap: push failed');
+        }
+      } catch (err) {
+        if (err instanceof GiteaRepoExistsError) {
+          warnings.push('Gitea repo already exists with this name; local repo created without remote');
+        } else {
+          const msg = err instanceof Error ? err.message : String(err);
+          warnings.push(`Gitea remote creation failed: ${msg.slice(0, 200)}`);
+        }
+        log.warn({ err, folder }, 'project_bootstrap: gitea remote step failed');
+      }
+    }
+  }
+
+  return {
+    folder_real_path: fullPath,
+    folder_name: folder,
+    gitea_remote_url,
+    folder_created,
+    git_initialized,
+    first_commit,
+    gitea_remote_created,
+    gitea_pushed,
+    warnings,
+  };
+}

apps/server/src/services/skills.ts

@@ -0,0 +1,321 @@
+import { promises as fs } from 'node:fs';
+import { join, isAbsolute, basename } from 'node:path';
+import { pathGuard, PathScopeError } from './path_guard.js';
+
+// Batch 9.6: read-only skill library. Folders under /data/skills/<group>/<skill>/
+// contain a SKILL.md with YAML frontmatter (name + description) and a markdown
+// body. Three tools expose the library: skill_find (search), skill_use (load
+// body), skill_resource (read a support file inside the folder).
+//
+// Layout is intentionally uniform — scan /data/skills/*/*/SKILL.md at fixed
+// depth 3. Group folders (depth 1) hold LICENSE + ATTRIBUTION.md + skill
+// subfolders and are NOT themselves skills. Support files inside skill
+// folders are reachable via skill_resource, never auto-parsed.
+//
+// Cache model mirrors agents.ts: walk on first access, TTL re-walk to pick up
+// new skills, per-entry mtime check on body access so a hot-edited SKILL.md
+// is re-read without a restart. No watcher.
+
+const SKILLS_ROOT = '/data/skills';
+const MAX_RESOURCE_BYTES = 5 * 1024 * 1024;
+const LIST_CACHE_TTL_MS = 60_000;
+
+export interface Skill {
+  name: string;
+  description: string;
+  path: string;
+  mtime: number;
+}
+
+interface CachedSkill extends Skill {
+  body: string;
+}
+
+const cache = new Map<string, CachedSkill>();
+let lastWalkedAt = 0;
+
+// ---- Frontmatter parser ----------------------------------------------------
+// Minimal `---\n...\n---` extractor. Only `name` and `description` keys are
+// honored; other frontmatter keys are silently ignored for forward-compat
+// with the anthropics/skills upstream spec.
+
+interface Frontmatter {
+  name?: string;
+  description?: string;
+}
+
+function stripQuotes(s: string): string {
+  if (s.length >= 2 && (s[0] === '"' || s[0] === "'") && s[0] === s[s.length - 1]) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+function parseFrontmatter(yaml: string): Frontmatter {
+  const fm: Frontmatter = {};
+  for (const raw of yaml.split('\n')) {
+    const line = raw.trim();
+    if (line.length === 0) continue;
+    const colon = line.indexOf(':');
+    if (colon < 0) continue;
+    const key = line.slice(0, colon).trim();
+    const val = stripQuotes(line.slice(colon + 1).trim());
+    if (key === 'name') fm.name = val;
+    else if (key === 'description') fm.description = val;
+  }
+  return fm;
+}
+
+interface ParsedSkillFile {
+  name: string;
+  description: string;
+  body: string;
+}
+
+function parseSkillFile(content: string): ParsedSkillFile {
+  const lines = content.split('\n');
+  let openIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i]!.trim();
+    if (t === '') continue;
+    if (t === '---') openIdx = i;
+    break;
+  }
+  if (openIdx < 0) throw new Error('missing opening --- fence');
+  let closeIdx = -1;
+  for (let i = openIdx + 1; i < lines.length; i++) {
+    if (lines[i]!.trim() === '---') { closeIdx = i; break; }
+  }
+  if (closeIdx < 0) throw new Error('missing closing --- fence');
+
+  const yamlText = lines.slice(openIdx + 1, closeIdx).join('\n');
+  const body = lines.slice(closeIdx + 1).join('\n');
+
+  const fm = parseFrontmatter(yamlText);
+  if (!fm.name) throw new Error('frontmatter missing name');
+  if (!fm.description) throw new Error('frontmatter missing description');
+  return { name: fm.name, description: fm.description, body };
+}
+
+// ---- Tree walk -------------------------------------------------------------
+
+// Fixed depth-3 scan: /data/skills/<group>/<skill>/SKILL.md. Two layers of
+// readdir, no recursion. Group folders without SKILL.md are skipped silently;
+// LICENSE / ATTRIBUTION.md / other non-SKILL.md files are ignored entirely.
+// Returns all parseable skills as-found — dedup + collision logging happens
+// in ensureCache where the sort order is established.
+async function walkSkills(root: string): Promise<CachedSkill[]> {
+  const found: CachedSkill[] = [];
+  let groups;
+  try {
+    groups = await fs.readdir(root, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const group of groups) {
+    if (!group.isDirectory() || group.name.startsWith('.')) continue;
+    const groupPath = join(root, group.name);
+    let entries;
+    try {
+      entries = await fs.readdir(groupPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+      const skillFolder = join(groupPath, entry.name);
+      const skillFile = join(skillFolder, 'SKILL.md');
+      let stat;
+      try {
+        stat = await fs.stat(skillFile);
+      } catch {
+        continue; // folder without SKILL.md — silent skip
+      }
+      if (!stat.isFile()) continue;
+      try {
+        const content = await fs.readFile(skillFile, 'utf8');
+        const parsed = parseSkillFile(content);
+        found.push({
+          name: parsed.name,
+          description: parsed.description,
+          path: skillFolder,
+          mtime: stat.mtimeMs,
+          body: parsed.body,
+        });
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        console.warn(`skills: failed to parse ${skillFile} — ${reason}`);
+      }
+    }
+  }
+  return found;
+}
+
+// ---- Cache ----------------------------------------------------------------
+
+async function ensureCache(): Promise<void> {
+  const now = Date.now();
+  if (cache.size > 0 && now - lastWalkedAt < LIST_CACHE_TTL_MS) return;
+  let stat;
+  try {
+    stat = await fs.stat(SKILLS_ROOT);
+  } catch {
+    cache.clear();
+    lastWalkedAt = now;
+    return;
+  }
+  if (!stat.isDirectory()) {
+    cache.clear();
+    lastWalkedAt = now;
+    return;
+  }
+  const found = await walkSkills(SKILLS_ROOT);
+  // Sort by name asc, then path asc — gives alphabetically-first-wins on
+  // collision and stable, deterministic ordering for /api/skills + skill_find.
+  found.sort((a, b) => {
+    const n = a.name.localeCompare(b.name);
+    return n !== 0 ? n : a.path.localeCompare(b.path);
+  });
+  cache.clear();
+  const winnerPath = new Map<string, string>();
+  for (const skill of found) {
+    const prev = winnerPath.get(skill.name);
+    if (prev) {
+      console.warn(
+        `skills: name collision "${skill.name}" — kept ${prev}, skipped ${skill.path}`,
+      );
+      continue;
+    }
+    winnerPath.set(skill.name, skill.path);
+    cache.set(skill.name, skill);
+  }
+  lastWalkedAt = now;
+}
+
+// ---- Public API -----------------------------------------------------------
+
+export async function listSkills(): Promise<Skill[]> {
+  await ensureCache();
+  return Array.from(cache.values()).map((s) => ({
+    name: s.name,
+    description: s.description,
+    path: s.path,
+    mtime: s.mtime,
+  }));
+}
+
+export interface SkillSummary {
+  name: string;
+  description: string;
+}
+
+export async function findSkills(query: string): Promise<SkillSummary[]> {
+  await ensureCache();
+  const all = Array.from(cache.values());
+  const q = (query ?? '').trim().toLowerCase();
+  if (q === '' || q === '*') {
+    return all.map((s) => ({ name: s.name, description: s.description }));
+  }
+  // name match weighted 2x description match. No fancy ranking — substring
+  // scoring is enough for ≤20 skills.
+  const scored = all
+    .map((s) => {
+      let score = 0;
+      if (s.name.toLowerCase().includes(q)) score += 2;
+      if (s.description.toLowerCase().includes(q)) score += 1;
+      return { s, score };
+    })
+    .filter((x) => x.score > 0)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, 5);
+  return scored.map(({ s }) => ({ name: s.name, description: s.description }));
+}
+
+// Returns the SKILL.md body with frontmatter stripped, or null if the skill
+// is unknown. Single-entry mtime refresh: a hot edit shows up on next call.
+export async function getSkillBody(name: string): Promise<string | null> {
+  await ensureCache();
+  const cached = cache.get(name);
+  if (!cached) return null;
+
+  let stat;
+  try {
+    stat = await fs.stat(join(cached.path, 'SKILL.md'));
+  } catch {
+    cache.delete(name);
+    return null;
+  }
+  if (stat.mtimeMs === cached.mtime) return cached.body;
+  try {
+    const raw = await fs.readFile(join(cached.path, 'SKILL.md'), 'utf8');
+    const parsed = parseSkillFile(raw);
+    if (parsed.name !== name) {
+      // Skill renamed itself; drop the stale entry. Next listSkills() walks.
+      cache.delete(name);
+      return null;
+    }
+    cached.body = parsed.body;
+    cached.description = parsed.description;
+    cached.mtime = stat.mtimeMs;
+    return cached.body;
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(`skills: re-parse failed for ${name} — ${reason}`);
+    cache.delete(name);
+    return null;
+  }
+}
+
+export type SkillResourceErrorCode = 'unknown_skill' | 'unknown_resource' | 'path_escape';
+
+export type SkillResourceResult =
+  | { ok: true; content: string }
+  | { ok: false; code: SkillResourceErrorCode; message: string };
+
+export async function getSkillResource(
+  name: string,
+  relativePath: string,
+): Promise<SkillResourceResult> {
+  await ensureCache();
+  const cached = cache.get(name);
+  if (!cached) {
+    return { ok: false, code: 'unknown_skill', message: `unknown skill: ${name}` };
+  }
+  if (typeof relativePath !== 'string' || relativePath.trim() === '') {
+    return { ok: false, code: 'unknown_resource', message: 'path is required' };
+  }
+  // Syntactic pre-check — catches the common "../../etc/passwd" attempt
+  // before realpath dereferences any symlinks.
+  if (isAbsolute(relativePath) || relativePath.split(/[\\/]/).some((seg) => seg === '..')) {
+    return { ok: false, code: 'path_escape', message: `path escapes skill folder: ${relativePath}` };
+  }
+  // SKILL.md is the manifest — skill_use is the right tool to read it.
+  if (basename(relativePath) === 'SKILL.md') {
+    return { ok: false, code: 'unknown_resource', message: 'use skill_use to read SKILL.md' };
+  }
+  let real: string;
+  try {
+    real = await pathGuard(cached.path, relativePath);
+  } catch (err) {
+    if (err instanceof PathScopeError) {
+      const code: SkillResourceErrorCode = err.message.includes('escapes')
+        ? 'path_escape'
+        : 'unknown_resource';
+      return { ok: false, code, message: err.message };
+    }
+    throw err;
+  }
+  const stat = await fs.stat(real);
+  if (!stat.isFile()) {
+    return { ok: false, code: 'unknown_resource', message: 'not a file' };
+  }
+  if (stat.size > MAX_RESOURCE_BYTES) {
+    return {
+      ok: false,
+      code: 'unknown_resource',
+      message: `file too large (${stat.size} bytes, max ${MAX_RESOURCE_BYTES})`,
+    };
+  }
+  const content = await fs.readFile(real, 'utf8');
+  return { ok: true, content };
+}

apps/server/src/services/tools.ts

@@ -3,6 +3,8 @@ import { resolve, basename, relative } from 'node:path';
 import { z } from 'zod';
 import { pathGuard, PathScopeError } from './path_guard.js';
 import { grep as fileOpsGrep, findFiles as fileOpsFindFiles } from './file_ops.js';
+import { getGitMeta } from './git_meta.js';
+import { findSkills, getSkillBody, getSkillResource } from './skills.js';
 
 const MAX_FILE_BYTES = 5 * 1024 * 1024;
 const DEFAULT_VIEW_LINES = 200;
@@ -266,13 +268,171 @@ export const findFiles: ToolDef<FindFilesInputT> = {
   },
 };
 
+// v1.8 Level 1 branch awareness: gives the model a read-only view of the
+// project's git state. No path input — operates on the inference-resolved
+// project root via getGitMeta. Subprocess runs with a 2s timeout (see git_meta).
+const GitStatusInput = z.object({}).strict();
+type GitStatusInputT = z.infer<typeof GitStatusInput>;
+
+export const gitStatus: ToolDef<GitStatusInputT> = {
+  name: 'git_status',
+  description:
+    "Returns the current git branch, whether the working tree is dirty, and ahead/behind counts vs upstream. Read-only. Use when you need to know which branch the user is currently working on.",
+  inputSchema: GitStatusInput,
+  jsonSchema: {
+    type: 'function',
+    function: {
+      name: 'git_status',
+      description:
+        'Returns the current git branch, dirty flag, and ahead/behind counts vs upstream. Read-only.',
+      parameters: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false,
+      },
+    },
+  },
+  async execute(_input, projectRoot) {
+    const meta = await getGitMeta(projectRoot);
+    if (meta === null) {
+      return { repo: false, branch: null, is_dirty: false, ahead: 0, behind: 0 };
+    }
+    return { repo: true, ...meta };
+  },
+};
+
+// Batch 9.6: skill_find, skill_use, skill_resource. Lazy-loaded markdown
+// playbooks at /data/skills/. Three tools rather than one to keep each call
+// cheap — the model lists, then loads, then optionally pulls support files.
+
+const SkillFindInput = z.object({
+  query: z.string().optional(),
+});
+type SkillFindInputT = z.infer<typeof SkillFindInput>;
+
+export const skillFind: ToolDef<SkillFindInputT> = {
+  name: 'skill_find',
+  description:
+    'Find skills (markdown playbooks under /data/skills) by name or description. Returns up to 5 matches. Empty query or "*" returns all available skills. Call this first to discover what skills are available.',
+  inputSchema: SkillFindInput,
+  jsonSchema: {
+    type: 'function',
+    function: {
+      name: 'skill_find',
+      description:
+        'Find skills by name or description. Returns up to 5 matches. Empty or "*" returns all.',
+      parameters: {
+        type: 'object',
+        properties: {
+          query: { type: 'string', description: 'substring matched against skill name and description' },
+        },
+        additionalProperties: false,
+      },
+    },
+  },
+  async execute(input) {
+    return await findSkills(input.query ?? '');
+  },
+};
+
+const SkillUseInput = z.object({
+  name: z.string().min(1),
+});
+type SkillUseInputT = z.infer<typeof SkillUseInput>;
+
+export const skillUse: ToolDef<SkillUseInputT> = {
+  name: 'skill_use',
+  description:
+    "Load the full body of a skill's SKILL.md by name. Returns the markdown playbook to follow. Discover names via skill_find. Errors: unknown_skill.",
+  inputSchema: SkillUseInput,
+  jsonSchema: {
+    type: 'function',
+    function: {
+      name: 'skill_use',
+      description: "Load the full body of a skill's SKILL.md by name.",
+      parameters: {
+        type: 'object',
+        properties: {
+          name: { type: 'string', description: 'skill name from skill_find' },
+        },
+        required: ['name'],
+        additionalProperties: false,
+      },
+    },
+  },
+  async execute(input) {
+    const body = await getSkillBody(input.name);
+    if (body === null) {
+      return { error: 'unknown_skill', message: `unknown skill: ${input.name}` };
+    }
+    return { body };
+  },
+};
+
+const SkillResourceInput = z.object({
+  name: z.string().min(1),
+  path: z.string().min(1),
+});
+type SkillResourceInputT = z.infer<typeof SkillResourceInput>;
+
+export const skillResource: ToolDef<SkillResourceInputT> = {
+  name: 'skill_resource',
+  description:
+    "Read a support file inside a skill's folder (e.g. references/root-cause-tracing.md). Path is relative to the skill folder. Use skill_use to read SKILL.md itself. Errors: unknown_skill, unknown_resource, path_escape.",
+  inputSchema: SkillResourceInput,
+  jsonSchema: {
+    type: 'function',
+    function: {
+      name: 'skill_resource',
+      description: "Read a support file inside a skill's folder. Path is relative to the skill folder.",
+      parameters: {
+        type: 'object',
+        properties: {
+          name: { type: 'string', description: 'skill name' },
+          path: { type: 'string', description: 'relative path under the skill folder' },
+        },
+        required: ['name', 'path'],
+        additionalProperties: false,
+      },
+    },
+  },
+  async execute(input) {
+    const result = await getSkillResource(input.name, input.path);
+    if (!result.ok) {
+      return { error: result.code, message: result.message };
+    }
+    return { content: result.content };
+  },
+};
+
 export const ALL_TOOLS: ReadonlyArray<ToolDef<unknown>> = [
   viewFile as ToolDef<unknown>,
   listDir as ToolDef<unknown>,
   grep as ToolDef<unknown>,
   findFiles as ToolDef<unknown>,
+  gitStatus as ToolDef<unknown>,
+  skillFind as ToolDef<unknown>,
+  skillUse as ToolDef<unknown>,
+  skillResource as ToolDef<unknown>,
 ];
 
+// v1.8.2: forward-compatible read-only whitelist. An agent whose `tools` is
+// fully contained in this set gets a generous default tool budget (30);
+// anything outside means the agent can mutate state and gets a tighter
+// default (10). Every tool in v1.8.2 happens to be read-only, so the
+// non-RO branch only takes effect once BooCoder lands write tools.
+// Batch 9.6: skill_* added; all still read-only.
+export const READ_ONLY_TOOL_NAMES = [
+  'view_file',
+  'list_dir',
+  'grep',
+  'find_files',
+  'git_status',
+  'skill_find',
+  'skill_use',
+  'skill_resource',
+] as const;
+
 export const TOOLS_BY_NAME: Record<string, ToolDef<unknown>> = Object.fromEntries(
   ALL_TOOLS.map((t) => [t.name, t])
 );

apps/server/src/types/api.ts

@@ -1,9 +1,21 @@
+// KEEP IN SYNC: apps/server/src/schema.sql projects_status_chk
+export const PROJECT_STATUSES = ['open', 'archived'] as const;
+export type ProjectStatus = typeof PROJECT_STATUSES[number];
+
 export interface Project {
   id: string;
   name: string;
   path: string;
   added_at: string;
   last_session_id: string | null;
+  status: ProjectStatus;
+  gitea_remote: string | null;
+  // v1.9: per-project defaults inherited by new sessions. Empty string on
+  // default_system_prompt means "no override" — the model gets the base
+  // BooCode system prompt only. default_web_search_enabled is the inherited
+  // value for sessions where web_search_enabled is null.
+  default_system_prompt: string;
+  default_web_search_enabled: boolean;
 }
 
 export interface AvailableProject {
@@ -11,18 +23,83 @@ export interface AvailableProject {
   name: string;
 }
 
+export type SessionStatus = 'open' | 'archived';
+
 export interface Session {
   id: string;
   project_id: string;
   name: string;
   model: string;
   system_prompt: string;
+  status: SessionStatus;
   created_at: string;
   updated_at: string;
+  agent_id: string | null;
+  // v1.9: per-session override for web_search. null = inherit from
+  // project.default_web_search_enabled. Plumbed but inert in v1.9 — the
+  // actual web_search tool ships in Batch 8.
+  web_search_enabled: boolean | null;
 }
 
-export type MessageRole = 'user' | 'assistant' | 'tool';
-export type MessageStatus = 'streaming' | 'complete' | 'failed';
+// v1.8.1: agents come from two sources. 'global' = /data/AGENTS.md (always
+// loaded inside the container), 'project' = per-project override at
+// <root>/AGENTS.md. Project entries override global by name (case-sensitive).
+export type AgentSource = 'global' | 'project';
+
+export interface Agent {
+  id: string;            // slug of name; stable handle stored in sessions.agent_id
+  name: string;
+  description: string;
+  system_prompt: string;
+  temperature: number;
+  tools: string[];       // whitelist of tool names; empty = no tools allowed
+  model: string | null;  // null means "session.model wins"
+  source: AgentSource;
+  // v1.8.2: per-agent tool-loop budget. null means resolve at runtime from the
+  // agent's toolset (30 if all tools are read-only, 10 otherwise) or 15 for
+  // raw chat with no agent.
+  max_tool_calls: number | null;
+}
+
+// One entry per malformed `## Name` block. Per-block errors don't fail the
+// whole file — the loader returns parsed-successfully agents AND the list of
+// skipped ones so the UI can show a non-blocking warning chip.
+export interface AgentParseError {
+  agent_name: string;
+  reason: string;
+}
+
+export interface AgentsResponse {
+  agents: Agent[];
+  errors: AgentParseError[];
+}
+
+// KEEP IN SYNC: apps/server/src/schema.sql chats_status_chk
+export const CHAT_STATUSES = ['open', 'archived'] as const;
+export type ChatStatus = typeof CHAT_STATUSES[number];
+
+export interface Chat {
+  id: string;
+  session_id: string;
+  name: string | null;
+  status: ChatStatus;
+  created_at: string;
+  updated_at: string;
+  // Populated by GET /api/sessions/:id/chats only.
+  message_count?: number;
+  last_message_preview?: string | null;
+  effective_context_tokens?: number | null;
+}
+
+// KEEP IN SYNC: apps/server/src/schema.sql messages_role_chk / messages_status_chk
+export const MESSAGE_ROLES = ['user', 'assistant', 'system', 'tool'] as const;
+export type MessageRole = typeof MESSAGE_ROLES[number];
+
+export const MESSAGE_STATUSES = ['streaming', 'complete', 'failed', 'cancelled'] as const;
+export type MessageStatus = typeof MESSAGE_STATUSES[number];
+
+export const MESSAGE_KINDS = ['message', 'compact'] as const;
+export type MessageKind = typeof MESSAGE_KINDS[number];
 
 export interface ToolCall {
   id: string;
@@ -37,11 +114,38 @@ export interface ToolResult {
   error?: string;
 }
 
+// v1.8.2: structured reason codes for failed inferences. `error` carries the
+// human text; `reason` is the machine-readable discriminator the UI matches
+// on (with `error` as fallback when reason is absent or unrecognized).
+export type ErrorReason =
+  | 'llm_provider_error'
+  | 'tool_execution_failed'
+  | 'summary_after_cap_failed';
+
+// v1.8.2: shapes stored in messages.metadata. Discriminated on `kind`.
+//   cap_hit  — system sentinel emitted when tool budget is exhausted
+//   error    — attached to a failed assistant message so UI can show reason
+export type MessageMetadata =
+  | {
+      kind: 'cap_hit';
+      used: number;
+      limit: number;
+      agent_name: string | null;
+      can_continue: boolean;
+    }
+  | {
+      kind: 'error';
+      error_reason: ErrorReason;
+      error_text: string;
+    };
+
 export interface Message {
   id: string;
   session_id: string;
+  chat_id: string;
   role: MessageRole;
   content: string;
+  kind: MessageKind;
   tool_calls: ToolCall[] | null;
   tool_results: ToolResult | null;
   status: MessageStatus;
@@ -52,6 +156,9 @@ export interface Message {
   started_at: string | null;
   finished_at: string | null;
   created_at: string;
+  // v1.8.2: per-message metadata. See MessageMetadata for the discriminated
+  // shapes currently in use.
+  metadata: MessageMetadata | null;
 }
 
 export interface ModelInfo {
@@ -70,6 +177,8 @@ export interface SidebarSession {
 export interface SidebarProject {
   id: string;
   name: string;
+  path: string;
+  gitea_remote: string | null;
   recent_sessions: SidebarSession[];
   total_sessions: number;
 }
@@ -139,9 +248,80 @@ export interface SessionUpdatedFrame {
   name: string;
   updated_at: string;
 }
+export interface SessionRenamedFrame {
+  type: 'session_renamed';
+  session_id: string;
+  name: string;
+}
+export interface SessionArchivedFrame {
+  type: 'session_archived';
+  session_id: string;
+  project_id: string;
+}
+export interface ChatCreatedFrame {
+  type: 'chat_created';
+  chat: Chat;
+  session_id: string;
+}
+export interface ChatUpdatedFrame {
+  type: 'chat_updated';
+  chat_id: string;
+  session_id: string;
+  name: string | null;
+  updated_at: string;
+}
+export interface ChatArchivedFrame {
+  type: 'chat_archived';
+  chat_id: string;
+  session_id: string;
+}
+export interface ChatUnarchivedFrame {
+  type: 'chat_unarchived';
+  chat: Chat;
+}
+export interface ChatDeletedFrame {
+  type: 'chat_deleted';
+  chat_id: string;
+  session_id: string;
+}
+export interface ProjectArchivedFrame {
+  type: 'project_archived';
+  project_id: string;
+}
+export interface ProjectUnarchivedFrame {
+  type: 'project_unarchived';
+  project: Project;
+}
+export interface ProjectUpdatedFrame {
+  type: 'project_updated';
+  project_id: string;
+  name: string;
+}
+// v1.8 mobile-tabs: server can't know about client-side panes, so status
+// is keyed by chat_id. Frontend dot derives pane status from pane.activeChatId.
+// v1.8.2: optional `reason` carries a machine-readable code when status is
+// 'error'. UI prefers reason; falls back to no detail when absent.
+export interface ChatStatusFrame {
+  type: 'chat_status';
+  chat_id: string;
+  status: 'working' | 'idle' | 'error';
+  at: string;
+  reason?: ErrorReason;
+}
 export type UserStreamFrame =
   | ProjectCreatedFrame
   | ProjectDeletedFrame
   | SessionCreatedFrame
   | SessionDeletedFrame
-  | SessionUpdatedFrame;
+  | SessionUpdatedFrame
+  | SessionRenamedFrame
+  | SessionArchivedFrame
+  | ChatCreatedFrame
+  | ChatUpdatedFrame
+  | ChatArchivedFrame
+  | ChatUnarchivedFrame
+  | ChatDeletedFrame
+  | ProjectArchivedFrame
+  | ProjectUnarchivedFrame
+  | ProjectUpdatedFrame
+  | ChatStatusFrame;

apps/server/tsconfig.json

@@ -10,5 +10,6 @@
     "declaration": false,
     "sourceMap": true
   },
-  "include": ["src/**/*"]
+  "include": ["src/**/*"],
+  "exclude": ["src/**/__tests__/**", "**/*.test.ts"]
 }

apps/server/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: false,
+    include: ['src/**/__tests__/**/*.test.ts'],
+  },
+});

apps/web/index.html

@@ -4,8 +4,31 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>BooCode</title>
+    <script>
+      // themes-v1 FOUC guard: read the last-applied theme from localStorage
+      // and stamp the class on <html> before React mounts. Falls back to
+      // obsidian + dark when no cache. Light-only themes (ivory, chalk) with
+      // a dark mode pref fall back to obsidian dark — mirrors the rule in
+      // lib/theme.ts effectiveThemeId().
+      (function () {
+        try {
+          var t = JSON.parse(localStorage.getItem('boocode.theme') || '{}');
+          var id = t.id || 'obsidian';
+          var mode = t.mode || 'dark';
+          if (mode === 'system') {
+            mode = matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+          }
+          if ((id === 'ivory' || id === 'chalk') && mode === 'dark') {
+            id = 'obsidian';
+          }
+          document.documentElement.className = 'theme-' + id + (mode === 'dark' ? ' dark' : '');
+        } catch (e) {
+          document.documentElement.className = 'theme-obsidian dark';
+        }
+      })();
+    </script>
   </head>
-  <body class="bg-neutral-950 text-neutral-100">
+  <body>
     <div id="root"></div>
     <script type="module" src="/src/main.tsx"></script>
   </body>

apps/web/src/App.tsx

@@ -1,23 +1,89 @@
-import { BrowserRouter, Routes, Route } from 'react-router-dom';
+import { useEffect, useState } from 'react';
+import { BrowserRouter, Routes, Route, useParams } from 'react-router-dom';
+import { api } from '@/api/client';
 import { ProjectSidebar } from '@/components/ProjectSidebar';
+import { RightRail } from '@/components/RightRail';
 import { Home } from '@/pages/Home';
 import { Project } from '@/pages/Project';
 import { Session } from '@/pages/Session';
+import { Settings } from '@/pages/Settings';
 import { Toaster } from '@/components/ui/sonner';
 import { useUserEvents } from '@/hooks/useUserEvents';
+import { useTheme } from '@/lib/theme';
+import { SidebarDrawerProvider, useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { RightRailDrawerProvider, useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
+
+function SessionRightRail() {
+  const { id } = useParams<{ id: string }>();
+  if (!id) return null;
+  return <RightRailForSession sessionId={id} />;
+}
+
+function RightRailForSession({ sessionId }: { sessionId: string }) {
+  const [projectId, setProjectId] = useState<string | null>(null);
+  useEffect(() => {
+    api.sessions
+      .get(sessionId)
+      .then((s) => setProjectId(s.project_id))
+      .catch((err) => console.warn('RightRail: failed to fetch session', err));
+  }, [sessionId]);
+  if (!projectId) return null;
+  // v1.6.2: rendered on all viewports. On mobile, RightRail itself renders as
+  // a right-side drawer toggled by the header's FolderTree button (via
+  // useRightRailDrawer). On desktop, it renders inline as before with its
+  // own internal open/close state.
+  return <RightRail projectId={projectId} />;
+}
+
+function MobileBackdrop() {
+  const { open, setOpen } = useSidebarDrawer();
+  const { isMobile } = useViewport();
+  if (!isMobile || !open) return null;
+  return (
+    <div
+      className="fixed inset-0 z-30 bg-black/40 md:hidden"
+      onClick={() => setOpen(false)}
+      aria-hidden="true"
+    />
+  );
+}
+
+function MobileRightRailBackdrop() {
+  const { open, setOpen } = useRightRailDrawer();
+  const { isMobile } = useViewport();
+  if (!isMobile || !open) return null;
+  return (
+    <div
+      className="fixed inset-0 z-30 bg-black/40 md:hidden"
+      onClick={() => setOpen(false)}
+      aria-hidden="true"
+    />
+  );
+}
 
 function AppShell() {
+  // themes-v1: useTheme() owns the matchMedia subscription for system mode
+  // and reconciles cache with /api/settings on mount. Mounted first so the
+  // theme class on <html> is correct before any child renders.
+  useTheme();
   useUserEvents();
   return (
-    <div className="dark h-screen flex bg-background text-foreground">
+    <div className="h-screen flex bg-background text-foreground">
       <ProjectSidebar />
+      <MobileBackdrop />
       <main className="flex-1 flex flex-col min-w-0">
         <Routes>
           <Route path="/" element={<Home />} />
           <Route path="/project/:id" element={<Project />} />
           <Route path="/session/:id" element={<Session />} />
+          <Route path="/settings" element={<Settings />} />
         </Routes>
       </main>
+      <MobileRightRailBackdrop />
+      <Routes>
+        <Route path="/session/:id" element={<SessionRightRail />} />
+      </Routes>
       <Toaster position="bottom-right" />
     </div>
   );
@@ -26,7 +92,11 @@ function AppShell() {
 export default function App() {
   return (
     <BrowserRouter>
-      <AppShell />
+      <SidebarDrawerProvider>
+        <RightRailDrawerProvider>
+          <AppShell />
+        </RightRailDrawerProvider>
+      </SidebarDrawerProvider>
     </BrowserRouter>
   );
 }

apps/web/src/api/client.ts

@@ -2,14 +2,15 @@ import type {
   Project,
   AvailableProject,
   Session,
+  Chat,
   Message,
   ModelInfo,
   SidebarResponse,
   ListDirResult,
   ViewFileResult,
-  Pane,
-  PaneCreateRequest,
-  PaneUpdateRequest,
+  AgentsResponse,
+  GitMeta,
+  Skill,
 } from './types';
 
 export class ApiError extends Error {
@@ -43,13 +44,57 @@ export const api = {
   health: () => request<{ status: string; db: boolean }>('/api/health'),
 
   projects: {
-    list: () => request<Project[]>('/api/projects'),
+    list: (params?: { status?: 'open' | 'archived' }) =>
+      request<Project[]>(`/api/projects${params?.status ? `?status=${params.status}` : ''}`),
     available: () => request<AvailableProject[]>('/api/projects/available'),
     add: (body: { path: string; name?: string }) =>
       request<Project>('/api/projects', {
         method: 'POST',
         body: JSON.stringify(body),
       }),
+    update: (
+      id: string,
+      body: Partial<Pick<Project, 'name' | 'default_system_prompt' | 'default_web_search_enabled'>>,
+    ) =>
+      request<Project>(`/api/projects/${id}`, {
+        method: 'PATCH',
+        body: JSON.stringify(body),
+      }),
+    get: (id: string) => request<Project>(`/api/projects/${id}`),
+    archive: (id: string) =>
+      request<void>(`/api/projects/${id}/archive`, { method: 'POST' }),
+    unarchive: (id: string) =>
+      request<Project>(`/api/projects/${id}/unarchive`, { method: 'POST' }),
+    // v1.9: bulk-archive every open session in this project. Server publishes
+    // one session_archived frame per affected id, so the sidebar reducer
+    // updates incrementally rather than waiting for a refetch.
+    archiveAllSessions: (id: string) =>
+      request<{ archived: number; ids: string[] }>(
+        `/api/projects/${id}/sessions/archive-all`,
+        { method: 'POST' },
+      ),
+    openSessionsCount: (id: string) =>
+      request<{ count: number }>(`/api/projects/${id}/sessions/open-count`),
+    create: (body: {
+      name: string;
+      commit_message?: string;
+      visibility?: 'private' | 'public';
+      create_gitea_remote?: boolean;
+    }) =>
+      request<{
+        project: Project;
+        bootstrap: {
+          folder_created: boolean;
+          git_initialized: boolean;
+          first_commit: boolean;
+          gitea_remote_created: boolean;
+          gitea_pushed: boolean;
+          warnings: string[];
+        };
+      }>(`/api/projects/create`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
     remove: (id: string) =>
       request<void>(`/api/projects/${id}`, { method: 'DELETE' }),
     listDir: (id: string, path: string) =>
@@ -58,14 +103,16 @@ export const api = {
       request<ViewFileResult>(`/api/projects/${id}/view_file?path=${encodeURIComponent(path)}`),
     files: (id: string) =>
       request<{ files: string[] }>(`/api/projects/${id}/files`),
+    git: (id: string) =>
+      request<GitMeta>(`/api/projects/${id}/git`),
   },
 
   sessions: {
-    listForProject: (projectId: string) =>
-      request<Session[]>(`/api/projects/${projectId}/sessions`),
+    listForProject: (projectId: string, status?: 'open' | 'archived') =>
+      request<Session[]>(`/api/projects/${projectId}/sessions${status ? `?status=${status}` : ''}`),
     create: (
       projectId: string,
-      body: { name?: string; model?: string; system_prompt?: string }
+      body: { name?: string; model?: string; system_prompt?: string; agent_id?: string | null }
     ) =>
       request<Session>(`/api/projects/${projectId}/sessions`, {
         method: 'POST',
@@ -74,7 +121,7 @@ export const api = {
     get: (id: string) => request<Session>(`/api/sessions/${id}`),
     update: (
       id: string,
-      body: Partial<Pick<Session, 'name' | 'model' | 'system_prompt'>>
+      body: Partial<Pick<Session, 'name' | 'model' | 'system_prompt' | 'agent_id' | 'web_search_enabled'>>
     ) =>
       request<Session>(`/api/sessions/${id}`, {
         method: 'PATCH',
@@ -82,28 +129,114 @@ export const api = {
       }),
     remove: (id: string) =>
       request<void>(`/api/sessions/${id}`, { method: 'DELETE' }),
+    archive: (id: string) =>
+      request<void>(`/api/sessions/${id}/archive`, { method: 'POST' }),
+    unarchive: (id: string) =>
+      request<Session>(`/api/sessions/${id}/unarchive`, { method: 'POST' }),
+    // v1.9: bulk-archive every open chat in this session. Same pattern as
+    // archiveAllSessions — server publishes one chat_archived per id.
+    archiveAllChats: (id: string) =>
+      request<{ archived: number; ids: string[] }>(
+        `/api/sessions/${id}/chats/archive-all`,
+        { method: 'POST' },
+      ),
+    openChatsCount: (id: string) =>
+      request<{ count: number }>(`/api/sessions/${id}/chats/open-count`),
+  },
+
+  chats: {
+    listForSession: (sessionId: string, params?: { status?: 'open' | 'archived' }) =>
+      request<Chat[]>(
+        `/api/sessions/${sessionId}/chats${params?.status ? `?status=${params.status}` : ''}`
+      ),
+    create: (sessionId: string, body?: { name?: string }) =>
+      request<Chat>(`/api/sessions/${sessionId}/chats`, {
+        method: 'POST',
+        body: JSON.stringify(body ?? {}),
+      }),
+    update: (chatId: string, body: { name: string }) =>
+      request<Chat>(`/api/chats/${chatId}`, {
+        method: 'PATCH',
+        body: JSON.stringify(body),
+      }),
+    archive: (chatId: string) =>
+      request<void>(`/api/chats/${chatId}/archive`, { method: 'POST' }),
+    unarchive: (chatId: string) =>
+      request<Chat>(`/api/chats/${chatId}/unarchive`, { method: 'POST' }),
+    remove: (chatId: string) =>
+      request<void>(`/api/chats/${chatId}`, { method: 'DELETE' }),
+    messages: (chatId: string) =>
+      request<Message[]>(`/api/chats/${chatId}/messages`),
+    compact: (chatId: string) =>
+      request<{ compact_message_id: string }>(`/api/chats/${chatId}/compact`, { method: 'POST' }),
+    stop: (chatId: string) =>
+      request<{ stopped: boolean }>(`/api/chats/${chatId}/stop`, { method: 'POST' }),
+    forceSend: (chatId: string, content: string) =>
+      request<{ user_message_id: string; assistant_message_id: string }>(
+        `/api/chats/${chatId}/force_send`,
+        { method: 'POST', body: JSON.stringify({ content }) }
+      ),
+    // v1.8.2: extend an inference that hit the tool budget. `sentinelMessageId`
+    // is the cap-hit sentinel message the user clicked Continue on.
+    continue: (chatId: string, sentinelMessageId: string) =>
+      request<{ assistant_message_id: string }>(
+        `/api/chats/${chatId}/continue`,
+        { method: 'POST', body: JSON.stringify({ sentinel_message_id: sentinelMessageId }) }
+      ),
+    fork: (chatId: string, body: { messageId: string; name?: string }) =>
+      request<Chat>(`/api/chats/${chatId}/fork`, {
+        method: 'POST',
+        body: JSON.stringify({ message_id: body.messageId, name: body.name }),
+      }),
+    // Batch 9.6: slash-command invocation. Server loads the skill body
+    // authoritatively (client doesn't get to forge file contents), persists
+    // a synthetic skill_use tool_use + tool_result + user message + streaming
+    // assistant, and enqueues inference. Returns all 4 new message IDs.
+    skillInvoke: (chatId: string, skillName: string, userMessage: string | null) =>
+      request<{
+        synth_assistant_id: string;
+        tool_message_id: string;
+        user_message_id: string;
+        assistant_message_id: string;
+      }>(`/api/chats/${chatId}/skill_invoke`, {
+        method: 'POST',
+        body: JSON.stringify({ skill_name: skillName, user_message: userMessage }),
+      }),
   },
 
   messages: {
     list: (sessionId: string) =>
       request<Message[]>(`/api/sessions/${sessionId}/messages`),
-    send: (sessionId: string, content: string) =>
+    send: (chatId: string, content: string) =>
       request<{ user_message_id: string; assistant_message_id: string }>(
-        `/api/sessions/${sessionId}/messages`,
+        `/api/chats/${chatId}/messages`,
         {
           method: 'POST',
           body: JSON.stringify({ content }),
         }
       ),
-    regenerate: (sessionId: string, messageId: string) =>
+    regenerate: (chatId: string, messageId: string) =>
       request<{ assistant_message_id: string }>(
-        `/api/sessions/${sessionId}/messages/${messageId}/regenerate`,
+        `/api/chats/${chatId}/messages/${messageId}/regenerate`,
         { method: 'POST' }
       ),
+    remove: (chatId: string, messageId: string) =>
+      request<void>(`/api/chats/${chatId}/messages/${messageId}`, {
+        method: 'DELETE',
+      }),
   },
 
   models: () => request<ModelInfo[]>('/api/models'),
 
+  agents: {
+    list: (projectId: string) =>
+      request<AgentsResponse>(`/api/projects/${projectId}/agents`),
+  },
+
+  skills: {
+    list: () => request<{ skills: Skill[] }>('/api/skills'),
+  },
+
   settings: {
     get: () => request<Record<string, unknown>>('/api/settings'),
     patch: (body: Record<string, unknown>) =>
@@ -116,21 +249,4 @@ export const api = {
   sidebar: {
     get: () => request<SidebarResponse>('/api/sidebar'),
   },
-
-  panes: {
-    getForSession: (sessionId: string) =>
-      request<{ panes: Pane[] }>(`/api/sessions/${sessionId}/panes`),
-    create: (sessionId: string, body: PaneCreateRequest) =>
-      request<Pane>(`/api/sessions/${sessionId}/panes`, {
-        method: 'POST',
-        body: JSON.stringify(body),
-      }),
-    update: (id: string, body: PaneUpdateRequest) =>
-      request<Pane>(`/api/panes/${id}`, {
-        method: 'PATCH',
-        body: JSON.stringify(body),
-      }),
-    remove: (id: string) =>
-      request<void>(`/api/panes/${id}`, { method: 'DELETE' }),
-  },
 };

apps/web/src/api/types.ts

@@ -1,9 +1,18 @@
+export const PROJECT_STATUSES = ['open', 'archived'] as const;
+export type ProjectStatus = typeof PROJECT_STATUSES[number];
+
 export interface Project {
   id: string;
   name: string;
   path: string;
   added_at: string;
   last_session_id: string | null;
+  status: ProjectStatus;
+  gitea_remote: string | null;
+  // v1.9: per-project defaults. Empty string on default_system_prompt means
+  // "no override" — inference falls through to the base system prompt.
+  default_system_prompt: string;
+  default_web_search_enabled: boolean;
 }
 
 export interface AvailableProject {
@@ -11,18 +20,71 @@ export interface AvailableProject {
   name: string;
 }
 
+export type SessionStatus = 'open' | 'archived';
+
 export interface Session {
   id: string;
   project_id: string;
   name: string;
   model: string;
   system_prompt: string;
+  status: SessionStatus;
   created_at: string;
   updated_at: string;
+  agent_id: string | null;
+  // v1.9: null = inherit from project.default_web_search_enabled.
+  web_search_enabled: boolean | null;
 }
 
-export type MessageRole = 'user' | 'assistant' | 'tool';
-export type MessageStatus = 'streaming' | 'complete' | 'failed';
+// v1.8.1: 'global' = /data/AGENTS.md (always-on), 'project' = per-project
+// override at <root>/AGENTS.md. In-code builtins were retired; the seed file
+// lives at /data/AGENTS.md.
+export type AgentSource = 'global' | 'project';
+
+export interface Agent {
+  id: string;
+  name: string;
+  description: string;
+  system_prompt: string;
+  temperature: number;
+  tools: string[];
+  model: string | null;
+  source: AgentSource;
+  // v1.8.2: per-agent tool-loop budget. null means resolve at runtime from
+  // the agent's toolset (30 for all read-only, 10 otherwise) or 15 for raw
+  // chat with no agent.
+  max_tool_calls: number | null;
+}
+
+export interface AgentParseError {
+  agent_name: string;
+  reason: string;
+}
+
+export interface AgentsResponse {
+  agents: Agent[];
+  errors: AgentParseError[];
+}
+
+export const CHAT_STATUSES = ['open', 'archived'] as const;
+export type ChatStatus = typeof CHAT_STATUSES[number];
+
+export interface Chat {
+  id: string;
+  session_id: string;
+  name: string | null;
+  status: ChatStatus;
+  created_at: string;
+  updated_at: string;
+  // Populated by GET /api/sessions/:id/chats only.
+  message_count?: number;
+  last_message_preview?: string | null;
+  effective_context_tokens?: number | null;
+}
+
+export type MessageRole = 'user' | 'assistant' | 'tool' | 'system';
+export type MessageStatus = 'streaming' | 'complete' | 'failed' | 'cancelled';
+export type MessageKind = 'message' | 'compact';
 
 export interface ToolCall {
   id: string;
@@ -37,11 +99,39 @@ export interface ToolResult {
   error?: string;
 }
 
+// v1.8.2: structured reason codes that flow through error frames / metadata.
+// `error` text stays human; `reason` is the discriminator the UI matches on.
+export type ErrorReason =
+  | 'llm_provider_error'
+  | 'tool_execution_failed'
+  | 'summary_after_cap_failed';
+
+// v1.8.2: shapes stored in Message.metadata. Discriminated on `kind`.
+//   cap_hit — sentinel emitted when the tool budget is hit; carries the
+//             budget + agent name + whether Continue is still allowed.
+//   error   — attached to a failed assistant message so the bubble can show
+//             a specific reason on reload (WS error frame is one-shot).
+export type MessageMetadata =
+  | {
+      kind: 'cap_hit';
+      used: number;
+      limit: number;
+      agent_name: string | null;
+      can_continue: boolean;
+    }
+  | {
+      kind: 'error';
+      error_reason: ErrorReason;
+      error_text: string;
+    };
+
 export interface Message {
   id: string;
   session_id: string;
+  chat_id: string;
   role: MessageRole;
   content: string;
+  kind: MessageKind;
   tool_calls: ToolCall[] | null;
   tool_results: ToolResult | null;
   status: MessageStatus;
@@ -52,6 +142,9 @@ export interface Message {
   started_at: string | null;
   finished_at: string | null;
   created_at: string;
+  // v1.8.2: per-message metadata; see MessageMetadata. null for the vast
+  // majority of messages.
+  metadata: MessageMetadata | null;
 }
 
 export interface ModelInfo {
@@ -70,6 +163,8 @@ export interface SidebarSession {
 export interface SidebarProject {
   id: string;
   name: string;
+  path: string;
+  gitea_remote: string | null;
   recent_sessions: SidebarSession[];
   total_sessions: number;
 }
@@ -127,14 +222,47 @@ export interface PaneUpdateRequest {
   position?: number;
 }
 
+// v1.8 mobile-tabs: shape returned by GET /api/projects/:id/git. Mirrors
+// services/git_meta.ts on the server. branch=null means "not a git repo".
+export interface GitMeta {
+  branch: string | null;
+  is_dirty: boolean;
+  ahead: number;
+  behind: number;
+}
+
+// Batch 9.6: skill catalog row. Returned by GET /api/skills and consumed by
+// the slash-command dropdown. `path` and `mtime` are exposed for debug surface
+// (/api/skills) but the dropdown only renders name + description.
+export interface Skill {
+  name: string;
+  description: string;
+  path: string;
+  mtime: number;
+}
+
+// v1.9: 'settings' is an ephemeral pane kind — never persisted, always
+// singleton per workspace. The pane hook filters it out before writing to
+// localStorage and dedupes on insertion via toggleSettingsPane().
+export type WorkspacePaneKind = 'chat' | 'terminal' | 'agent' | 'empty' | 'settings';
+
+export interface WorkspacePane {
+  id: string;
+  kind: WorkspacePaneKind;
+  chatId?: string;
+  chatIds: string[];
+  activeChatIdx: number;
+}
+
 export type WsFrame =
   | { type: 'snapshot'; messages: Message[] }
-  | { type: 'message_started'; message_id: string; role: MessageRole }
-  | { type: 'delta'; message_id: string; content: string }
-  | { type: 'tool_call'; message_id: string; tool_call: ToolCall }
+  | { type: 'message_started'; message_id: string; chat_id?: string; role: MessageRole }
+  | { type: 'delta'; message_id: string; chat_id?: string; content: string }
+  | { type: 'tool_call'; message_id: string; chat_id?: string; tool_call: ToolCall }
   | {
       type: 'tool_result';
       tool_message_id: string;
+      chat_id?: string;
       tool_call_id: string;
       output: unknown;
       truncated: boolean;
@@ -143,12 +271,19 @@ export type WsFrame =
   | {
       type: 'message_complete';
       message_id: string;
+      chat_id?: string;
       tokens_used?: number | null;
       ctx_used?: number | null;
       ctx_max?: number | null;
       started_at?: string | null;
       finished_at?: string | null;
+      // v1.8.2: piggybacks the persisted metadata onto the terminal frame so
+      // cap-hit sentinels (and any future stamped-on-complete metadata) flow
+      // to the client without a refetch.
+      metadata?: MessageMetadata | null;
     }
-  | { type: 'messages_deleted'; message_ids: string[] }
-  | { type: 'session_renamed'; session_id: string; name: string }
-  | { type: 'error'; message_id?: string; error: string };
+  | { type: 'messages_deleted'; message_ids: string[]; chat_id?: string }
+  | { type: 'chat_renamed'; chat_id: string; name: string }
+  // v1.8.2: `reason` discriminates structured failures (the UI prefers it
+  // over `error` text when present).
+  | { type: 'error'; message_id?: string; chat_id?: string; error: string; reason?: ErrorReason };

apps/web/src/components/AddProjectModal.tsx

@@ -1,7 +1,6 @@
 import { useEffect, useState } from 'react';
 import { api } from '@/api/client';
 import type { AvailableProject } from '@/api/types';
-import { sessionEvents } from '@/hooks/sessionEvents';
 import { Button } from '@/components/ui/button';
 import {
   Dialog,
@@ -43,8 +42,8 @@ export function AddProjectModal({ open, onOpenChange, onAdded }: Props) {
     setBusy(true);
     setError(null);
     try {
-      const created = await api.projects.add({ path });
-      sessionEvents.emit({ type: 'project_created', project: created });
+      await api.projects.add({ path });
+      // Server publishes project_created via WS; let useUserEvents deliver it.
       onAdded();
       onOpenChange(false);
     } catch (err) {

apps/web/src/components/AgentPicker.tsx

@@ -0,0 +1,121 @@
+import { useEffect, useState } from 'react';
+import { Check, ChevronDown } from 'lucide-react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import type { Agent, AgentParseError } from '@/api/types';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+
+interface Props {
+  projectId: string;
+  value: string | null;
+  onChange: (agentId: string | null) => void | Promise<void>;
+}
+
+export function AgentPicker({ projectId, value, onChange }: Props) {
+  const [agents, setAgents] = useState<Agent[] | null>(null);
+  const [parseErrors, setParseErrors] = useState<AgentParseError[]>([]);
+  const [error, setError] = useState<string | null>(null);
+  const [open, setOpen] = useState(false);
+
+  // v1.8.1: per-agent parse errors are non-blocking. Silent if any agents
+  // loaded successfully; a gray warning toast fires only when EVERY agent
+  // in AGENTS.md failed to parse. Server logs a console.warn either way.
+  useEffect(() => {
+    let cancelled = false;
+    setAgents(null);
+    setParseErrors([]);
+    setError(null);
+    api.agents
+      .list(projectId)
+      .then((res) => {
+        if (cancelled) return;
+        setAgents(res.agents);
+        setParseErrors(res.errors);
+        if (res.errors.length > 0 && res.agents.length === 0) {
+          toast.warning(
+            `AGENTS.md: ${res.errors.length} agent${res.errors.length === 1 ? '' : 's'} failed to parse, none loaded`,
+          );
+        }
+      })
+      .catch((err) => {
+        if (cancelled) return;
+        setError(err instanceof Error ? err.message : 'failed to load agents');
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [projectId]);
+
+  const selectedAgent = agents?.find((a) => a.id === value) ?? null;
+  const triggerLabel = value === null
+    ? 'No agent'
+    : selectedAgent?.name ?? value;
+
+  return (
+    <DropdownMenu open={open} onOpenChange={setOpen}>
+      <DropdownMenuTrigger asChild>
+        <button
+          type="button"
+          className="text-xs text-muted-foreground hover:text-foreground flex items-center gap-1 px-1.5 py-0.5 rounded hover:bg-muted/60"
+          title={selectedAgent?.description ?? undefined}
+        >
+          <span className="truncate max-w-[160px]">{triggerLabel}</span>
+          <ChevronDown className="size-3 opacity-70" />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="max-h-80 overflow-y-auto w-72">
+        {error && (
+          <div className="px-2 py-1.5 text-xs text-destructive">{error}</div>
+        )}
+        {agents === null && !error && (
+          <div className="px-2 py-1.5 text-xs text-muted-foreground">Loading…</div>
+        )}
+        {agents !== null && (
+          <>
+            <DropdownMenuItem
+              onSelect={() => void onChange(null)}
+              className="text-xs"
+            >
+              <Check className={`size-3 ${value === null ? 'opacity-100' : 'opacity-0'}`} />
+              <span className="font-medium">No agent</span>
+            </DropdownMenuItem>
+            {agents.length > 0 && <DropdownMenuSeparator />}
+            {agents.map((a) => (
+              <DropdownMenuItem
+                key={a.id}
+                onSelect={() => void onChange(a.id)}
+                className="text-xs flex-col items-start gap-0.5"
+              >
+                <div className="flex items-center gap-1.5">
+                  <Check
+                    className={`size-3 ${a.id === value ? 'opacity-100' : 'opacity-0'}`}
+                  />
+                  <span className="font-medium">{a.name}</span>
+                </div>
+                {a.description && (
+                  <span className="text-muted-foreground pl-[18px] truncate w-full">
+                    {a.description}
+                  </span>
+                )}
+              </DropdownMenuItem>
+            ))}
+            {parseErrors.length > 0 && (
+              <div
+                className="px-2 py-1.5 mt-1 text-xs text-amber-500 border-t border-border"
+                title={parseErrors.map((e) => `${e.agent_name}: ${e.reason}`).join('\n')}
+              >
+                {parseErrors.length} agent{parseErrors.length === 1 ? '' : 's'} skipped
+              </div>
+            )}
+          </>
+        )}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}

apps/web/src/components/AttachmentChip.tsx

@@ -0,0 +1,41 @@
+import { FileText, X } from 'lucide-react';
+import type { Attachment } from '@/lib/attachments';
+
+interface Props {
+  attachment: Attachment;
+  onRemove: (id: string) => void;
+  onPreview: (attachment: Attachment) => void;
+}
+
+export function AttachmentChip({ attachment, onRemove, onPreview }: Props) {
+  const lineCount = attachment.content.split('\n').length;
+
+  const label =
+    attachment.kind === 'lines' && attachment.range
+      ? `${attachment.filename}:${attachment.range[0]}-${attachment.range[1]}`
+      : attachment.filename;
+
+  return (
+    <div className="flex items-center gap-1.5 bg-muted/60 border border-border rounded px-2 py-0.5 text-xs font-mono">
+      <button
+        type="button"
+        onClick={() => onPreview(attachment)}
+        className="flex items-center gap-1.5 hover:bg-muted/60 transition-colors min-w-0"
+      >
+        <FileText className="size-3 shrink-0 text-muted-foreground" />
+        <span className="truncate max-w-[200px]">{label}</span>
+        <span className="text-muted-foreground whitespace-nowrap">
+          +{lineCount} lines
+        </span>
+      </button>
+      <button
+        type="button"
+        onClick={() => onRemove(attachment.id)}
+        className="ml-0.5 rounded hover:bg-muted-foreground/20 p-0.5 shrink-0"
+        aria-label="Remove attachment"
+      >
+        <X className="size-3" />
+      </button>
+    </div>
+  );
+}

apps/web/src/components/AttachmentPreviewModal.tsx

@@ -0,0 +1,37 @@
+import type { Attachment } from '@/lib/attachments';
+import { CodeBlock } from '@/components/CodeBlock';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+
+interface Props {
+  attachment: Attachment | null;
+  onClose: () => void;
+}
+
+export function AttachmentPreviewModal({ attachment, onClose }: Props) {
+  const title = attachment
+    ? attachment.kind === 'lines' && attachment.range
+      ? `${attachment.filename}:${attachment.range[0]}-${attachment.range[1]}`
+      : attachment.filename
+    : '';
+
+  return (
+    <Dialog open={attachment !== null} onOpenChange={() => onClose()}>
+      <DialogContent className="sm:max-w-2xl max-h-[80vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle className="font-mono text-sm">{title}</DialogTitle>
+        </DialogHeader>
+        {attachment && (
+          <CodeBlock
+            code={attachment.content}
+            lang={attachment.language ?? undefined}
+          />
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}

apps/web/src/components/BottomSheet.tsx

@@ -0,0 +1,92 @@
+import { useEffect, useRef, useState, type ReactNode, type TouchEvent } from 'react';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  open: boolean;
+  onClose: () => void;
+  children: ReactNode;
+  title?: string;
+}
+
+// Past this drag distance, release dismisses the sheet.
+const SWIPE_DISMISS_THRESHOLD_PX = 80;
+
+export function BottomSheet({ open, onClose, children, title }: Props) {
+  const [dragY, setDragY] = useState(0);
+  const startYRef = useRef<number | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') onClose();
+    };
+    window.addEventListener('keydown', onKey);
+    return () => window.removeEventListener('keydown', onKey);
+  }, [open, onClose]);
+
+  useEffect(() => {
+    if (!open) {
+      setDragY(0);
+      startYRef.current = null;
+    }
+  }, [open]);
+
+  function onTouchStart(e: TouchEvent<HTMLDivElement>) {
+    const t = e.touches[0];
+    if (!t) return;
+    startYRef.current = t.clientY;
+  }
+  function onTouchMove(e: TouchEvent<HTMLDivElement>) {
+    const t = e.touches[0];
+    if (!t || startYRef.current === null) return;
+    const dy = t.clientY - startYRef.current;
+    // Clamp to downward drags so the sheet doesn't "rubber-band" up.
+    if (dy > 0) setDragY(dy);
+  }
+  function onTouchEnd() {
+    if (dragY > SWIPE_DISMISS_THRESHOLD_PX) {
+      onClose();
+    } else {
+      setDragY(0);
+    }
+    startYRef.current = null;
+  }
+
+  if (!open) return null;
+
+  return (
+    <>
+      <div
+        className="fixed inset-0 z-40 bg-black/40"
+        onClick={onClose}
+        aria-hidden="true"
+      />
+      <div
+        role="dialog"
+        aria-modal="true"
+        className={cn(
+          'fixed inset-x-0 bottom-0 z-50 rounded-t-2xl border-t border-border bg-popover text-popover-foreground shadow-2xl',
+          'transition-transform duration-150 will-change-transform',
+          'max-h-[70vh] flex flex-col',
+        )}
+        style={{
+          transform: `translateY(${dragY}px)`,
+          paddingBottom: 'env(safe-area-inset-bottom)',
+        }}
+      >
+        <div
+          onTouchStart={onTouchStart}
+          onTouchMove={onTouchMove}
+          onTouchEnd={onTouchEnd}
+          className="flex flex-col items-center pt-2 pb-1 select-none touch-none"
+        >
+          <div className="w-10 h-1 bg-muted-foreground/40 rounded-full" />
+          {title && (
+            <div className="mt-1 text-sm font-medium text-muted-foreground">{title}</div>
+          )}
+        </div>
+        <div className="flex-1 overflow-y-auto">{children}</div>
+      </div>
+    </>
+  );
+}

apps/web/src/components/CapHitSentinel.tsx

@@ -0,0 +1,90 @@
+import { useState } from 'react';
+import { AlertCircle } from 'lucide-react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import type { Message } from '@/api/types';
+import { Button } from '@/components/ui/button';
+
+interface Props {
+  message: Message;
+  // 1-indexed position among cap-hit sentinels in this chat. The first
+  // cap-hit is 1, second is 2, third is 3 (hard ceiling).
+  capHitPosition: number;
+  // Only the most recent sentinel shows the Continue button. Older ones
+  // render text-only — they've already been continued past.
+  isLatest: boolean;
+}
+
+// Hard ceiling = 3 cap-hits per chat ⇒ 2 continues max. Lives here in sync
+// with insertCapHitSentinel's `canContinue = priorCount < 2` rule in
+// services/inference.ts.
+const MAX_CONTINUES = 2;
+
+export function CapHitSentinel({ message, capHitPosition, isLatest }: Props) {
+  const meta = message.metadata;
+  // Defensive parse — if the row is somehow missing metadata we still render
+  // the bare text rather than crashing the chat.
+  const isCapHit =
+    meta !== null && typeof meta === 'object' && meta.kind === 'cap_hit';
+
+  const limit = isCapHit ? meta.limit : null;
+  const canContinue = isCapHit ? meta.can_continue : false;
+  const agentName = isCapHit ? meta.agent_name : null;
+  // `capHitPosition` is 1-indexed; `MAX_CONTINUES - (position - 1)` is the
+  // number of continues remaining including this one. Clamped to ≥0.
+  const remaining = Math.max(0, MAX_CONTINUES - (capHitPosition - 1));
+
+  const [continuing, setContinuing] = useState(false);
+
+  async function handleContinue() {
+    if (continuing || !canContinue || !isLatest) return;
+    setContinuing(true);
+    try {
+      await api.chats.continue(message.chat_id, message.id);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'continue failed');
+    } finally {
+      setContinuing(false);
+    }
+  }
+
+  // Tooltip wording from the v1.8.2 spec. Disabled state takes precedence —
+  // the spec text "Hard limit reached — start a new chat" matches what the
+  // server returns when canContinue is false.
+  const enabledTooltip = limit
+    ? `Resumes with a fresh budget of ${limit} tool calls. ${remaining} continue${remaining === 1 ? '' : 's'} remaining on this chat.`
+    : undefined;
+  const disabledTooltip = 'Hard limit reached — start a new chat';
+
+  return (
+    <div className="rounded-md border border-amber-500/40 bg-amber-500/10 text-sm">
+      <div className="px-3 py-2 flex items-start gap-2">
+        <AlertCircle className="size-4 text-amber-500 shrink-0 mt-0.5" />
+        <div className="flex-1 min-w-0 space-y-1">
+          <div className="text-xs font-medium text-amber-700 dark:text-amber-300">
+            {isCapHit && limit !== null
+              ? `Reached tool budget (${limit}/${limit})${agentName ? ` — ${agentName}` : ''}.`
+              : 'Reached tool budget.'}
+          </div>
+          <div className="text-xs text-muted-foreground">
+            {message.content}
+          </div>
+          {isLatest && (
+            <div className="pt-1">
+              <Button
+                type="button"
+                size="sm"
+                variant="outline"
+                onClick={() => void handleContinue()}
+                disabled={!canContinue || continuing}
+                title={canContinue ? enabledTooltip : disabledTooltip}
+              >
+                {continuing ? 'Continuing…' : 'Continue'}
+              </Button>
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/src/components/ChatContextPopover.tsx

@@ -0,0 +1,55 @@
+import type { ChatContextStats } from '@/hooks/useChatContextStats';
+
+interface Props {
+  stats: ChatContextStats | null;
+}
+
+/**
+ * Formats a token count into a compact k/m-suffix string.
+ *  - < 1_000          → raw integer (e.g. "42")
+ *  - 1_000–999_999    → "Nk" or "N.Nk" (e.g. "30k", "12.5k", "100k")
+ *  - >= 1_000_000     → "Nm" or "N.Nm" (e.g. "1m", "1.5m", "100m")
+ *
+ * Drops a trailing ".0" so we get "30k" instead of "30.0k".
+ */
+function formatTokens(n: number): string {
+  if (n < 1000) return String(n);
+  if (n < 1_000_000) {
+    const k = n / 1000;
+    return k >= 100 ? `${Math.round(k)}k` : `${k.toFixed(1).replace(/\.0$/, '')}k`;
+  }
+  const m = n / 1_000_000;
+  return m >= 100 ? `${Math.round(m)}m` : `${m.toFixed(1).replace(/\.0$/, '')}m`;
+}
+
+/**
+ * Color thresholds:
+ *  - >  85%  → text-destructive
+ *  - >= 60%  → text-amber-500
+ *  - else    → text-muted-foreground
+ * (85% itself falls into the amber band.)
+ */
+function percentColorClass(percent: number): string {
+  if (percent > 85) return 'text-destructive';
+  if (percent >= 60) return 'text-amber-500';
+  return 'text-muted-foreground';
+}
+
+export function ChatContextPopover({ stats }: Props) {
+  if (!stats) return null;
+  return (
+    <div className="absolute bottom-full right-4 mb-4 z-20 pointer-events-none">
+      <div className="rounded-md border border-border bg-card text-card-foreground shadow-sm px-3 py-2 text-xs min-w-[140px]">
+        <div className="text-muted-foreground/80 text-[10px] uppercase tracking-wide mb-0.5">
+          Context window
+        </div>
+        <div className={`text-base font-medium ${percentColorClass(stats.percent)}`}>
+          {stats.percent}% used
+        </div>
+        <div className="text-muted-foreground text-[10px] font-mono">
+          {formatTokens(stats.used)} / {formatTokens(stats.max)} tokens
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/src/components/ChatInput.tsx

@@ -1,25 +1,151 @@
-import { useState, type KeyboardEvent } from 'react';
-import { Send } from 'lucide-react';
+import { useCallback, useEffect, useMemo, useRef, useState, type DragEvent, type KeyboardEvent } from 'react';
+import { Check, Plus, Send } from 'lucide-react';
 import { toast } from 'sonner';
 import { Textarea } from '@/components/ui/textarea';
 import { Button } from '@/components/ui/button';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import {
+  flattenToMessage,
+  inferLanguage,
+  looksBinary,
+  MAX_FILE_SIZE_BYTES,
+  PASTE_INLINE_MAX_LINES,
+  type Attachment,
+} from '@/lib/attachments';
+import { AttachmentChip } from '@/components/AttachmentChip';
+import { AttachmentPreviewModal } from '@/components/AttachmentPreviewModal';
+import { FileMentionPopover } from '@/components/FileMentionPopover';
+import { DropOverlay } from '@/components/DropOverlay';
+import { AgentPicker } from '@/components/AgentPicker';
+import { SkillSlashCommand } from '@/components/SkillSlashCommand';
+import { api } from '@/api/client';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { useSkills } from '@/hooks/useSkills';
+import { useViewport } from '@/hooks/useViewport';
+
+const MAX_ATTACHMENTS = 10;
 
 interface Props {
   disabled?: boolean;
+  projectId: string;
+  // Batch 9: optional so callers that pre-date the agent picker still compile.
+  // When omitted, the toolbar row is hidden entirely.
+  agentId?: string | null;
+  onAgentChange?: (agentId: string | null) => void | Promise<void>;
+  // v1.9: when sessionId + webSearchEnabled are both provided, the + menu
+  // renders next to the AgentPicker with a single "Web search" toggle item.
+  // The check reflects the *stored* session value (not the effective one):
+  // null counts as unchecked. Clicking PATCHes session.web_search_enabled
+  // with the inverted boolean (null → true, true → false, false → true).
+  sessionId?: string;
+  webSearchEnabled?: boolean | null;
   onSend: (content: string) => void | Promise<void>;
+  onForceSend?: (content: string) => void | Promise<void>;
+  // Batch 9.6: slash-command dispatch. When the input parses to a known skill,
+  // ChatInput calls this with the skill name + the post-name args (possibly
+  // empty). Callers wire this to api.chats.skillInvoke. Omitting the prop
+  // disables slash-command dispatch (input is sent as literal text).
+  onSlashCommand?: (skillName: string, userMessage: string) => void | Promise<void>;
 }
 
-export function ChatInput({ disabled, onSend }: Props) {
+export function ChatInput({ disabled, projectId, agentId, onAgentChange, sessionId, webSearchEnabled, onSend, onForceSend, onSlashCommand }: Props) {
+  const { isMobile } = useViewport();
   const [value, setValue] = useState('');
   const [busy, setBusy] = useState(false);
+  const [attachments, setAttachments] = useState<Attachment[]>([]);
+  const [previewAttachment, setPreviewAttachment] = useState<Attachment | null>(null);
+  const [isDraggingOver, setIsDraggingOver] = useState(false);
+  const dropRootRef = useRef<HTMLDivElement | null>(null);
+  const pasteCounterRef = useRef(0);
+  const [mentionState, setMentionState] = useState<{
+    open: boolean;
+    query: string;
+    atIdx: number;
+    anchorRect: { top: number; left: number };
+  } | null>(null);
+  // Batch 9.6: slash-command dropdown. Opens when `/` is the first char of
+  // the input and stays open while the input is `/<word>` with no whitespace.
+  // Disabled entirely when the caller doesn't pass onSlashCommand.
+  const [slashState, setSlashState] = useState<{
+    query: string;
+    anchorRect: { top: number; left: number };
+  } | null>(null);
+  const { skills } = useSkills();
+  const skillsLookup = useMemo(() => {
+    const m = new Map<string, true>();
+    for (const s of skills) m.set(s.name, true);
+    return m;
+  }, [skills]);
+  const [fileIndex, setFileIndex] = useState<string[] | null>(null);
+  const textareaRef = useRef<HTMLTextAreaElement | null>(null);
+
+  function addAttachment(a: Attachment) {
+    setAttachments(prev => {
+      if (prev.length >= MAX_ATTACHMENTS) {
+        toast.error(`Max ${MAX_ATTACHMENTS} attachments per message`);
+        return prev;
+      }
+      return [...prev, a];
+    });
+  }
+
+  const addAttachmentRef = useRef(addAttachment);
+  addAttachmentRef.current = addAttachment;
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type !== 'attach_chat_file') return;
+      addAttachmentRef.current({
+        id: crypto.randomUUID(),
+        ...event.attachment,
+      });
+    });
+  }, []);
+
+  function removeAttachment(id: string) {
+    setAttachments(prev => prev.filter(a => a.id !== id));
+  }
 
   async function submit() {
     const text = value.trim();
-    if (!text || disabled || busy) return;
+    if (!text && attachments.length === 0) return;
+    if (disabled || busy) return;
+
+    // Batch 9.6: slash-command dispatch. Only when no attachments and the
+    // input parses to a known skill. Falls through to onSend for unknown
+    // slash names (literal text) or when slash dispatch isn't wired.
+    if (onSlashCommand && attachments.length === 0 && text.startsWith('/')) {
+      const match = text.match(/^\/(\S+)\s*([\s\S]*)$/);
+      if (match && skillsLookup.has(match[1]!)) {
+        const skillName = match[1]!;
+        const args = (match[2] ?? '').trim();
+        setBusy(true);
+        try {
+          await onSlashCommand(skillName, args);
+          setValue('');
+          setAttachments([]);
+          setSlashState(null);
+        } catch (err) {
+          toast.error(err instanceof Error ? err.message : 'skill invocation failed');
+        } finally {
+          setBusy(false);
+        }
+        return;
+      }
+      // Unknown skill name — fall through and send as literal text.
+    }
+
     setBusy(true);
     try {
-      await onSend(text);
+      const body = flattenToMessage(attachments, text);
+      await onSend(body);
       setValue('');
+      setAttachments([]);
     } catch (err) {
       toast.error(err instanceof Error ? err.message : 'failed to send');
     } finally {
@@ -27,32 +153,464 @@ export function ChatInput({ disabled, onSend }: Props) {
     }
   }
 
+  function handleSlashSelect(skillName: string) {
+    const next = `/${skillName} `;
+    setValue(next);
+    setSlashState(null);
+    requestAnimationFrame(() => {
+      const ta = textareaRef.current;
+      if (ta) {
+        ta.selectionStart = ta.selectionEnd = next.length;
+        ta.focus();
+      }
+    });
+  }
+
+  function getCaretCoords(textarea: HTMLTextAreaElement): { top: number; left: number } {
+    const mirror = document.createElement('div');
+    const style = window.getComputedStyle(textarea);
+
+    const properties = [
+      'fontFamily', 'fontSize', 'fontWeight', 'fontStyle',
+      'letterSpacing', 'lineHeight', 'textTransform', 'wordSpacing',
+      'textIndent', 'paddingTop', 'paddingRight', 'paddingBottom', 'paddingLeft',
+      'borderTopWidth', 'borderRightWidth', 'borderBottomWidth', 'borderLeftWidth',
+      'boxSizing', 'whiteSpace', 'overflowWrap',
+    ] as const;
+
+    mirror.style.position = 'absolute';
+    mirror.style.visibility = 'hidden';
+    mirror.style.overflow = 'hidden';
+    mirror.style.width = style.width;
+    for (const prop of properties) {
+      mirror.style[prop] = style[prop];
+    }
+    mirror.style.whiteSpace = 'pre-wrap';
+    mirror.style.overflowWrap = 'break-word';
+
+    const textBefore = textarea.value.slice(0, textarea.selectionStart);
+    mirror.textContent = textBefore;
+
+    const span = document.createElement('span');
+    span.textContent = '​'; // zero-width space
+    mirror.appendChild(span);
+
+    document.body.appendChild(mirror);
+
+    const taRect = textarea.getBoundingClientRect();
+    const spanRect = span.getBoundingClientRect();
+    const mirrorRect = mirror.getBoundingClientRect();
+
+    const top = taRect.top + (spanRect.top - mirrorRect.top) - textarea.scrollTop + span.offsetHeight;
+    const left = taRect.left + (spanRect.left - mirrorRect.left);
+
+    document.body.removeChild(mirror);
+
+    return { top, left };
+  }
+
+  function handleChange(e: React.ChangeEvent<HTMLTextAreaElement>) {
+    const newValue = e.target.value;
+    setValue(newValue);
+
+    const ta = e.target;
+    const pos = ta.selectionStart;
+
+    // Batch 9.6: slash-command trigger. Active while the input is a single
+    // slash-prefixed token with no whitespace (i.e. user is still typing the
+    // skill name). Hand off to args mode the moment a space appears or the
+    // slash leaves position 0.
+    if (onSlashCommand && /^\/[^\s]*$/.test(newValue)) {
+      const query = newValue.slice(1);
+      if (!slashState) {
+        const rect = ta.getBoundingClientRect();
+        setSlashState({ query, anchorRect: { top: rect.top, left: rect.left } });
+      } else if (slashState.query !== query) {
+        setSlashState({ ...slashState, query });
+      }
+      if (mentionState?.open) setMentionState(null);
+      return;
+    }
+    if (slashState) setSlashState(null);
+
+    // Check for @ trigger
+    if (pos > 0 && newValue[pos - 1] === '@') {
+      const charBefore = pos >= 2 ? newValue[pos - 2] : null;
+      if (charBefore === null || charBefore === ' ' || charBefore === '\n') {
+        const coords = getCaretCoords(ta);
+        setMentionState({ open: true, query: '', atIdx: pos - 1, anchorRect: coords });
+        if (!fileIndex) {
+          api.projects.files(projectId).then(r => setFileIndex(r.files)).catch(() => {});
+        }
+        return;
+      }
+    }
+
+    // Update query if popover is open — use stored atIdx
+    if (mentionState?.open) {
+      const { atIdx } = mentionState;
+      if (atIdx < pos && newValue[atIdx] === '@') {
+        const query = newValue.slice(atIdx + 1, pos);
+        setMentionState(prev => prev ? { ...prev, query } : null);
+      } else {
+        setMentionState(null);
+      }
+    }
+  }
+
+  async function handleMentionSelect(path: string) {
+    const atIdx = mentionState?.atIdx ?? -1;
+    const ta = textareaRef.current;
+    const caretPos = ta?.selectionStart ?? value.length;
+    setMentionState(null);
+
+    try {
+      const result = await api.projects.viewFile(projectId, path);
+      if (atIdx >= 0) {
+        const cleaned = value.slice(0, atIdx) + value.slice(caretPos);
+        setValue(cleaned);
+        if (ta) {
+          requestAnimationFrame(() => {
+            ta.selectionStart = ta.selectionEnd = atIdx;
+            ta.focus();
+          });
+        }
+      }
+      addAttachment({
+        id: crypto.randomUUID(),
+        kind: 'file',
+        filename: path,
+        language: inferLanguage(path),
+        content: result.content,
+        source: '@',
+      });
+    } catch {
+      toast.error('Failed to load file');
+    }
+  }
+
+  const closeMention = useCallback(() => setMentionState(null), []);
+
+  // ---- Drag & drop (F1 + F3 + F4) ----------------------------------------
+  // The drop zone is the outer ChatInput container (ref'd as dropRootRef).
+  // onDragLeave only clears the highlight when the cursor leaves the
+  // container, not when it crosses into a child element.
+
+  async function processDroppedFile(file: File) {
+    // Size gate
+    if (file.size > MAX_FILE_SIZE_BYTES) {
+      const mb = (file.size / (1024 * 1024)).toFixed(1);
+      toast.error(`File ${file.name} is too large (${mb} MB). Limit is 5 MB.`);
+      return;
+    }
+    // Read once as ArrayBuffer so we can do byte-level binary detection
+    // before deciding whether to decode as text.
+    let buf: ArrayBuffer;
+    try {
+      buf = await file.arrayBuffer();
+    } catch (err) {
+      toast.error(`Failed to read ${file.name}: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    if (looksBinary(buf)) {
+      toast.error(`${file.name} appears to be binary.`);
+      return;
+    }
+    const text = new TextDecoder('utf-8', { fatal: false }).decode(buf);
+    addAttachment({
+      id: crypto.randomUUID(),
+      kind: 'file',
+      filename: file.name,
+      language: inferLanguage(file.name),
+      content: text,
+      source: 'drop',
+    });
+  }
+
+  function isFolderItem(item: DataTransferItem | undefined): boolean {
+    if (!item) return false;
+    // webkitGetAsEntry is non-standard but supported in Chromium + Safari.
+    // If unavailable, we conservatively treat the entry as a file.
+    const entry =
+      typeof item.webkitGetAsEntry === 'function' ? item.webkitGetAsEntry() : null;
+    if (entry && entry.isDirectory) return true;
+    // Heuristic fallback: folders dragged from Finder have type === '' and
+    // a 0-byte File. The empty-type alone isn't reliable for files (some
+    // plaintext drops also lack a type), so we only flag when the entry
+    // explicitly says directory.
+    return false;
+  }
+
+  async function handleDroppedItems(dt: DataTransfer) {
+    // Snapshot items first because reading files inside the loop can
+    // detach the DataTransfer between awaits.
+    const itemsArray: { file: File | null; isFolder: boolean }[] = [];
+    if (dt.items && dt.items.length > 0) {
+      for (let i = 0; i < dt.items.length; i++) {
+        const it = dt.items[i];
+        if (!it || it.kind !== 'file') continue;
+        const folder = isFolderItem(it);
+        const file = folder ? null : it.getAsFile();
+        itemsArray.push({ file, isFolder: folder });
+      }
+    } else {
+      for (let i = 0; i < dt.files.length; i++) {
+        const f = dt.files[i];
+        if (f) itemsArray.push({ file: f, isFolder: false });
+      }
+    }
+
+    let remainingSlots = MAX_ATTACHMENTS - attachments.length;
+    let folderRejected = false;
+    for (const { file, isFolder } of itemsArray) {
+      if (isFolder) {
+        if (!folderRejected) {
+          toast.error('Folders are not supported');
+          folderRejected = true;
+        }
+        continue;
+      }
+      if (!file) continue;
+      if (remainingSlots <= 0) {
+        toast.error(`Attachment limit reached (${MAX_ATTACHMENTS}).`);
+        return;
+      }
+      await processDroppedFile(file);
+      remainingSlots -= 1;
+    }
+  }
+
+  function onDragEnter(e: DragEvent<HTMLDivElement>) {
+    if (disabled || busy) return;
+    e.preventDefault();
+    setIsDraggingOver(true);
+  }
+
+  function onDragOver(e: DragEvent<HTMLDivElement>) {
+    if (disabled || busy) return;
+    e.preventDefault();
+    e.dataTransfer.dropEffect = 'copy';
+  }
+
+  function onDragLeave(e: DragEvent<HTMLDivElement>) {
+    // Only clear when the cursor actually leaves the root container.
+    // relatedTarget is the element being entered; if it's inside the root,
+    // ignore — we're just crossing into a child.
+    const root = dropRootRef.current;
+    if (!root) return;
+    const related = e.relatedTarget as Node | null;
+    if (related && root.contains(related)) return;
+    setIsDraggingOver(false);
+  }
+
+  function onDrop(e: DragEvent<HTMLDivElement>) {
+    e.preventDefault();
+    setIsDraggingOver(false);
+    if (disabled || busy) return;
+    void handleDroppedItems(e.dataTransfer);
+  }
+  // ---- end Drag & drop -----------------------------------------------------
+
+  // ---- Paste-as-attachment (F2) -------------------------------------------
+  // Pasting >PASTE_INLINE_MAX_LINES lines of text becomes a chip rather than
+  // inline content. Image pastes are rejected with a toast. If both text and
+  // image are present (e.g. screenshot tool that sets both), prefer text.
+
+  function onPaste(e: React.ClipboardEvent<HTMLTextAreaElement>) {
+    const cd = e.clipboardData;
+    if (!cd) return;
+    const text = cd.getData('text/plain');
+    const hasImage = Array.from(cd.items ?? []).some((it) =>
+      it.type.startsWith('image/'),
+    );
+    if (text) {
+      const lineCount = text.split('\n').length;
+      if (lineCount > PASTE_INLINE_MAX_LINES) {
+        e.preventDefault();
+        pasteCounterRef.current += 1;
+        addAttachment({
+          id: crypto.randomUUID(),
+          kind: 'paste',
+          filename: `pasted-${pasteCounterRef.current}.txt`,
+          language: 'plaintext',
+          content: text,
+          source: 'paste',
+        });
+      }
+      // <= threshold: let default paste insert inline.
+      return;
+    }
+    if (hasImage) {
+      e.preventDefault();
+      toast.error('Image paste is not supported. Drop a file or paste text.');
+    }
+  }
+  // ---- end Paste-as-attachment --------------------------------------------
+
   function onKeyDown(e: KeyboardEvent<HTMLTextAreaElement>) {
-    if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
+    if (mentionState?.open) return;
+    // SkillSlashCommand owns Arrow/Enter/Tab/Esc via a document listener; let
+    // it consume them so the textarea doesn't also submit on Enter.
+    if (slashState) return;
+    // IME safety: never act on Enter while an IME composition is in flight
+    // (CJK input methods commit composition via Enter). Without this, the
+    // first Enter of a Japanese/Chinese/Korean composition would submit
+    // instead of finalizing the candidate.
+    if (e.nativeEvent.isComposing) return;
+    if (e.key === 'Enter' && e.shiftKey && (e.metaKey || e.ctrlKey) && onForceSend) {
+      e.preventDefault();
+      void forceSubmit();
+      return;
+    }
+    if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+      e.preventDefault();
+      void submit();
+      return;
+    }
+    // Bare Enter: sends on desktop, inserts a newline on mobile (per spec —
+    // send is via the dedicated button on touch devices).
+    if (e.key === 'Enter' && !e.shiftKey && !isMobile) {
       e.preventDefault();
       void submit();
     }
   }
 
+  async function forceSubmit() {
+    const text = value.trim();
+    if (!text || !onForceSend) return;
+    if (busy) return;
+    setBusy(true);
+    try {
+      const body = flattenToMessage(attachments, text);
+      await onForceSend(body);
+      setValue('');
+      setAttachments([]);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    } finally {
+      setBusy(false);
+    }
+  }
+
   return (
-    <div className="border-t px-4 py-3 flex items-end gap-2">
-      <Textarea
-        value={value}
-        onChange={(e) => setValue(e.target.value)}
-        onKeyDown={onKeyDown}
-        placeholder="Ask about this project. Cmd/Ctrl+Enter to send."
-        disabled={disabled || busy}
-        rows={3}
-        className="resize-none min-h-[68px] max-h-[240px]"
+    <div
+      ref={dropRootRef}
+      className="border-t relative"
+      style={{ paddingBottom: 'env(safe-area-inset-bottom)' }}
+      onDragEnter={onDragEnter}
+      onDragOver={onDragOver}
+      onDragLeave={onDragLeave}
+      onDrop={onDrop}
+    >
+      <DropOverlay visible={isDraggingOver} />
+      <div className="max-w-[1000px] mx-auto w-full">
+      {attachments.length > 0 && (
+        <div className="flex flex-wrap gap-1.5 px-4 pt-3">
+          {attachments.map(a => (
+            <AttachmentChip
+              key={a.id}
+              attachment={a}
+              onRemove={removeAttachment}
+              onPreview={setPreviewAttachment}
+            />
+          ))}
+        </div>
+      )}
+      {/* Batch 9 toolbar — agent picker. v1.9 adds the icon-only + menu next
+          to it for quick toggles (currently: Web search). When omitted at the
+          callsite the row stays collapsed so nothing else has to change. */}
+      {(onAgentChange || sessionId) && (
+        <div className="px-4 pt-2 flex items-center gap-1.5">
+          {onAgentChange && (
+            <AgentPicker
+              projectId={projectId}
+              value={agentId ?? null}
+              onChange={onAgentChange}
+            />
+          )}
+          {sessionId && (
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
+                <button
+                  type="button"
+                  aria-label="Quick toggles"
+                  title="Quick toggles"
+                  className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground"
+                >
+                  <Plus className="size-3.5" />
+                </button>
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="start">
+                <DropdownMenuItem
+                  onSelect={async () => {
+                    // v1.9: tri-state collapses to two on the wire when toggled
+                    // here. null (inherit) treated as off; click flips to true.
+                    // To restore "inherit" the user opens SettingsPane.
+                    const next = webSearchEnabled === true ? false : true;
+                    try {
+                      await api.sessions.update(sessionId, { web_search_enabled: next });
+                    } catch (err) {
+                      toast.error(err instanceof Error ? err.message : 'failed to toggle web search');
+                    }
+                  }}
+                  className="text-xs"
+                >
+                  <Check className={`size-3 ${webSearchEnabled === true ? 'opacity-100' : 'opacity-0'}`} />
+                  Web search
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+          )}
+        </div>
+      )}
+      <div className="px-4 py-3 flex items-end gap-2">
+        <Textarea
+          ref={textareaRef}
+          value={value}
+          onChange={handleChange}
+          onKeyDown={onKeyDown}
+          onPaste={onPaste}
+          placeholder={
+            isMobile
+              ? 'Ask about this project. Tap send to submit.'
+              : 'Ask about this project. Enter to send · Shift+Enter for newline.'
+          }
+          disabled={disabled || busy}
+          rows={3}
+          className="resize-none min-h-[68px] max-h-[240px]"
+        />
+        <Button
+          onClick={() => void submit()}
+          disabled={disabled || busy || (!value.trim() && attachments.length === 0)}
+          size="icon-lg"
+          aria-label="Send"
+        >
+          <Send />
+        </Button>
+      </div>
+      </div>
+      <AttachmentPreviewModal
+        attachment={previewAttachment}
+        onClose={() => setPreviewAttachment(null)}
       />
-      <Button
-        onClick={() => void submit()}
-        disabled={disabled || busy || !value.trim()}
-        size="icon-lg"
-        aria-label="Send"
-      >
-        <Send />
-      </Button>
+      {mentionState?.open && (
+        <FileMentionPopover
+          query={mentionState.query}
+          files={fileIndex ?? []}
+          anchorRect={mentionState.anchorRect}
+          onSelect={handleMentionSelect}
+          onClose={closeMention}
+        />
+      )}
+      {slashState && (
+        <SkillSlashCommand
+          query={slashState.query}
+          skills={skills}
+          anchorRect={slashState.anchorRect}
+          onSelect={handleSlashSelect}
+          onClose={() => setSlashState(null)}
+        />
+      )}
     </div>
   );
 }

apps/web/src/components/ChatTabBar.tsx

@@ -0,0 +1,202 @@
+import { useState } from 'react';
+import { History, MessageSquare, Plus, X } from 'lucide-react';
+import type { Chat, WorkspacePane } from '@/api/types';
+import { StatusDot } from '@/components/StatusDot';
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import { useLongPress } from '@/hooks/useLongPress';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  pane: WorkspacePane;
+  tabs: Chat[];
+  onSwitchTab: (tabIdx: number) => void;
+  onRemoveTab: (chatId: string) => void;
+  onCloseOthers: (chatId: string) => void;
+  onCloseToRight: (chatId: string) => void;
+  onCloseAll: () => void;
+  onNewChat: () => void;
+  onShowHistory: () => void;
+  onRename: (chatId: string, name: string) => Promise<void>;
+  onRemovePane?: () => void;
+}
+
+export function ChatTabBar({
+  pane,
+  tabs,
+  onSwitchTab,
+  onRemoveTab,
+  onCloseOthers,
+  onCloseToRight,
+  onCloseAll,
+  onNewChat,
+  onShowHistory,
+  onRename,
+  onRemovePane,
+}: Props) {
+  const [renamingId, setRenamingId] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+
+  // Long-press: dispatch a synthetic contextmenu event on the tab so the
+  // existing Radix ContextMenuTrigger opens at the touch coordinates. Works
+  // because asChild composition makes the tab div the trigger element.
+  const longPress = useLongPress(({ clientX, clientY, target }) => {
+    if (!target || !(target instanceof Element)) return;
+    const tab = target.closest('[data-tab-id]') as HTMLElement | null;
+    if (!tab) return;
+    tab.dispatchEvent(
+      new MouseEvent('contextmenu', { bubbles: true, cancelable: true, clientX, clientY }),
+    );
+  });
+
+  function startRename(chatId: string, currentName: string | null) {
+    setRenamingId(chatId);
+    setRenameValue(currentName ?? '');
+  }
+
+  async function finishRename() {
+    if (renamingId && renameValue.trim()) {
+      await onRename(renamingId, renameValue.trim());
+    }
+    setRenamingId(null);
+  }
+
+  return (
+    <div className="flex items-center border-b border-border bg-muted/20 h-8 shrink-0 overflow-x-auto max-md:hidden">
+      {tabs.map((chat, tabIdx) => {
+        const isActive = tabIdx === pane.activeChatIdx;
+        const isLast = tabIdx === tabs.length - 1;
+        const onlyTab = tabs.length === 1;
+        const label = chat.name ?? 'New chat';
+        return (
+          <ContextMenu key={chat.id}>
+            <ContextMenuTrigger asChild>
+              <div
+                data-tab-id={chat.id}
+                onClick={() => onSwitchTab(tabIdx)}
+                onTouchStart={longPress.onTouchStart}
+                onTouchMove={longPress.onTouchMove}
+                onTouchEnd={longPress.onTouchEnd}
+                onTouchCancel={longPress.onTouchCancel}
+                style={{ WebkitTouchCallout: 'none' }}
+                className={cn(
+                  'group flex items-center gap-1.5 px-3 py-1.5 text-xs border-r border-border cursor-default select-none shrink-0',
+                  isActive
+                    ? 'bg-background text-foreground'
+                    : 'bg-muted/30 text-muted-foreground hover:bg-muted/60'
+                )}
+              >
+                <MessageSquare size={12} className="shrink-0" />
+                <StatusDot chatId={chat.id} />
+                {renamingId === chat.id ? (
+                  <input
+                    autoFocus
+                    value={renameValue}
+                    onChange={(e) => setRenameValue(e.target.value)}
+                    onBlur={() => void finishRename()}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter') void finishRename();
+                      if (e.key === 'Escape') setRenamingId(null);
+                    }}
+                    onClick={(e) => e.stopPropagation()}
+                    className="bg-transparent border-b border-border text-xs outline-none w-28"
+                  />
+                ) : (
+                  <span className="truncate max-w-[140px]" title={label}>
+                    {label}
+                  </span>
+                )}
+                <button
+                  type="button"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onRemoveTab(chat.id);
+                  }}
+                  className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded opacity-0 group-hover:opacity-60 hover:!opacity-100 shrink-0 max-md:min-h-[44px] max-md:min-w-[44px] max-md:opacity-100"
+                  aria-label="Close tab"
+                >
+                  <X size={10} />
+                </button>
+              </div>
+            </ContextMenuTrigger>
+            <ContextMenuContent>
+              <ContextMenuItem onSelect={() => onNewChat()}>
+                New chat
+              </ContextMenuItem>
+              <ContextMenuSeparator />
+              <ContextMenuItem onSelect={() => startRename(chat.id, chat.name)}>
+                Rename
+              </ContextMenuItem>
+              <ContextMenuSeparator />
+              <ContextMenuItem onSelect={() => onRemoveTab(chat.id)}>
+                Close
+              </ContextMenuItem>
+              <ContextMenuItem
+                disabled={onlyTab}
+                onSelect={() => onCloseOthers(chat.id)}
+              >
+                Close others
+              </ContextMenuItem>
+              <ContextMenuItem
+                disabled={isLast}
+                onSelect={() => onCloseToRight(chat.id)}
+              >
+                Close to right
+              </ContextMenuItem>
+              <ContextMenuItem onSelect={() => onCloseAll()}>
+                Close all
+              </ContextMenuItem>
+            </ContextMenuContent>
+          </ContextMenu>
+        );
+      })}
+
+      {tabs.length === 0 && (
+        <div className="flex items-center gap-1.5 px-3 py-1.5 text-xs text-muted-foreground">
+          <History size={12} className="shrink-0" />
+          <span>Session</span>
+        </div>
+      )}
+
+      <div className="flex items-center ml-auto gap-0.5 px-1 shrink-0">
+        <button
+          type="button"
+          onClick={onNewChat}
+          className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="New chat"
+          title="New chat"
+        >
+          <Plus size={12} />
+        </button>
+        <button
+          type="button"
+          onClick={onShowHistory}
+          className={cn(
+            'inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]',
+            pane.kind === 'empty' && 'text-foreground bg-muted/50'
+          )}
+          aria-label="Session history"
+          title="Session history"
+        >
+          <History size={12} />
+        </button>
+        {onRemovePane && (
+          <button
+            type="button"
+            onClick={onRemovePane}
+            className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Close pane"
+            title="Close pane"
+          >
+            <X size={12} />
+          </button>
+        )}
+      </div>
+    </div>
+  );
+}

apps/web/src/components/CreateProjectModal.tsx

@@ -0,0 +1,171 @@
+import { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+
+interface Props {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+function previewFolderName(raw: string): string {
+  return raw
+    .toLowerCase()
+    .trim()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64);
+}
+
+export function CreateProjectModal({ open, onOpenChange }: Props) {
+  const navigate = useNavigate();
+  const [name, setName] = useState('');
+  const [commitMessage, setCommitMessage] = useState('Initial commit');
+  const [visibility, setVisibility] = useState<'private' | 'public'>('private');
+  const [createRemote, setCreateRemote] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    setName('');
+    setCommitMessage('Initial commit');
+    setVisibility('private');
+    setCreateRemote(true);
+    setBusy(false);
+    setError(null);
+  }, [open]);
+
+  const folderPreview = previewFolderName(name);
+
+  async function submit() {
+    if (!folderPreview) {
+      setError('Project name must contain at least one letter or digit.');
+      return;
+    }
+    setBusy(true);
+    setError(null);
+    try {
+      const result = await api.projects.create({
+        name: name.trim(),
+        commit_message: commitMessage.trim() || 'Initial commit',
+        visibility,
+        create_gitea_remote: createRemote,
+      });
+      const warnings = result.bootstrap.warnings;
+      if (warnings.length > 0) {
+        toast.warning(`Project created with warnings: ${warnings.join('; ')}`);
+      } else {
+        toast.success(`Project "${result.project.name}" created`);
+      }
+      onOpenChange(false);
+      navigate(`/project/${result.project.id}`);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'failed to create project');
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Create New Project</DialogTitle>
+          <DialogDescription>
+            Creates a folder under /opt with a git repo, .gitignore, and optionally a Gitea remote.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-3">
+          <div className="space-y-1.5">
+            <Label htmlFor="proj-name">Project name</Label>
+            <Input
+              id="proj-name"
+              placeholder="My new project"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              disabled={busy}
+              autoFocus
+            />
+            {name && (
+              <div className="text-xs text-muted-foreground font-mono">
+                Folder: /opt/projects/{folderPreview || <span className="text-destructive">(empty after sanitization)</span>}
+              </div>
+            )}
+          </div>
+
+          <div className="space-y-1.5">
+            <Label htmlFor="commit-msg">Initial commit message</Label>
+            <Input
+              id="commit-msg"
+              value={commitMessage}
+              onChange={(e) => setCommitMessage(e.target.value)}
+              disabled={busy}
+            />
+          </div>
+
+          <div className="space-y-1.5">
+            <Label>Visibility</Label>
+            <div className="flex gap-4 text-sm">
+              <label className="flex items-center gap-1.5">
+                <input
+                  type="radio"
+                  checked={visibility === 'private'}
+                  onChange={() => setVisibility('private')}
+                  disabled={busy}
+                />
+                Private
+              </label>
+              <label className="flex items-center gap-1.5">
+                <input
+                  type="radio"
+                  checked={visibility === 'public'}
+                  onChange={() => setVisibility('public')}
+                  disabled={busy}
+                />
+                Public
+              </label>
+            </div>
+          </div>
+
+          <label className="flex items-center gap-2 text-sm">
+            <input
+              type="checkbox"
+              checked={createRemote}
+              onChange={(e) => setCreateRemote(e.target.checked)}
+              disabled={busy}
+            />
+            Create Gitea remote and push
+          </label>
+
+          {error && (
+            <div className="text-sm text-destructive">{error}</div>
+          )}
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={busy}>
+            Cancel
+          </Button>
+          <Button onClick={() => void submit()} disabled={busy || !folderPreview}>
+            {busy ? 'Creating…' : 'Create'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

apps/web/src/components/DropOverlay.tsx

@@ -0,0 +1,18 @@
+interface Props {
+  visible: boolean;
+}
+
+// Visual cue layered over the ChatInput while a drag is in progress.
+// Pointer-events: none so the underlying drop handler still receives the
+// drop event. Renders nothing when not visible (cheap and out of layout).
+export function DropOverlay({ visible }: Props) {
+  if (!visible) return null;
+  return (
+    <div
+      className="absolute inset-0 z-10 pointer-events-none flex items-center justify-center rounded border-2 border-dashed border-primary bg-background/85"
+      aria-hidden="true"
+    >
+      <div className="text-sm font-medium text-primary">Drop to attach</div>
+    </div>
+  );
+}

apps/web/src/components/FileMentionPopover.tsx

@@ -0,0 +1,145 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  query: string;
+  files: string[];
+  anchorRect: { top: number; left: number };
+  onSelect: (path: string) => void;
+  onClose: () => void;
+}
+
+function filterAndRank(files: string[], query: string): string[] {
+  const q = query.toLowerCase();
+  if (!q) {
+    return files.slice(0, 20);
+  }
+
+  const filenameMatches: string[] = [];
+  const pathOnlyMatches: string[] = [];
+
+  for (const file of files) {
+    const lower = file.toLowerCase();
+    if (!lower.includes(q)) continue;
+    const basename = file.split('/').pop() ?? file;
+    if (basename.toLowerCase().includes(q)) {
+      filenameMatches.push(file);
+    } else {
+      pathOnlyMatches.push(file);
+    }
+  }
+
+  filenameMatches.sort((a, b) => a.localeCompare(b));
+  pathOnlyMatches.sort((a, b) => a.localeCompare(b));
+
+  return [...filenameMatches, ...pathOnlyMatches].slice(0, 20);
+}
+
+export function FileMentionPopover({
+  query,
+  files,
+  anchorRect,
+  onSelect,
+  onClose,
+}: Props) {
+  const [highlightIndex, setHighlightIndex] = useState(0);
+  const popoverRef = useRef<HTMLDivElement>(null);
+  const filtered = useMemo(() => filterAndRank(files, query), [files, query]);
+
+  // Reset highlight when query changes
+  useEffect(() => {
+    setHighlightIndex(0);
+  }, [query]);
+
+  // Keyboard navigation
+  useEffect(() => {
+    function handleKeyDown(e: KeyboardEvent) {
+      if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        setHighlightIndex(prev =>
+          prev < filtered.length - 1 ? prev + 1 : 0
+        );
+      } else if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        setHighlightIndex(prev =>
+          prev > 0 ? prev - 1 : filtered.length - 1
+        );
+      } else if (e.key === 'Enter') {
+        e.preventDefault();
+        if (filtered.length > 0) {
+          onSelect(filtered[highlightIndex] ?? filtered[0]!);
+        }
+      } else if (e.key === 'Escape') {
+        e.preventDefault();
+        onClose();
+      }
+    }
+
+    document.addEventListener('keydown', handleKeyDown);
+    return () => document.removeEventListener('keydown', handleKeyDown);
+  }, [filtered, highlightIndex, onSelect, onClose]);
+
+  // Click outside to close
+  useEffect(() => {
+    function handleMouseDown(e: MouseEvent) {
+      if (
+        popoverRef.current &&
+        !popoverRef.current.contains(e.target as Node)
+      ) {
+        onClose();
+      }
+    }
+
+    document.addEventListener('mousedown', handleMouseDown);
+    return () => document.removeEventListener('mousedown', handleMouseDown);
+  }, [onClose]);
+
+  // Scroll highlighted item into view
+  useEffect(() => {
+    const el = popoverRef.current?.querySelector('[data-highlighted="true"]');
+    if (el) {
+      el.scrollIntoView({ block: 'nearest' });
+    }
+  }, [highlightIndex]);
+
+  if (filtered.length === 0) {
+    return (
+      <div
+        ref={popoverRef}
+        className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[260px] p-2"
+        style={{ top: anchorRect.top, left: anchorRect.left }}
+      >
+        <div className="text-xs text-muted-foreground px-2 py-1">
+          No matching files
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div
+      ref={popoverRef}
+      className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[260px] max-h-[240px] overflow-y-auto"
+      style={{ top: anchorRect.top, left: anchorRect.left }}
+    >
+      {filtered.map((file, i) => (
+        <button
+          key={file}
+          type="button"
+          data-highlighted={i === highlightIndex}
+          className={cn(
+            'w-full text-left text-xs font-mono px-2 py-1.5 cursor-pointer',
+            i === highlightIndex && 'bg-muted'
+          )}
+          onMouseEnter={() => setHighlightIndex(i)}
+          onMouseDown={(e) => {
+            e.preventDefault();
+            onSelect(file);
+          }}
+        >
+          {file}
+        </button>
+      ))}
+    </div>
+  );
+}

apps/web/src/components/FileViewerOverlay.tsx

@@ -0,0 +1,241 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { Check, Copy, X, Paperclip } from 'lucide-react';
+import { codeToHtml } from 'shiki';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { Button } from '@/components/ui/button';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  path: string;
+  content: string;
+  lang: string | null;
+  projectId: string;
+  onClose: () => void;
+  onNavigate: (path: string) => void;
+}
+
+const SHIKI_THEME = 'github-dark';
+
+function splitShikiLines(html: string): string[] {
+  const match = html.match(/<code[^>]*>([\s\S]*)<\/code>/);
+  if (!match) return [];
+  const inner = match[1]!;
+  const lines = inner.split(/(?=<span class="line">)/);
+  return lines.filter(l => l.trim().length > 0);
+}
+
+function basename(path: string): string {
+  const parts = path.split('/');
+  return parts[parts.length - 1] ?? path;
+}
+
+export function FileViewerOverlay({ path, content, lang, onClose }: Props) {
+  const [copied, setCopied] = useState(false);
+  const [lineHtmls, setLineHtmls] = useState<string[] | null>(null);
+  const [selectedLines, setSelectedLines] = useState<Set<number>>(new Set());
+  const [showAttachPopover, setShowAttachPopover] = useState(false);
+  const draggingRef = useRef(false);
+  const dragStartRef = useRef<number | null>(null);
+  const overlayRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    setSelectedLines(new Set());
+    setShowAttachPopover(false);
+    if (!lang) { setLineHtmls(null); return; }
+    let cancelled = false;
+    (async () => {
+      try {
+        const result = await codeToHtml(content, { lang, theme: SHIKI_THEME });
+        if (!cancelled) {
+          const lines = splitShikiLines(result);
+          setLineHtmls(lines.length > 0 ? lines : null);
+        }
+      } catch { if (!cancelled) setLineHtmls(null); }
+    })();
+    return () => { cancelled = true; };
+  }, [content, lang]);
+
+  const plainLines = content.split('\n');
+  const totalLines = lineHtmls ? lineHtmls.length : plainLines.length;
+
+  async function copyAll() {
+    try {
+      await navigator.clipboard.writeText(content);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1200);
+    } catch { /* ignore */ }
+  }
+
+  function handleLineMouseDown(lineNo: number, e: React.MouseEvent) {
+    if (e.shiftKey && dragStartRef.current !== null) {
+      const start = dragStartRef.current;
+      const min = Math.min(start, lineNo);
+      const max = Math.max(start, lineNo);
+      const next = new Set<number>();
+      for (let i = min; i <= max; i++) next.add(i);
+      setSelectedLines(next);
+      setShowAttachPopover(true);
+      return;
+    }
+    draggingRef.current = true;
+    dragStartRef.current = lineNo;
+    setSelectedLines(new Set([lineNo]));
+    setShowAttachPopover(false);
+  }
+
+  function handleLineMouseEnter(lineNo: number) {
+    if (!draggingRef.current || dragStartRef.current === null) return;
+    const start = dragStartRef.current;
+    const min = Math.min(start, lineNo);
+    const max = Math.max(start, lineNo);
+    const next = new Set<number>();
+    for (let i = min; i <= max; i++) next.add(i);
+    setSelectedLines(next);
+  }
+
+  const handleMouseUp = useCallback(() => {
+    if (draggingRef.current) {
+      draggingRef.current = false;
+      if (selectedLines.size > 0) setShowAttachPopover(true);
+    }
+  }, [selectedLines.size]);
+
+  useEffect(() => {
+    document.addEventListener('mouseup', handleMouseUp);
+    return () => document.removeEventListener('mouseup', handleMouseUp);
+  }, [handleMouseUp]);
+
+  useEffect(() => {
+    function handleClick(e: MouseEvent) {
+      if (overlayRef.current && !overlayRef.current.contains(e.target as Node)) {
+        onClose();
+      }
+    }
+    document.addEventListener('mousedown', handleClick);
+    return () => document.removeEventListener('mousedown', handleClick);
+  }, [onClose]);
+
+  useEffect(() => {
+    function handleKey(e: KeyboardEvent) {
+      if (e.key === 'Escape') onClose();
+    }
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [onClose]);
+
+  function getSelectionRange(): { min: number; max: number } | null {
+    if (selectedLines.size === 0) return null;
+    let min = Infinity;
+    let max = -Infinity;
+    for (const n of selectedLines) {
+      if (n < min) min = n;
+      if (n > max) max = n;
+    }
+    return { min, max };
+  }
+
+  function handleAttach() {
+    const range = getSelectionRange();
+    if (!range) return;
+    const lines = content.split('\n').slice(range.min - 1, range.max);
+    sessionEvents.emit({
+      type: 'attach_chat_file',
+      attachment: {
+        kind: 'lines',
+        filename: path,
+        language: lang,
+        content: lines.join('\n'),
+        range: [range.min, range.max],
+        source: 'line-select',
+      },
+    });
+    setSelectedLines(new Set());
+    setShowAttachPopover(false);
+  }
+
+  const range = getSelectionRange();
+  const attachLabel = range
+    ? range.min === range.max
+      ? `Attach line ${range.min} to chat`
+      : `Attach lines ${range.min}–${range.max} to chat`
+    : '';
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-start justify-center pt-12 pb-12">
+      <div className="absolute inset-0 bg-black/40" />
+      <div
+        ref={overlayRef}
+        className="relative bg-background border rounded-lg shadow-xl flex flex-col w-[80vw] max-w-[1000px] max-h-[80vh] overflow-hidden"
+      >
+        <div className="flex items-center gap-2 px-4 py-2 border-b shrink-0">
+          <span className="text-sm font-medium truncate flex-1" title={path}>
+            {basename(path)}
+          </span>
+          <span className="text-xs text-muted-foreground truncate">{path}</span>
+          <button
+            type="button"
+            onClick={() => void copyAll()}
+            className="flex items-center gap-1 text-xs px-2 py-1 rounded hover:bg-muted"
+          >
+            {copied ? <Check size={12} /> : <Copy size={12} />}
+            {copied ? 'Copied' : 'Copy'}
+          </button>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1 rounded hover:bg-muted"
+            aria-label="Close"
+          >
+            <X size={16} />
+          </button>
+        </div>
+
+        {/* Shiki-highlighted code lines are generated from source code files, not user content */}
+        <div className="flex-1 overflow-auto text-sm font-mono select-none">
+          {Array.from({ length: totalLines }, (_, i) => {
+            const lineNo = i + 1;
+            const isSelected = selectedLines.has(lineNo);
+            return (
+              <div
+                key={lineNo}
+                className={cn('flex', isSelected && 'bg-blue-500/10')}
+                onMouseDown={(e) => handleLineMouseDown(lineNo, e)}
+                onMouseEnter={() => handleLineMouseEnter(lineNo)}
+              >
+                <div
+                  className="shrink-0 w-[3.5ch] text-right pr-2 text-xs text-muted-foreground select-none cursor-pointer hover:text-foreground"
+                  style={{ fontVariantNumeric: 'tabular-nums' }}
+                >
+                  {lineNo}
+                </div>
+                {lineHtmls ? (
+                  <div
+                    className="flex-1 min-w-0 text-xs leading-relaxed [&>.line]:!bg-transparent"
+                    dangerouslySetInnerHTML={{ __html: lineHtmls[i] ?? '' }}
+                  />
+                ) : (
+                  <span className="flex-1 min-w-0 text-xs leading-relaxed whitespace-pre">
+                    {plainLines[i] ?? ''}
+                  </span>
+                )}
+              </div>
+            );
+          })}
+        </div>
+
+        {showAttachPopover && range && (
+          <div className="sticky bottom-0 border-t bg-background px-4 py-2 flex items-center gap-2">
+            <Paperclip size={14} className="text-muted-foreground" />
+            <span className="text-xs flex-1">{attachLabel}</span>
+            <Button size="sm" onClick={handleAttach}>
+              Attach
+            </Button>
+            <Button size="sm" variant="ghost" onClick={() => { setSelectedLines(new Set()); setShowAttachPopover(false); }}>
+              Cancel
+            </Button>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}

apps/web/src/components/MessageBubble.tsx

@@ -2,13 +2,31 @@ import { Children, cloneElement, isValidElement, useState } from 'react';
 import type { ReactElement, ReactNode } from 'react';
 import Markdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
-import { Copy, RefreshCw, Check } from 'lucide-react';
+import { ChevronDown, ChevronRight, Copy, RefreshCw, Check, Share2, RotateCw, GitFork, Trash2 } from 'lucide-react';
 import { toast } from 'sonner';
-import type { Message } from '@/api/types';
+import type { Chat, ErrorReason, Message } from '@/api/types';
 import { api } from '@/api/client';
 import { sessionEvents } from '@/hooks/sessionEvents';
-import { ToolCallCard } from './ToolCallCard';
+import { CapHitSentinel } from './CapHitSentinel';
 import { CodeBlock } from './CodeBlock';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+
+// v1.8.2: human labels for the machine-readable error reasons that ride on
+// failed assistant messages via metadata.kind === 'error'. Kept short so the
+// inline render under "message failed" stays a single muted line.
+const ERROR_REASON_LABELS: Record<ErrorReason, string> = {
+  llm_provider_error: 'LLM provider error',
+  tool_execution_failed: 'Tool execution failed',
+  summary_after_cap_failed: 'Summary after tool budget hit failed',
+};
 
 // Match path-shaped substrings ending in `.ext`. Additionally require a `/`
 // in the match to reduce false positives in prose (e.g. plain `foo.ts` won't
@@ -84,7 +102,10 @@ function linkifyChildren(children: ReactNode, keyPrefix = 'l'): ReactNode {
 
 interface Props {
   message: Message;
-  sessionId: string;
+  sessionChats?: Chat[];
+  // v1.8.2: passed by MessageList's render-item pass for cap-hit sentinels.
+  // Only the most recent sentinel shows the Continue button.
+  capHitInfo?: { position: number; isLatest: boolean };
 }
 
 function MarkdownBody({ content }: { content: string }) {
@@ -193,13 +214,14 @@ function StatsLine({ message }: { message: Message }) {
 
 function ActionRow({
   message,
-  sessionId,
 }: {
   message: Message;
-  sessionId: string;
 }) {
   const [justCopied, setJustCopied] = useState(false);
   const [regenerating, setRegenerating] = useState(false);
+  const [forking, setForking] = useState(false);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+  const [deleting, setDeleting] = useState(false);
 
   async function copy() {
     try {
@@ -215,7 +237,7 @@ function ActionRow({
     if (regenerating || message.status === 'streaming') return;
     setRegenerating(true);
     try {
-      await api.messages.regenerate(sessionId, message.id);
+      await api.messages.regenerate(message.chat_id, message.id);
     } catch (err) {
       toast.error(err instanceof Error ? err.message : 'regenerate failed');
     } finally {
@@ -223,48 +245,272 @@ function ActionRow({
     }
   }
 
+  async function fork() {
+    if (forking || message.status !== 'complete') return;
+    setForking(true);
+    try {
+      const chat = await api.chats.fork(message.chat_id, { messageId: message.id });
+      sessionEvents.emit({ type: 'open_chat_in_active_pane', chat_id: chat.id });
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'fork failed');
+    } finally {
+      setForking(false);
+    }
+  }
+
+  async function confirmDelete() {
+    if (deleting) return;
+    setDeleting(true);
+    try {
+      await api.messages.remove(message.chat_id, message.id);
+      setDeleteOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'delete failed');
+    } finally {
+      setDeleting(false);
+    }
+  }
+
   const isAssistant = message.role === 'assistant';
   const canRegen = isAssistant && message.status !== 'streaming';
+  const canFork = message.status === 'complete';
+  const canDelete = message.status !== 'streaming';
 
   return (
-    <div className="flex gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
-      <button
-        type="button"
-        onClick={() => void copy()}
-        className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground"
-        aria-label="Copy message"
-        title="Copy"
-      >
-        {justCopied ? <Check className="size-3" /> : <Copy className="size-3" />}
-      </button>
-      {isAssistant && (
+    <>
+      <div className="flex gap-1 opacity-0 group-hover:opacity-100 transition-opacity max-md:opacity-100">
         <button
           type="button"
-          onClick={() => void regenerate()}
-          disabled={!canRegen || regenerating}
-          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed"
-          aria-label="Regenerate message"
-          title="Regenerate"
+          onClick={() => void copy()}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Copy message"
+          title="Copy"
         >
-          <RefreshCw className={`size-3 ${regenerating ? 'animate-spin' : ''}`} />
+          {justCopied ? <Check className="size-3" /> : <Copy className="size-3" />}
         </button>
+        {isAssistant && (
+          <button
+            type="button"
+            onClick={() => void regenerate()}
+            disabled={!canRegen || regenerating}
+            className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Regenerate message"
+            title="Regenerate"
+          >
+            <RefreshCw className={`size-3 ${regenerating ? 'animate-spin' : ''}`} />
+          </button>
+        )}
+        <button
+          type="button"
+          onClick={() => void fork()}
+          disabled={!canFork || forking}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Fork from here"
+          title="Fork from here"
+        >
+          <GitFork className="size-3" />
+        </button>
+        <button
+          type="button"
+          onClick={() => setDeleteOpen(true)}
+          disabled={!canDelete}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-destructive disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Delete message"
+          title="Delete message"
+        >
+          <Trash2 className="size-3" />
+        </button>
+      </div>
+      <Dialog
+        open={deleteOpen}
+        onOpenChange={(open) => {
+          if (!deleting) setDeleteOpen(open);
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete this message and all messages after it?</DialogTitle>
+            <DialogDescription>
+              This removes the selected message and every later message in this chat. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button
+              variant="outline"
+              onClick={() => setDeleteOpen(false)}
+              disabled={deleting}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={() => void confirmDelete()}
+              disabled={deleting}
+            >
+              {deleting ? 'Deleting…' : 'Delete'}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
+function CompactCard({ message, sessionChats }: { message: Message; sessionChats?: Chat[] }) {
+  const [expanded, setExpanded] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const [shareOpen, setShareOpen] = useState(false);
+  const [rerunning, setRerunning] = useState(false);
+
+  const headerMatch = message.content.match(/^\[Context compacted — (\d+) messages summarized\]/);
+  const headerText = headerMatch ? headerMatch[0] : 'Context compacted';
+  const summaryText = headerMatch
+    ? message.content.slice(headerMatch[0].length).trim()
+    : message.content;
+
+  async function handleCopy() {
+    try {
+      await navigator.clipboard.writeText(summaryText);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1200);
+      toast.success('Summary copied to clipboard');
+    } catch {
+      toast.error('Copy failed');
+    }
+  }
+
+  async function handleShareToChat(chat: Chat) {
+    try {
+      await api.messages.send(chat.id, summaryText);
+      toast.success(`Summary sent to ${chat.name ?? 'New chat'}`);
+      setShareOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to share');
+    }
+  }
+
+  async function handleRerun() {
+    if (rerunning) return;
+    setRerunning(true);
+    try {
+      await api.chats.compact(message.chat_id);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Re-run failed');
+    } finally {
+      setRerunning(false);
+    }
+  }
+
+  const otherChats = (sessionChats ?? []).filter(
+    (c) => c.id !== message.chat_id && c.status === 'open'
+  );
+
+  return (
+    <div className="rounded-lg border bg-muted/30 text-sm">
+      <div className="flex items-center gap-2 px-3 py-2">
+        <button
+          type="button"
+          onClick={() => setExpanded(!expanded)}
+          className="flex items-center gap-1.5 flex-1 min-w-0 text-left text-muted-foreground hover:text-foreground"
+        >
+          {expanded ? <ChevronDown size={14} /> : <ChevronRight size={14} />}
+          <span className="text-xs font-medium truncate">{headerText}</span>
+        </button>
+        <button
+          type="button"
+          onClick={() => void handleCopy()}
+          className="p-1 rounded hover:bg-muted text-muted-foreground"
+          aria-label="Copy summary"
+          title="Copy summary"
+        >
+          {copied ? <Check size={12} /> : <Copy size={12} />}
+        </button>
+        <div className="relative">
+          <button
+            type="button"
+            onClick={() => setShareOpen(!shareOpen)}
+            className="p-1 rounded hover:bg-muted text-muted-foreground"
+            aria-label="Send to chat"
+            title="Send to chat"
+          >
+            <Share2 size={12} />
+          </button>
+          {shareOpen && (
+            <div className="absolute right-0 top-full mt-1 z-50 bg-popover border rounded-md shadow-md min-w-[180px] py-1">
+              {otherChats.length === 0 ? (
+                <div className="px-3 py-1.5 text-xs text-muted-foreground">
+                  No other chats in this session
+                </div>
+              ) : (
+                otherChats.map((c) => (
+                  <button
+                    key={c.id}
+                    type="button"
+                    onClick={() => void handleShareToChat(c)}
+                    className="w-full text-left px-3 py-1.5 text-xs hover:bg-accent truncate"
+                  >
+                    {c.name ?? 'New chat'}
+                  </button>
+                ))
+              )}
+            </div>
+          )}
+        </div>
+        <button
+          type="button"
+          onClick={() => void handleRerun()}
+          disabled={rerunning}
+          className="p-1 rounded hover:bg-muted text-muted-foreground disabled:opacity-40"
+          aria-label="Re-run compact"
+          title="Re-run compact"
+        >
+          <RotateCw size={12} className={rerunning ? 'animate-spin' : ''} />
+        </button>
+      </div>
+      {expanded && (
+        <div className="px-3 pb-3 text-xs leading-relaxed text-muted-foreground whitespace-pre-wrap border-t pt-2">
+          {summaryText}
+        </div>
       )}
     </div>
   );
 }
 
-export function MessageBubble({ message, sessionId }: Props) {
-  if (message.role === 'tool') {
-    return <ToolCallCard message={message} />;
+export function MessageBubble({ message, sessionChats, capHitInfo }: Props) {
+  if (message.kind === 'compact') {
+    return <CompactCard message={message} sessionChats={sessionChats} />;
   }
 
+  // v1.8.2: cap-hit sentinels render as a distinct system bubble with a
+  // Continue button. MessageList's pre-render pass tags each sentinel with
+  // its position; only the latest gets the actionable button.
+  if (
+    message.role === 'system' &&
+    message.metadata?.kind === 'cap_hit' &&
+    capHitInfo
+  ) {
+    return (
+      <CapHitSentinel
+        message={message}
+        capHitPosition={capHitInfo.position}
+        isLatest={capHitInfo.isLatest}
+      />
+    );
+  }
+
+  // v1.8.2: tool messages and assistant tool_calls are now rendered by
+  // MessageList via ToolCallLine / ToolCallGroup. Tool-role messages reach
+  // this point only if MessageList didn't consume them (shouldn't happen,
+  // but guard against it by rendering nothing rather than a stale card).
+  if (message.role === 'tool') return null;
+
   if (message.role === 'user') {
     return (
       <div className="group flex flex-col items-end gap-1">
-        <div className="max-w-[80%] rounded-lg bg-primary text-primary-foreground px-3 py-2 text-sm whitespace-pre-wrap">
+        <div className="max-w-[80%] rounded-lg bg-primary text-primary-foreground px-3 py-2 text-sm whitespace-pre-wrap break-words min-w-0">
           {message.content}
         </div>
-        <ActionRow message={message} sessionId={sessionId} />
+        <ActionRow message={message} />
       </div>
     );
   }
@@ -272,15 +518,18 @@ export function MessageBubble({ message, sessionId }: Props) {
   const isStreaming = message.status === 'streaming';
   const failed = message.status === 'failed';
   const hasContent = message.content.length > 0;
-  const hasToolCalls = (message.tool_calls?.length ?? 0) > 0;
+  // v1.8.2: if metadata stamps an error reason, surface it inline under the
+  // generic "message failed" line. Keeps the user's eye where it already is
+  // rather than introducing a separate banner.
+  const errorMeta =
+    message.metadata !== null && message.metadata.kind === 'error'
+      ? message.metadata
+      : null;
 
   return (
     <div className="group flex flex-col gap-2">
-      {message.tool_calls?.map((tc) => (
-        <ToolCallCard key={tc.id} toolCall={tc} />
-      ))}
-      {(hasContent || (!hasToolCalls && isStreaming)) && (
-        <div className="max-w-[90%] text-sm leading-relaxed space-y-2">
+      {(hasContent || isStreaming) && (
+        <div className="max-w-[90%] text-sm leading-relaxed space-y-2 break-words min-w-0">
           {hasContent ? <MarkdownBody content={message.content} /> : null}
           {isStreaming && (
             <span className="inline-block w-1.5 h-3.5 align-baseline bg-muted-foreground/60 animate-pulse" />
@@ -288,12 +537,18 @@ export function MessageBubble({ message, sessionId }: Props) {
         </div>
       )}
       {failed && (
-        <div className="text-xs text-destructive">message failed</div>
+        <div className="text-xs text-destructive">
+          message failed
+          {errorMeta && (
+            <span className="block text-muted-foreground mt-0.5">
+              {ERROR_REASON_LABELS[errorMeta.error_reason]}
+              {errorMeta.error_text ? ` — ${errorMeta.error_text}` : ''}
+            </span>
+          )}
+        </div>
       )}
       {!isStreaming && <StatsLine message={message} />}
-      {!isStreaming && (hasContent || hasToolCalls) && (
-        <ActionRow message={message} sessionId={sessionId} />
-      )}
+      {!isStreaming && hasContent && <ActionRow message={message} />}
     </div>
   );
 }

apps/web/src/components/MessageList.tsx

@@ -1,15 +1,128 @@
-import { useEffect, useRef } from 'react';
-import type { Message } from '@/api/types';
+import { useEffect, useMemo, useRef } from 'react';
+import type { Chat, Message } from '@/api/types';
 import { MessageBubble } from './MessageBubble';
+import { ToolCallGroup } from './ToolCallGroup';
+import { ToolCallLine, type ToolRun } from './ToolCallLine';
 
 interface Props {
   messages: Message[];
-  sessionId: string;
+  sessionChats?: Chat[];
 }
 
-export function MessageList({ messages, sessionId }: Props) {
+// v1.8.2: pre-render units. The single linear `messages` array gets walked
+// into a render-time list where each tool_call is a first-class item and
+// tool_result messages are folded onto their matching tool_run by id.
+type RenderItem =
+  | { kind: 'message'; message: Message; capHitInfo?: { position: number; isLatest: boolean } }
+  | { kind: 'tool_run'; run: ToolRun; key: string }
+  | { kind: 'tool_group'; runs: ToolRun[]; key: string };
+
+const GROUP_THRESHOLD = 3;
+
+function isCapHitSentinel(m: Message): boolean {
+  return m.role === 'system' && m.metadata?.kind === 'cap_hit';
+}
+
+// First pass: walk messages chronologically, expanding assistant tool_calls
+// into per-call run items and folding tool_result messages onto their
+// matching runs. Tool messages themselves never produce a render item.
+// Assistant messages produce a text render item only when they have text;
+// pure tool-call messages are "transparent" so consecutive tool runs can
+// still group across them.
+function flatten(messages: Message[]): RenderItem[] {
+  const items: RenderItem[] = [];
+  const runsByCallId = new Map<string, ToolRun>();
+
+  for (const m of messages) {
+    if (m.role === 'tool') {
+      if (m.tool_results) {
+        const run = runsByCallId.get(m.tool_results.tool_call_id);
+        if (run) run.result = m.tool_results;
+      }
+      continue;
+    }
+    const hasToolCalls = m.tool_calls != null && m.tool_calls.length > 0;
+    const hasText = m.content.length > 0;
+    if (m.role === 'assistant' && hasToolCalls) {
+      if (hasText || m.status === 'streaming') {
+        items.push({ kind: 'message', message: m });
+      }
+      for (const tc of m.tool_calls!) {
+        const run: ToolRun = { call: tc, result: null };
+        runsByCallId.set(tc.id, run);
+        items.push({ kind: 'tool_run', run, key: tc.id });
+      }
+      continue;
+    }
+    items.push({ kind: 'message', message: m });
+  }
+
+  return items;
+}
+
+// Second pass: collapse runs of >=GROUP_THRESHOLD consecutive tool_run items
+// of the same tool name into a single tool_group. Any other render item
+// (text bubble, sentinel, user message) breaks the chain.
+function group(items: RenderItem[]): RenderItem[] {
+  const out: RenderItem[] = [];
+  let i = 0;
+  while (i < items.length) {
+    const item = items[i]!;
+    if (item.kind !== 'tool_run') {
+      out.push(item);
+      i += 1;
+      continue;
+    }
+    const name = item.run.call.name;
+    let j = i + 1;
+    while (
+      j < items.length &&
+      items[j]!.kind === 'tool_run' &&
+      (items[j] as { kind: 'tool_run'; run: ToolRun }).run.call.name === name
+    ) {
+      j += 1;
+    }
+    const run = items.slice(i, j) as Array<{ kind: 'tool_run'; run: ToolRun; key: string }>;
+    if (run.length >= GROUP_THRESHOLD) {
+      out.push({
+        kind: 'tool_group',
+        runs: run.map((r) => r.run),
+        key: `group-${run[0]!.key}`,
+      });
+    } else {
+      for (const r of run) out.push(r);
+    }
+    i = j;
+  }
+  return out;
+}
+
+// Third pass: number cap-hit sentinels (1-indexed) and mark the latest.
+// CapHitSentinel uses position to compute the "N continues remaining"
+// tooltip, and isLatest to gate the Continue button (only the most recent
+// sentinel is actionable).
+function stampCapHits(items: RenderItem[]): RenderItem[] {
+  const totalCapHits = items.reduce(
+    (n, it) => n + (it.kind === 'message' && isCapHitSentinel(it.message) ? 1 : 0),
+    0,
+  );
+  if (totalCapHits === 0) return items;
+  let index = 0;
+  return items.map((it) => {
+    if (it.kind !== 'message' || !isCapHitSentinel(it.message)) return it;
+    index += 1;
+    return {
+      ...it,
+      capHitInfo: { position: index, isLatest: index === totalCapHits },
+    };
+  });
+}
+
+export function MessageList({ messages, sessionChats }: Props) {
   const endRef = useRef<HTMLDivElement>(null);
 
+  const renderItems = useMemo(() => stampCapHits(group(flatten(messages))), [messages]);
+
   useEffect(() => {
     endRef.current?.scrollIntoView({ block: 'end' });
   }, [messages]);
@@ -23,11 +136,26 @@ export function MessageList({ messages, sessionId }: Props) {
   }
 
   return (
-    <div className="flex-1 overflow-y-auto px-6 py-4 space-y-4">
-      {messages.map((m) => (
-        <MessageBubble key={m.id} message={m} sessionId={sessionId} />
-      ))}
-      <div ref={endRef} />
+    <div className="flex-1 overflow-y-auto">
+      <div className="max-w-[1000px] mx-auto w-full px-6 py-4 space-y-4">
+        {renderItems.map((item) => {
+          if (item.kind === 'message') {
+            return (
+              <MessageBubble
+                key={item.message.id}
+                message={item.message}
+                sessionChats={sessionChats}
+                capHitInfo={item.capHitInfo}
+              />
+            );
+          }
+          if (item.kind === 'tool_run') {
+            return <ToolCallLine key={item.key} run={item.run} />;
+          }
+          return <ToolCallGroup key={item.key} runs={item.runs} />;
+        })}
+        <div ref={endRef} />
+      </div>
     </div>
   );
 }

apps/web/src/components/MobileTabSwitcher.tsx

@@ -0,0 +1,210 @@
+import { useState } from 'react';
+import {
+  Bot,
+  ChevronDown,
+  Edit2,
+  MessageSquare,
+  MoreHorizontal,
+  Settings as SettingsIcon,
+  Terminal,
+  X,
+} from 'lucide-react';
+import { toast } from 'sonner';
+import type { Chat, WorkspacePane } from '@/api/types';
+import { BottomSheet } from '@/components/BottomSheet';
+import { StatusDot } from '@/components/StatusDot';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { useLongPress } from '@/hooks/useLongPress';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  panes: WorkspacePane[];
+  activePaneIdx: number;
+  chats: Chat[];
+  onSwitchPane: (idx: number) => void;
+  onRemovePane: (idx: number) => void;
+  onRenameChat: (chatId: string, name: string) => Promise<void>;
+}
+
+function paneIcon(kind: WorkspacePane['kind']) {
+  if (kind === 'terminal') return <Terminal size={14} />;
+  if (kind === 'agent') return <Bot size={14} />;
+  if (kind === 'settings') return <SettingsIcon size={14} />;
+  return <MessageSquare size={14} />;
+}
+
+function paneActiveChatId(pane: WorkspacePane | undefined): string | null {
+  if (!pane) return null;
+  if (pane.chatId) return pane.chatId;
+  const idx = pane.activeChatIdx;
+  if (idx < 0 || idx >= pane.chatIds.length) return null;
+  return pane.chatIds[idx] ?? null;
+}
+
+function paneLabel(pane: WorkspacePane, chats: Chat[]): string {
+  const cid = paneActiveChatId(pane);
+  if (cid) {
+    const c = chats.find((x) => x.id === cid);
+    if (c) return c.name ?? 'New chat';
+  }
+  if (pane.kind === 'chat') return 'Chat';
+  if (pane.kind === 'terminal') return 'Terminal';
+  if (pane.kind === 'agent') return 'Agent';
+  if (pane.kind === 'settings') return 'Settings';
+  return 'Empty';
+}
+
+export function MobileTabSwitcher({
+  panes,
+  activePaneIdx,
+  chats,
+  onSwitchPane,
+  onRemovePane,
+  onRenameChat,
+}: Props) {
+  const [open, setOpen] = useState(false);
+  const [renamingChatId, setRenamingChatId] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+
+  const active = panes[activePaneIdx];
+  const activeLabel = active ? paneLabel(active, chats) : 'Empty';
+  const activeChatId = paneActiveChatId(active);
+
+  // Long-press mirrors ChatTabBar: synthesize a contextmenu event on the row
+  // so the trailing kebab's Radix DropdownMenu opens at the touch point.
+  const longPress = useLongPress(({ clientX, clientY, target }) => {
+    if (!target || !(target instanceof Element)) return;
+    const row = target.closest('[data-pane-id]') as HTMLElement | null;
+    if (!row) return;
+    const trigger = row.querySelector('[data-pane-kebab]') as HTMLElement | null;
+    if (trigger) {
+      trigger.click();
+      return;
+    }
+    row.dispatchEvent(
+      new MouseEvent('contextmenu', { bubbles: true, cancelable: true, clientX, clientY }),
+    );
+  });
+
+  function startRename(chatId: string, currentName: string | null) {
+    setRenamingChatId(chatId);
+    setRenameValue(currentName ?? '');
+  }
+  async function finishRename() {
+    if (renamingChatId && renameValue.trim()) {
+      try {
+        await onRenameChat(renamingChatId, renameValue.trim());
+      } catch (err) {
+        toast.error(err instanceof Error ? err.message : 'rename failed');
+      }
+    }
+    setRenamingChatId(null);
+  }
+
+  function handleSwitchPane(idx: number) {
+    onSwitchPane(idx);
+    setOpen(false);
+  }
+
+  return (
+    <>
+      <button
+        type="button"
+        onClick={() => setOpen(true)}
+        className="flex-1 inline-flex items-center gap-1.5 min-h-[44px] px-3 text-sm rounded-full bg-muted/40 hover:bg-muted/70 text-foreground min-w-0"
+        aria-label="Switch pane"
+      >
+        <span className="shrink-0 text-muted-foreground">{paneIcon(active?.kind ?? 'chat')}</span>
+        <StatusDot chatId={activeChatId} />
+        <span className="truncate flex-1 text-left">{activeLabel}</span>
+        <ChevronDown size={14} className="opacity-60 shrink-0" />
+      </button>
+
+      <BottomSheet open={open} onClose={() => setOpen(false)} title="Panes">
+        <ul className="px-2 py-2 space-y-1">
+          {panes.map((pane, idx) => {
+            const isActive = idx === activePaneIdx;
+            const cid = paneActiveChatId(pane);
+            const chat = cid ? chats.find((c) => c.id === cid) ?? null : null;
+            const label = paneLabel(pane, chats);
+            return (
+              <li
+                key={pane.id}
+                data-pane-id={pane.id}
+                onTouchStart={longPress.onTouchStart}
+                onTouchMove={longPress.onTouchMove}
+                onTouchEnd={longPress.onTouchEnd}
+                onTouchCancel={longPress.onTouchCancel}
+                onClick={() => handleSwitchPane(idx)}
+                style={{ WebkitTouchCallout: 'none' }}
+                className={cn(
+                  'flex items-center gap-2 px-3 py-2 rounded min-h-[48px] cursor-default select-none',
+                  isActive
+                    ? 'bg-accent/40 border-l-2 border-primary'
+                    : 'hover:bg-muted/50',
+                )}
+              >
+                <span className="shrink-0 text-muted-foreground">{paneIcon(pane.kind)}</span>
+                <StatusDot chatId={cid ?? null} />
+                {renamingChatId === cid && cid ? (
+                  <input
+                    autoFocus
+                    value={renameValue}
+                    onChange={(e) => setRenameValue(e.target.value)}
+                    onBlur={() => void finishRename()}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter') void finishRename();
+                      if (e.key === 'Escape') setRenamingChatId(null);
+                    }}
+                    onClick={(e) => e.stopPropagation()}
+                    className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+                  />
+                ) : (
+                  <span className="truncate flex-1 text-sm">{label}</span>
+                )}
+                {isActive && (
+                  <span aria-hidden="true" className="text-primary text-xs shrink-0">
+                    ✓
+                  </span>
+                )}
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <button
+                      type="button"
+                      data-pane-kebab
+                      onClick={(e) => e.stopPropagation()}
+                      className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground min-h-[44px] min-w-[44px]"
+                      aria-label="Pane options"
+                    >
+                      <MoreHorizontal size={14} />
+                    </button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    {chat && (
+                      <DropdownMenuItem onSelect={() => startRename(chat.id, chat.name)}>
+                        <Edit2 size={14} /> Rename chat
+                      </DropdownMenuItem>
+                    )}
+                    <DropdownMenuItem
+                      disabled={panes.length <= 1}
+                      onSelect={() => onRemovePane(idx)}
+                    >
+                      <X size={14} /> Close pane
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </li>
+            );
+          })}
+        </ul>
+        {/* v1.8: New-pane button moved out of the sheet to the header row 2
+            (see NewPaneMenu). Sheet is for switching only. */}
+      </BottomSheet>
+    </>
+  );
+}

apps/web/src/components/ModelPicker.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from 'react';
-import { Check, ChevronDown } from 'lucide-react';
+import { Check, ChevronDown, Cpu } from 'lucide-react';
 import { api } from '@/api/client';
 import type { ModelInfo } from '@/api/types';
 import {
@@ -8,26 +8,94 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu';
+import { BottomSheet } from '@/components/BottomSheet';
+import { useViewport } from '@/hooks/useViewport';
 
 interface Props {
   value: string;
   onChange: (model: string) => void | Promise<void>;
 }
 
+// v1.9: shared list rendered inside both shells. Lazy-fetches /api/models on
+// first open so the picker doesn't pay for a request when it's never shown.
+function ModelList({
+  models,
+  error,
+  value,
+  onPick,
+}: {
+  models: ModelInfo[] | null;
+  error: string | null;
+  value: string;
+  onPick: (id: string) => void;
+}) {
+  if (error) {
+    return <div className="px-2 py-1.5 text-xs text-destructive">{error}</div>;
+  }
+  if (models === null) {
+    return <div className="px-2 py-1.5 text-xs text-muted-foreground">Loading…</div>;
+  }
+  return (
+    <>
+      {models.map((m) => (
+        <button
+          key={m.id}
+          type="button"
+          onClick={() => onPick(m.id)}
+          className="w-full text-left flex items-center gap-2 font-mono text-xs px-2 py-1.5 hover:bg-accent rounded"
+        >
+          <Check className={`size-3 ${m.id === value ? 'opacity-100' : 'opacity-0'}`} />
+          <span className="truncate">{m.id}</span>
+        </button>
+      ))}
+    </>
+  );
+}
+
 export function ModelPicker({ value, onChange }: Props) {
+  const { isMobile } = useViewport();
   const [models, setModels] = useState<ModelInfo[] | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [open, setOpen] = useState(false);
 
   useEffect(() => {
     if (!open || models !== null) return;
-    api.models()
+    api
+      .models()
       .then(setModels)
       .catch((err) =>
-        setError(err instanceof Error ? err.message : 'failed to load models')
+        setError(err instanceof Error ? err.message : 'failed to load models'),
       );
   }, [open, models]);
 
+  function handlePick(id: string) {
+    setOpen(false);
+    void onChange(id);
+  }
+
+  // v1.9: mobile = icon-only trigger + bottom-sheet shell. Desktop = labeled
+  // trigger (model name + chevron) + dropdown. Same ModelList under the hood.
+  if (isMobile) {
+    return (
+      <>
+        <button
+          type="button"
+          onClick={() => setOpen(true)}
+          aria-label={`Model: ${value}`}
+          title={value}
+          className="inline-flex items-center justify-center min-h-[44px] min-w-[44px] rounded text-muted-foreground hover:text-foreground"
+        >
+          <Cpu className="size-4" />
+        </button>
+        <BottomSheet open={open} onClose={() => setOpen(false)} title="Model">
+          <div className="px-2 py-2 space-y-1">
+            <ModelList models={models} error={error} value={value} onPick={handlePick} />
+          </div>
+        </BottomSheet>
+      </>
+    );
+  }
+
   return (
     <DropdownMenu open={open} onOpenChange={setOpen}>
       <DropdownMenuTrigger asChild>
@@ -49,7 +117,7 @@ export function ModelPicker({ value, onChange }: Props) {
         {models?.map((m) => (
           <DropdownMenuItem
             key={m.id}
-            onSelect={() => void onChange(m.id)}
+            onSelect={() => handlePick(m.id)}
             className="font-mono text-xs"
           >
             <Check

apps/web/src/components/NewPaneMenu.tsx

@@ -0,0 +1,44 @@
+import { Bot, MessageSquare, Plus, Terminal } from 'lucide-react';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+
+interface Props {
+  onAddPane: (kind: 'chat' | 'terminal' | 'agent') => void;
+  disabled?: boolean;
+}
+
+// v1.8 row-2 right cluster: mirrors the desktop Workspace.tsx Split dropdown.
+// Terminal and Agent items pass through to addSplitPane which already shows
+// "coming soon" toasts; rendering them here matches the Batch 3 workspace
+// model so the UI is forward-compatible with BooTerm/BooCoder.
+export function NewPaneMenu({ onAddPane, disabled }: Props) {
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <button
+          type="button"
+          disabled={disabled}
+          className="inline-flex items-center justify-center min-h-[44px] min-w-[44px] rounded-full bg-muted/40 hover:bg-muted/70 text-foreground disabled:opacity-40 disabled:cursor-not-allowed shrink-0"
+          aria-label="New pane"
+        >
+          <Plus size={16} />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end">
+        <DropdownMenuItem onSelect={() => onAddPane('chat')}>
+          <MessageSquare size={14} /> New chat
+        </DropdownMenuItem>
+        <DropdownMenuItem onSelect={() => onAddPane('terminal')}>
+          <Terminal size={14} /> New terminal
+        </DropdownMenuItem>
+        <DropdownMenuItem onSelect={() => onAddPane('agent')}>
+          <Bot size={14} /> New agent
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}

apps/web/src/components/PaneTab.tsx

@@ -1,116 +0,0 @@
-import type { DragEvent } from 'react';
-import { FolderOpen, MessageSquare, X } from 'lucide-react';
-import type { Pane, PaneKind } from '@/api/types';
-import { cn } from '@/lib/utils';
-import {
-  ContextMenu,
-  ContextMenuContent,
-  ContextMenuItem,
-  ContextMenuSeparator,
-  ContextMenuSub,
-  ContextMenuSubContent,
-  ContextMenuSubTrigger,
-  ContextMenuTrigger,
-} from '@/components/ui/context-menu';
-
-interface Props {
-  pane: Pane;
-  isActive: boolean;
-  onClick: () => void;
-  onClose: () => void;
-  onSplit: (kind: PaneKind) => void;
-  onCloseOthers: () => void;
-  onCloseToRight: () => void;
-  onCloseAll: () => void;
-  onDragStart: (e: DragEvent<HTMLDivElement>) => void;
-  onDragOver: (e: DragEvent<HTMLDivElement>) => void;
-  onDrop: (e: DragEvent<HTMLDivElement>) => void;
-}
-
-function basename(path: string): string {
-  if (!path) return '';
-  const parts = path.split('/');
-  return parts[parts.length - 1] ?? path;
-}
-
-function labelFor(pane: Pane): string {
-  if (pane.kind === 'chat') return 'Chat';
-  const openFile = pane.state.open_file;
-  if (openFile) return basename(openFile);
-  return 'Files';
-}
-
-export function PaneTab({
-  pane,
-  isActive,
-  onClick,
-  onClose,
-  onSplit,
-  onCloseOthers,
-  onCloseToRight,
-  onCloseAll,
-  onDragStart,
-  onDragOver,
-  onDrop,
-}: Props) {
-  const Icon = pane.kind === 'chat' ? MessageSquare : FolderOpen;
-  const label = labelFor(pane);
-
-  return (
-    <ContextMenu>
-      <ContextMenuTrigger asChild>
-        <div
-          draggable
-          onDragStart={onDragStart}
-          onDragOver={onDragOver}
-          onDrop={onDrop}
-          onClick={onClick}
-          className={cn(
-            'group flex items-center gap-1.5 px-3 py-1.5 text-xs border-r border-border cursor-default select-none',
-            isActive
-              ? 'bg-background text-foreground'
-              : 'bg-muted/30 text-muted-foreground hover:bg-muted/60'
-          )}
-          role="tab"
-          aria-selected={isActive}
-        >
-          <Icon size={12} className="shrink-0" />
-          <span className="truncate max-w-[160px]" title={label}>
-            {label}
-          </span>
-          <button
-            type="button"
-            onClick={(e) => {
-              e.stopPropagation();
-              onClose();
-            }}
-            className="p-0.5 hover:bg-muted rounded opacity-60 hover:opacity-100 shrink-0"
-            aria-label="Close tab"
-          >
-            <X size={10} />
-          </button>
-        </div>
-      </ContextMenuTrigger>
-      <ContextMenuContent>
-        <ContextMenuSub>
-          <ContextMenuSubTrigger>Split</ContextMenuSubTrigger>
-          <ContextMenuSubContent>
-            <ContextMenuItem onSelect={() => onSplit('chat')}>
-              <MessageSquare /> Chat
-            </ContextMenuItem>
-            <ContextMenuItem onSelect={() => onSplit('file_browser')}>
-              <FolderOpen /> File Browser
-            </ContextMenuItem>
-          </ContextMenuSubContent>
-        </ContextMenuSub>
-        <ContextMenuSeparator />
-        <ContextMenuItem onSelect={onClose}>Close</ContextMenuItem>
-        <ContextMenuItem onSelect={onCloseOthers}>Close others</ContextMenuItem>
-        <ContextMenuItem onSelect={onCloseToRight}>
-          Close to the right
-        </ContextMenuItem>
-        <ContextMenuItem onSelect={onCloseAll}>Close all</ContextMenuItem>
-      </ContextMenuContent>
-    </ContextMenu>
-  );
-}

apps/web/src/components/ProjectSidebar.tsx

@@ -1,19 +1,31 @@
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { NavLink, useLocation, useNavigate } from 'react-router-dom';
-import { ChevronRight, Folder, MessageSquare, Plus } from 'lucide-react';
+import { ChevronRight, ExternalLink, Folder, MessageSquare, Plus, Settings as SettingsIcon } from 'lucide-react';
 import { toast } from 'sonner';
 import { Button } from '@/components/ui/button';
+import { sessionEvents } from '@/hooks/sessionEvents';
 import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@/components/ui/dropdown-menu';
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
 import { AddProjectModal } from './AddProjectModal';
 import { api } from '@/api/client';
-import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSidebar } from '@/hooks/useSidebar';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useViewport } from '@/hooks/useViewport';
+import { usePullToRefresh } from '@/hooks/usePullToRefresh';
 import type { SidebarProject } from '@/api/types';
+import { giteaUrlFor } from '@/lib/projectUrls';
 import { cn } from '@/lib/utils';
 
 const EXPANDED_KEY = 'boocode.sidebar.expanded';
@@ -91,6 +103,12 @@ export function ProjectSidebar() {
     useSidebar();
   const [addOpen, setAddOpen] = useState(false);
   const [expanded, setExpanded] = useState<Set<string>>(() => readExpanded());
+  const [renamingSession, setRenamingSession] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+  const [deleteConfirm, setDeleteConfirm] = useState<{ id: string; name: string } | null>(null);
+  const [renamingProject, setRenamingProject] = useState<string | null>(null);
+  const [renameProjectValue, setRenameProjectValue] = useState('');
+  const [archiveProjectConfirm, setArchiveProjectConfirm] = useState<{ id: string; name: string } | null>(null);
   const navigate = useNavigate();
   const location = useLocation();
   const lastToastedError = useRef<string | null>(null);
@@ -123,21 +141,82 @@ export function ProjectSidebar() {
     });
   }
 
-  async function handleRemove(id: string) {
+  async function handleArchiveProject(id: string) {
     try {
-      await api.projects.remove(id);
-      sessionEvents.emit({ type: 'project_deleted', project_id: id });
-      navigate('/');
+      await api.projects.archive(id);
+      // Server publishes project_archived via WS.
+      if (activeProject === id) navigate('/');
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'failed to remove project');
+      toast.error(err instanceof Error ? err.message : 'failed to archive project');
+    }
+  }
+
+  async function handleRenameProject(id: string) {
+    const trimmed = renameProjectValue.trim();
+    setRenamingProject(null);
+    if (!trimmed) return;
+    try {
+      await api.projects.update(id, { name: trimmed });
+      // Server publishes project_updated via WS.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to rename project');
+    }
+  }
+
+  async function handleArchiveSession(sessionId: string, projectId: string) {
+    try {
+      await api.sessions.archive(sessionId);
+      // Server publishes session_archived via WS; useUserEvents delivers it.
+      if (activeSession === sessionId) navigate(`/project/${projectId}`);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to archive session');
+    }
+  }
+
+  async function handleDeleteSession(sessionId: string, projectId: string) {
+    try {
+      await api.sessions.remove(sessionId);
+      // Server publishes session_deleted via WS; useUserEvents delivers it.
+      if (activeSession === sessionId) navigate(`/project/${projectId}`);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to delete session');
+    }
+  }
+
+  async function handleRenameSession(sessionId: string) {
+    const trimmed = renameValue.trim();
+    setRenamingSession(null);
+    if (!trimmed) return;
+    try {
+      await api.sessions.update(sessionId, { name: trimmed });
+      // Server publishes session_renamed via broker.publishUser; useUserEvents
+      // forwards onto the bus. No local emit needed.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to rename session');
     }
   }
 
   const rowCls = (active: boolean) =>
     active ? 'bg-sidebar-accent text-sidebar-accent-foreground' : 'hover:bg-sidebar-accent/60';
 
+  const { open: drawerOpen, setOpen: setDrawerOpen } = useSidebarDrawer();
+  const { isMobile } = useViewport();
+  const pull = usePullToRefresh(() => retry(), { enabled: isMobile });
+
+  // On mobile the sidebar is a slide-in drawer (fixed, z-40, off-screen by
+  // default). On desktop it sits inline as a normal flex column. The
+  // backdrop is rendered by AppShell; drawer-open state lives in
+  // SidebarDrawerProvider.
+  const asideCls = isMobile
+    ? cn(
+        'fixed inset-y-0 left-0 z-40 w-60 border-r bg-sidebar text-sidebar-foreground flex flex-col',
+        'transition-transform duration-200 ease-out',
+        drawerOpen ? 'translate-x-0' : '-translate-x-full',
+      )
+    : 'w-60 shrink-0 border-r bg-sidebar text-sidebar-foreground flex flex-col h-screen';
+
   return (
-    <aside className="w-60 shrink-0 border-r bg-sidebar text-sidebar-foreground flex flex-col h-screen">
+    <aside className={asideCls}>
       <div className="px-4 py-3 border-b flex items-center justify-between">
         <NavLink to="/" className="font-semibold tracking-tight text-base">
           BooCode
@@ -147,7 +226,30 @@ export function ProjectSidebar() {
         </Button>
       </div>
 
-      <nav className="flex-1 overflow-y-auto py-2">
+      {isMobile && (pull.pullDist > 0 || pull.refreshing) && (
+        <div
+          className="flex items-center justify-center text-[10px] uppercase tracking-wide text-muted-foreground border-b overflow-hidden shrink-0"
+          style={{
+            height: pull.refreshing ? 32 : Math.min(pull.pullDist, 80),
+            transition: pull.pullDist === 0 && !pull.refreshing ? 'height 0.2s ease' : undefined,
+          }}
+          aria-live="polite"
+        >
+          {pull.refreshing
+            ? 'Refreshing…'
+            : pull.pullDist >= 80
+            ? 'Release to refresh'
+            : 'Pull to refresh'}
+        </div>
+      )}
+
+      <nav
+        className="flex-1 overflow-y-auto py-2"
+        onTouchStart={isMobile ? pull.onTouchStart : undefined}
+        onTouchMove={isMobile ? pull.onTouchMove : undefined}
+        onTouchEnd={isMobile ? pull.onTouchEnd : undefined}
+        onTouchCancel={isMobile ? pull.onTouchEnd : undefined}
+      >
         {loading && data == null && (
           <div className="space-y-2 px-2">
             {[0, 1, 2, 3].map((i) => (
@@ -175,67 +277,126 @@ export function ProjectSidebar() {
             const visible = p.recent_sessions.slice(0, MAX_VISIBLE_SESSIONS);
             return (
               <div key={p.id} className="px-2">
-                <DropdownMenu>
-                  <div
-                    className={`group flex items-center gap-1 rounded-md px-2 py-1.5 text-sm ${rowCls(isActiveProject)}`}
-                    onContextMenu={(e) => {
-                      e.preventDefault();
-                      (
-                        e.currentTarget.parentElement?.querySelector(
-                          '[data-ctxtrigger]'
-                        ) as HTMLElement | null
-                      )?.click();
-                    }}
-                  >
-                    <button
-                      type="button"
-                      aria-label={isExpanded ? 'Collapse' : 'Expand'}
-                      aria-expanded={isExpanded}
-                      disabled={isActiveProject}
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        if (isActiveProject) return;
-                        toggle(p.id);
-                      }}
-                      className={cn(
-                        'flex items-center justify-center size-4 shrink-0 opacity-70 hover:opacity-100',
-                        isActiveProject &&
-                          'opacity-50 cursor-not-allowed hover:opacity-50'
-                      )}
+                <ContextMenu>
+                  <ContextMenuTrigger asChild>
+                    <div
+                      className={`group flex items-center gap-1 rounded-md px-2 py-1.5 text-sm ${rowCls(isActiveProject)}`}
                     >
-                      <ChevronRight
-                        className={`size-3.5 transition-transform ${isExpanded ? 'rotate-90' : ''}`}
-                      />
-                    </button>
-                    <NavLink to={`/project/${p.id}`} className="flex items-center gap-2 min-w-0 flex-1">
-                      <Folder className="size-3.5 shrink-0 opacity-70" />
-                      <span className="truncate" title={p.name}>{p.name}</span>
-                    </NavLink>
-                  </div>
-                  <DropdownMenuTrigger asChild>
-                    <button data-ctxtrigger className="hidden" aria-hidden />
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="start">
-                    <DropdownMenuItem variant="destructive" onClick={() => void handleRemove(p.id)}>
-                      Remove from sidebar
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
+                      <button
+                        type="button"
+                        aria-label={isExpanded ? 'Collapse' : 'Expand'}
+                        aria-expanded={isExpanded}
+                        disabled={isActiveProject}
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          if (isActiveProject) return;
+                          toggle(p.id);
+                        }}
+                        className={cn(
+                          'flex items-center justify-center size-4 shrink-0 opacity-70 hover:opacity-100',
+                          isActiveProject &&
+                            'opacity-50 cursor-not-allowed hover:opacity-50'
+                        )}
+                      >
+                        <ChevronRight
+                          className={`size-3.5 transition-transform ${isExpanded ? 'rotate-90' : ''}`}
+                        />
+                      </button>
+                      {renamingProject === p.id ? (
+                        <div className="flex items-center gap-2 min-w-0 flex-1">
+                          <Folder className="size-3.5 shrink-0 opacity-70" />
+                          <input
+                            autoFocus
+                            value={renameProjectValue}
+                            onChange={(e) => setRenameProjectValue(e.target.value)}
+                            onBlur={() => void handleRenameProject(p.id)}
+                            onKeyDown={(e) => {
+                              if (e.key === 'Enter') void handleRenameProject(p.id);
+                              if (e.key === 'Escape') setRenamingProject(null);
+                            }}
+                            className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+                          />
+                        </div>
+                      ) : (
+                        <NavLink to={`/project/${p.id}`} className="flex items-center gap-2 min-w-0 flex-1">
+                          <Folder className="size-3.5 shrink-0 opacity-70" />
+                          <span className="truncate" title={p.name}>{p.name}</span>
+                        </NavLink>
+                      )}
+                    </div>
+                  </ContextMenuTrigger>
+                  <ContextMenuContent>
+                    <ContextMenuItem onSelect={() => {
+                      setRenamingProject(p.id);
+                      setRenameProjectValue(p.name);
+                    }}>
+                      Rename
+                    </ContextMenuItem>
+                    <ContextMenuItem onSelect={() => setArchiveProjectConfirm({ id: p.id, name: p.name })}>
+                      Archive
+                    </ContextMenuItem>
+                    <ContextMenuSeparator />
+                    <ContextMenuItem onSelect={() => {
+                      const url = giteaUrlFor({ path: p.path, gitea_remote: p.gitea_remote });
+                      window.open(url, '_blank', 'noopener');
+                    }}>
+                      <ExternalLink size={12} /> Open in Gitea
+                    </ContextMenuItem>
+                  </ContextMenuContent>
+                </ContextMenu>
 
                 {isExpanded && (
                   <div className="ml-5 mt-0.5 space-y-0.5">
                     {visible.map((s) => (
-                      <NavLink
-                        key={s.id}
-                        to={`/session/${s.id}`}
-                        className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}
-                      >
-                        <MessageSquare className="size-3.5 shrink-0 opacity-70" />
-                        <span className="truncate flex-1" title={s.name}>{s.name}</span>
-                        <span className="text-xs text-muted-foreground shrink-0 tabular-nums">
-                          {relTime(s.updated_at)}
-                        </span>
-                      </NavLink>
+                      <ContextMenu key={s.id}>
+                        <ContextMenuTrigger asChild>
+                          {renamingSession === s.id ? (
+                            <div className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}>
+                              <MessageSquare className="size-3.5 shrink-0 opacity-70" />
+                              <input
+                                autoFocus
+                                value={renameValue}
+                                onChange={(e) => setRenameValue(e.target.value)}
+                                onBlur={() => void handleRenameSession(s.id)}
+                                onKeyDown={(e) => {
+                                  if (e.key === 'Enter') void handleRenameSession(s.id);
+                                  if (e.key === 'Escape') setRenamingSession(null);
+                                }}
+                                className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+                              />
+                            </div>
+                          ) : (
+                            <NavLink
+                              to={`/session/${s.id}`}
+                              className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}
+                            >
+                              <MessageSquare className="size-3.5 shrink-0 opacity-70" />
+                              <span className="truncate flex-1" title={s.name}>{s.name}</span>
+                              <span className="text-xs text-muted-foreground shrink-0 tabular-nums">
+                                {relTime(s.updated_at)}
+                              </span>
+                            </NavLink>
+                          )}
+                        </ContextMenuTrigger>
+                        <ContextMenuContent>
+                          <ContextMenuItem onSelect={() => {
+                            setRenamingSession(s.id);
+                            setRenameValue(s.name);
+                          }}>
+                            Rename
+                          </ContextMenuItem>
+                          <ContextMenuItem onSelect={() => void handleArchiveSession(s.id, p.id)}>
+                            Archive
+                          </ContextMenuItem>
+                          <ContextMenuSeparator />
+                          <ContextMenuItem
+                            variant="destructive"
+                            onSelect={() => setDeleteConfirm({ id: s.id, name: s.name })}
+                          >
+                            Delete
+                          </ContextMenuItem>
+                        </ContextMenuContent>
+                      </ContextMenu>
                     ))}
                     {p.total_sessions > MAX_VISIBLE_SESSIONS && (
                       <NavLink
@@ -252,7 +413,85 @@ export function ProjectSidebar() {
           })}
       </nav>
 
+      {/* v1.9: bottom-pinned Settings button. In a session, opens/focuses the
+          workspace settings pane via the sessionEvents bus (Session.tsx owns
+          the panesHook). Outside a session there's no workspace to mount the
+          pane in, so we navigate to /settings (themes page) instead. */}
+      <div className="border-t shrink-0 p-2">
+        <button
+          type="button"
+          onClick={() => {
+            if (activeSession) {
+              sessionEvents.emit({ type: 'open_settings_pane' });
+              if (isMobile) setDrawerOpen(false);
+            } else {
+              navigate('/settings');
+              if (isMobile) setDrawerOpen(false);
+            }
+          }}
+          className="w-full flex items-center gap-2 px-2 py-1.5 rounded-md text-sm hover:bg-sidebar-accent/60 text-sidebar-foreground"
+          aria-label="Settings"
+        >
+          <SettingsIcon className="size-3.5 shrink-0 opacity-70" />
+          <span className="flex-1 text-left">Settings</span>
+        </button>
+      </div>
+
       <AddProjectModal open={addOpen} onOpenChange={setAddOpen} onAdded={() => {}} />
+
+      <Dialog open={archiveProjectConfirm !== null} onOpenChange={(open) => { if (!open) setArchiveProjectConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive project?</DialogTitle>
+            <DialogDescription>
+              Removes {archiveProjectConfirm ? `"${archiveProjectConfirm.name}"` : 'this project'} from the sidebar. Files on disk are untouched. You can restore it later from the Archived Projects view.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setArchiveProjectConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              onClick={() => {
+                if (archiveProjectConfirm) void handleArchiveProject(archiveProjectConfirm.id);
+                setArchiveProjectConfirm(null);
+              }}
+            >
+              Archive
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={deleteConfirm !== null} onOpenChange={(open) => { if (!open) setDeleteConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete session?</DialogTitle>
+            <DialogDescription>
+              This will permanently delete {deleteConfirm ? `"${deleteConfirm.name}"` : 'this session'} and all its chats and messages. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setDeleteConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={() => {
+                if (deleteConfirm) {
+                  const projectId = projects.find((p) =>
+                    p.recent_sessions.some((s) => s.id === deleteConfirm.id)
+                  )?.id;
+                  if (projectId) void handleDeleteSession(deleteConfirm.id, projectId);
+                }
+                setDeleteConfirm(null);
+              }}
+            >
+              Delete
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
     </aside>
   );
 }

apps/web/src/components/RightRail.tsx

@@ -0,0 +1,295 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { ChevronRight, ChevronDown, FileText, Folder, PanelRightClose, PanelRightOpen } from 'lucide-react';
+import { api } from '@/api/client';
+import type { FileEntry } from '@/api/types';
+import { inferLanguage } from '@/lib/attachments';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
+import { FileViewerOverlay } from '@/components/FileViewerOverlay';
+import { Input } from '@/components/ui/input';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  projectId: string;
+}
+
+const STORAGE_KEY = 'boocode.rightrail';
+
+function basename(path: string): string {
+  if (!path) return '';
+  const parts = path.split('/');
+  return parts[parts.length - 1] ?? path;
+}
+
+function joinPath(parent: string, name: string): string {
+  if (!parent || parent === '.' || parent === '') return name;
+  return `${parent}/${name}`;
+}
+
+export function RightRail({ projectId }: Props) {
+  const { isMobile } = useViewport();
+  const { open: drawerOpen, setOpen: setDrawerOpen } = useRightRailDrawer();
+  const [open, setOpen] = useState(() => {
+    try { return localStorage.getItem(`${STORAGE_KEY}.open`) !== 'false'; } catch { return true; }
+  });
+  const [filter, setFilter] = useState('');
+  const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set());
+  const [cache, setCache] = useState<Map<string, FileEntry[]>>(new Map());
+  const [fullFileList, setFullFileList] = useState<string[] | null>(null);
+  const [viewerFile, setViewerFile] = useState<{ path: string; content: string } | null>(null);
+
+  // Combined open state: on mobile use the global drawer state (toggled by
+  // the Session header's FolderTree button); on desktop use the persistent
+  // internal state.
+  const isOpen = isMobile ? drawerOpen : open;
+  const closeRail = useCallback(() => {
+    if (isMobile) setDrawerOpen(false);
+    else setOpen(false);
+  }, [isMobile, setDrawerOpen]);
+  const openRail = useCallback(() => {
+    if (isMobile) setDrawerOpen(true);
+    else setOpen(true);
+  }, [isMobile, setDrawerOpen]);
+
+  useEffect(() => {
+    // best-effort; ignore failure because localStorage may be unavailable (quota, private mode)
+    try { localStorage.setItem(`${STORAGE_KEY}.open`, String(open)); } catch {}
+  }, [open]);
+
+  useEffect(() => {
+    let cancelled = false;
+    api.projects.files(projectId).then((r) => {
+      if (!cancelled) setFullFileList(r.files);
+    }).catch(() => {});
+    return () => { cancelled = true; };
+  }, [projectId]);
+
+  const loadDir = useCallback(async (dirPath: string) => {
+    const apiPath = dirPath === '' ? '.' : dirPath;
+    try {
+      const result = await api.projects.listDir(projectId, apiPath);
+      setCache((prev) => { const next = new Map(prev); next.set(dirPath, result.entries); return next; });
+    } catch { /* ignore */ }
+  }, [projectId]);
+
+  useEffect(() => {
+    if (!isOpen) return;
+    if (!cache.has('')) void loadDir('');
+  }, [isOpen, cache, loadDir]);
+
+  function toggleDir(dirPath: string) {
+    setExpandedDirs((prev) => {
+      const next = new Set(prev);
+      if (next.has(dirPath)) {
+        next.delete(dirPath);
+      } else {
+        next.add(dirPath);
+        if (!cache.has(dirPath)) void loadDir(dirPath);
+      }
+      return next;
+    });
+  }
+
+  async function openFile(path: string) {
+    try {
+      const result = await api.projects.viewFile(projectId, path);
+      setViewerFile({ path, content: result.content });
+    } catch { /* ignore */ }
+  }
+
+  // Filter results
+  const trimmed = filter.trim().toLowerCase();
+  const filterActive = trimmed.length > 0;
+
+  interface FilterResult { path: string; name: string; }
+
+  const filterResults = useMemo<FilterResult[]>(() => {
+    if (!filterActive) return [];
+    if (fullFileList) {
+      const filenameMatches: string[] = [];
+      const pathOnly: string[] = [];
+      for (const p of fullFileList) {
+        const lp = p.toLowerCase();
+        if (!lp.includes(trimmed)) continue;
+        if (basename(p).toLowerCase().includes(trimmed)) filenameMatches.push(p);
+        else pathOnly.push(p);
+      }
+      filenameMatches.sort((a, b) => a.localeCompare(b));
+      pathOnly.sort((a, b) => a.localeCompare(b));
+      return [...filenameMatches, ...pathOnly].slice(0, 50).map((p) => ({ path: p, name: basename(p) }));
+    }
+    return [];
+  }, [filterActive, trimmed, fullFileList]);
+
+  // Listen for open_file_in_browser events
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type !== 'open_file_in_browser') return;
+      if (!isOpen) openRail();
+      void openFile(event.path);
+    });
+  }, [isOpen, openRail, projectId]);
+
+  // Desktop closed state: render the floating chevron handle. Mobile never
+  // shows the handle — the toggle lives in the Session header on mobile.
+  if (!isMobile && !open) {
+    return (
+      <button
+        type="button"
+        onClick={() => setOpen(true)}
+        className="shrink-0 border-l bg-sidebar p-2 hover:bg-muted"
+        aria-label="Open file browser"
+      >
+        <PanelRightOpen size={16} />
+      </button>
+    );
+  }
+
+  const rootEntries = cache.get('') ?? [];
+
+  // Mobile: render as fixed-position right-side drawer (always mounted so
+  // the transform transition can animate in/out). Desktop: inline aside.
+  const asideCls = isMobile
+    ? cn(
+        'fixed inset-y-0 right-0 z-40 w-[85vw] max-w-sm border-l bg-sidebar flex flex-col overflow-hidden',
+        'transition-transform duration-200 ease-out',
+        drawerOpen ? 'translate-x-0' : 'translate-x-full',
+      )
+    : 'w-64 shrink-0 border-l bg-sidebar flex flex-col h-full overflow-hidden';
+
+  return (
+    <>
+      <aside className={asideCls}>
+        <div className="flex items-center gap-2 px-3 py-2 border-b shrink-0">
+          <span className="text-xs font-medium flex-1">Files</span>
+          <button
+            type="button"
+            onClick={closeRail}
+            className="p-1 rounded hover:bg-muted text-muted-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Close file browser"
+          >
+            <PanelRightClose size={14} />
+          </button>
+        </div>
+        <div className="px-2 py-1.5 shrink-0">
+          <Input
+            value={filter}
+            onChange={(e) => setFilter(e.target.value)}
+            placeholder="Filter files..."
+            className="h-7 text-xs"
+          />
+        </div>
+        <div className="flex-1 overflow-y-auto px-1 py-1">
+          {filterActive ? (
+            filterResults.length > 0 ? (
+              <ul className="list-none space-y-0.5">
+                {filterResults.map((r) => (
+                  <li key={r.path}>
+                    <button
+                      type="button"
+                      className="w-full flex items-center gap-1 px-2 py-1 text-xs rounded hover:bg-muted/60 text-left"
+                      onClick={() => void openFile(r.path)}
+                    >
+                      <FileText size={12} className="text-muted-foreground shrink-0" />
+                      <span className="font-bold truncate">{r.name}</span>
+                      <span className="text-muted-foreground ml-1 truncate">{r.path}</span>
+                    </button>
+                  </li>
+                ))}
+              </ul>
+            ) : (
+              <div className="text-xs text-muted-foreground px-2 py-4 text-center">No matches</div>
+            )
+          ) : (
+            <TreeLevel
+              parentPath=""
+              entries={rootEntries}
+              cache={cache}
+              expanded={expandedDirs}
+              depth={0}
+              onToggleDir={toggleDir}
+              onSelectFile={(path) => void openFile(path)}
+            />
+          )}
+        </div>
+      </aside>
+
+      {viewerFile && (
+        <FileViewerOverlay
+          path={viewerFile.path}
+          content={viewerFile.content}
+          lang={inferLanguage(viewerFile.path)}
+          projectId={projectId}
+          onClose={() => setViewerFile(null)}
+          onNavigate={(path) => void openFile(path)}
+        />
+      )}
+    </>
+  );
+}
+
+interface TreeLevelProps {
+  parentPath: string;
+  entries: FileEntry[];
+  cache: Map<string, FileEntry[]>;
+  expanded: Set<string>;
+  depth: number;
+  onToggleDir: (dirPath: string) => void;
+  onSelectFile: (path: string) => void;
+}
+
+function TreeLevel({ parentPath, entries, cache, expanded, depth, onToggleDir, onSelectFile }: TreeLevelProps) {
+  const sorted = useMemo(() => {
+    const copy = [...entries];
+    copy.sort((a, b) => {
+      if (a.kind !== b.kind) return a.kind === 'dir' ? -1 : 1;
+      return a.name.localeCompare(b.name);
+    });
+    return copy;
+  }, [entries]);
+
+  return (
+    <ul className="list-none">
+      {sorted.map((entry) => {
+        const fullPath = joinPath(parentPath, entry.name);
+        const isExpanded = entry.kind === 'dir' && expanded.has(fullPath);
+        return (
+          <li key={fullPath}>
+            <div
+              className="flex items-center gap-1 px-1 py-0.5 text-xs cursor-default rounded hover:bg-muted/60"
+              style={{ paddingLeft: 4 + depth * 12 }}
+              onClick={() => {
+                if (entry.kind === 'dir') onToggleDir(fullPath);
+                else onSelectFile(fullPath);
+              }}
+            >
+              {entry.kind === 'dir' ? (
+                isExpanded ? <ChevronDown size={10} className="shrink-0" /> : <ChevronRight size={10} className="shrink-0" />
+              ) : (
+                <span className="w-[10px] shrink-0" />
+              )}
+              {entry.kind === 'dir' ? (
+                <Folder size={12} className="text-muted-foreground shrink-0" />
+              ) : (
+                <FileText size={12} className="text-muted-foreground shrink-0" />
+              )}
+              <span className="truncate">{entry.name}</span>
+            </div>
+            {entry.kind === 'dir' && isExpanded && cache.has(fullPath) && (
+              <TreeLevel
+                parentPath={fullPath}
+                entries={cache.get(fullPath) ?? []}
+                cache={cache}
+                expanded={expanded}
+                depth={depth + 1}
+                onToggleDir={onToggleDir}
+                onSelectFile={onSelectFile}
+              />
+            )}
+          </li>
+        );
+      })}
+    </ul>
+  );
+}

apps/web/src/components/SessionLandingPage.tsx

@@ -0,0 +1,377 @@
+import { useState } from 'react';
+import { Archive, MessageSquare, Send, ChevronDown, ChevronRight, RotateCcw, Trash2 } from 'lucide-react';
+import type { Chat } from '@/api/types';
+import { Button } from '@/components/ui/button';
+import { Textarea } from '@/components/ui/textarea';
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
+import { formatTokens } from '@/lib/format';
+
+interface Props {
+  sessionId: string;
+  projectId: string;
+  chats: Chat[];
+  onOpenChat: (chatId: string) => void;
+  onSend: (content: string) => void;
+  onReopenChat: (chatId: string) => Promise<void>;
+  onArchiveChat: (chatId: string) => Promise<void>;
+  onRenameChat: (chatId: string, name: string) => Promise<void>;
+  onDeleteChat: (chatId: string) => Promise<void>;
+}
+
+function relTime(iso: string): string {
+  const now = Date.now();
+  const t = Date.parse(iso);
+  if (Number.isNaN(t)) return '';
+  const sec = Math.max(0, Math.floor((now - t) / 1000));
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+interface ChatRowProps {
+  chat: Chat;
+  onClick: () => void;
+  dimmed?: boolean;
+  trailing?: React.ReactNode;
+  actions?: React.ReactNode;
+  renamingId: string | null;
+  renameValue: string;
+  setRenameValue: (s: string) => void;
+  onFinishRename: () => void;
+  onCancelRename: () => void;
+  onContextStartRename: () => void;
+  onContextArchive: () => void;
+  onContextDelete: () => void;
+  showContextMenu: boolean;
+}
+
+function ChatRow({
+  chat,
+  onClick,
+  dimmed,
+  trailing,
+  actions,
+  renamingId,
+  renameValue,
+  setRenameValue,
+  onFinishRename,
+  onCancelRename,
+  onContextStartRename,
+  onContextArchive,
+  onContextDelete,
+  showContextMenu,
+}: ChatRowProps) {
+  const meta: string[] = [relTime(chat.updated_at)];
+  if (chat.message_count !== undefined && chat.message_count > 0) {
+    meta.push(`${chat.message_count} msg`);
+  }
+  const tokens = formatTokens(chat.effective_context_tokens);
+  if (tokens) meta.push(tokens);
+  const preview = chat.last_message_preview;
+  const isRenaming = renamingId === chat.id;
+
+  const inner = (
+    <button
+      type="button"
+      onClick={onClick}
+      className="w-full flex flex-col gap-0.5 px-3 py-2 hover:bg-muted/50 text-left"
+    >
+      <div className="flex items-center gap-2 min-w-0">
+        <MessageSquare className={`size-3.5 shrink-0 ${dimmed ? 'opacity-40' : 'opacity-70'}`} />
+        {isRenaming ? (
+          <input
+            autoFocus
+            value={renameValue}
+            onChange={(e) => setRenameValue(e.target.value)}
+            onBlur={() => onFinishRename()}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') onFinishRename();
+              if (e.key === 'Escape') onCancelRename();
+            }}
+            onClick={(e) => e.stopPropagation()}
+            className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+          />
+        ) : (
+          <span className={`truncate text-sm flex-1 ${dimmed ? 'text-muted-foreground' : ''}`}>
+            {chat.name ?? 'New chat'}
+          </span>
+        )}
+        {trailing && (
+          <span className="text-xs text-muted-foreground shrink-0">{trailing}</span>
+        )}
+        {actions && (
+          <div className="flex items-center gap-0.5 shrink-0">{actions}</div>
+        )}
+      </div>
+      <div className="ml-5 text-xs text-muted-foreground tabular-nums">
+        {meta.join(' · ')}
+      </div>
+      {preview && (
+        <div className="ml-5 text-xs italic text-muted-foreground truncate">
+          {preview}
+        </div>
+      )}
+    </button>
+  );
+
+  if (!showContextMenu) return inner;
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger asChild>{inner}</ContextMenuTrigger>
+      <ContextMenuContent>
+        <ContextMenuItem onSelect={onClick}>Open</ContextMenuItem>
+        <ContextMenuItem onSelect={onContextStartRename}>Rename</ContextMenuItem>
+        <ContextMenuItem onSelect={onContextArchive}>Archive</ContextMenuItem>
+        <ContextMenuSeparator />
+        <ContextMenuItem variant="destructive" onSelect={onContextDelete}>
+          Delete
+        </ContextMenuItem>
+      </ContextMenuContent>
+    </ContextMenu>
+  );
+}
+
+export function SessionLandingPage({
+  chats,
+  onOpenChat,
+  onSend,
+  onReopenChat,
+  onArchiveChat,
+  onRenameChat,
+  onDeleteChat,
+}: Props) {
+  const [composerValue, setComposerValue] = useState('');
+  const [showArchived, setShowArchived] = useState(false);
+  const [renamingId, setRenamingId] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+  const [archiveConfirm, setArchiveConfirm] = useState<Chat | null>(null);
+  const [deleteConfirm, setDeleteConfirm] = useState<Chat | null>(null);
+
+  const openChats = chats
+    .filter((c) => c.status === 'open')
+    .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime());
+  const archivedChats = chats
+    .filter((c) => c.status === 'archived')
+    .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime());
+
+  function handleSend() {
+    const text = composerValue.trim();
+    if (!text) return;
+    onSend(text);
+    setComposerValue('');
+  }
+
+  function startRename(chat: Chat) {
+    setRenamingId(chat.id);
+    setRenameValue(chat.name ?? '');
+  }
+
+  async function finishRename() {
+    if (renamingId && renameValue.trim()) {
+      await onRenameChat(renamingId, renameValue.trim());
+    }
+    setRenamingId(null);
+  }
+
+  // TODO: Landing page chat counts are a snapshot at mount. New messages in
+  // visible chats won't update the per-row stats until next mount/navigation.
+  return (
+    <div className="flex flex-col h-full min-h-0">
+      <div className="flex-1 overflow-y-auto px-6 py-4 space-y-6">
+        {openChats.length > 0 && (
+          <div>
+            <h3 className="text-xs font-medium text-muted-foreground mb-2">Open chats</h3>
+            <ul className="divide-y rounded-md border">
+              {openChats.map((chat) => (
+                <li key={chat.id}>
+                  <ChatRow
+                    chat={chat}
+                    onClick={() => onOpenChat(chat.id)}
+                    renamingId={renamingId}
+                    renameValue={renameValue}
+                    setRenameValue={setRenameValue}
+                    onFinishRename={() => void finishRename()}
+                    onCancelRename={() => setRenamingId(null)}
+                    onContextStartRename={() => startRename(chat)}
+                    onContextArchive={() => setArchiveConfirm(chat)}
+                    onContextDelete={() => setDeleteConfirm(chat)}
+                    showContextMenu
+                    actions={
+                      <>
+                        <Button
+                          variant="ghost"
+                          size="icon-sm"
+                          aria-label="Archive chat"
+                          title="Archive chat"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setArchiveConfirm(chat);
+                          }}
+                        >
+                          <Archive size={14} />
+                        </Button>
+                        <Button
+                          variant="ghost"
+                          size="icon-sm"
+                          aria-label="Delete chat"
+                          title="Delete chat"
+                          className="text-destructive hover:text-destructive"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setDeleteConfirm(chat);
+                          }}
+                        >
+                          <Trash2 size={14} />
+                        </Button>
+                      </>
+                    }
+                  />
+                </li>
+              ))}
+            </ul>
+          </div>
+        )}
+
+        {archivedChats.length > 0 && (
+          <div>
+            <button
+              type="button"
+              onClick={() => setShowArchived(!showArchived)}
+              className="flex items-center gap-1 text-xs font-medium text-muted-foreground mb-2 hover:text-foreground"
+            >
+              {showArchived ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+              Archived chats ({archivedChats.length})
+            </button>
+            {showArchived && (
+              <ul className="divide-y rounded-md border">
+                {archivedChats.map((chat) => (
+                  <li key={chat.id}>
+                    <ChatRow
+                      chat={chat}
+                      onClick={() => void onReopenChat(chat.id)}
+                      dimmed
+                      trailing={<><RotateCcw size={10} className="inline mr-1" />Restore</>}
+                      renamingId={null}
+                      renameValue=""
+                      setRenameValue={() => {}}
+                      onFinishRename={() => {}}
+                      onCancelRename={() => {}}
+                      onContextStartRename={() => {}}
+                      onContextArchive={() => {}}
+                      onContextDelete={() => {}}
+                      showContextMenu={false}
+                    />
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        )}
+
+        {openChats.length === 0 && archivedChats.length === 0 && (
+          <div className="text-sm text-muted-foreground py-8 text-center">
+            No chats yet. Type below to start a conversation.
+          </div>
+        )}
+      </div>
+
+      <div className="border-t px-4 py-3 flex items-end gap-2 shrink-0">
+        <Textarea
+          value={composerValue}
+          onChange={(e) => setComposerValue(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+              e.preventDefault();
+              handleSend();
+              return;
+            }
+            if (e.key === 'Enter' && !e.shiftKey) {
+              e.preventDefault();
+              handleSend();
+            }
+          }}
+          placeholder="Start a new chat..."
+          rows={2}
+          className="resize-none min-h-[52px] max-h-[160px]"
+        />
+        <Button
+          onClick={handleSend}
+          disabled={!composerValue.trim()}
+          size="icon-lg"
+          aria-label="Send"
+        >
+          <Send />
+        </Button>
+      </div>
+
+      <Dialog open={archiveConfirm !== null} onOpenChange={(open) => { if (!open) setArchiveConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive chat?</DialogTitle>
+            <DialogDescription>
+              Moves {archiveConfirm ? `"${archiveConfirm.name ?? 'New chat'}"` : 'this chat'} to the Archived chats section. You can restore it any time.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setArchiveConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              onClick={() => {
+                if (archiveConfirm) void onArchiveChat(archiveConfirm.id);
+                setArchiveConfirm(null);
+              }}
+            >
+              Archive
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={deleteConfirm !== null} onOpenChange={(open) => { if (!open) setDeleteConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete chat?</DialogTitle>
+            <DialogDescription>
+              Permanently delete{' '}
+              <span className="font-mono font-medium text-foreground">{deleteConfirm?.name || '(unnamed)'}</span>
+              {' '}and all its messages. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setDeleteConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={() => {
+                if (deleteConfirm) void onDeleteChat(deleteConfirm.id);
+                setDeleteConfirm(null);
+              }}
+            >
+              Delete
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </div>
+  );
+}

apps/web/src/components/SkillSlashCommand.tsx

@@ -0,0 +1,137 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { cn } from '@/lib/utils';
+import type { Skill } from '@/api/types';
+
+interface Props {
+  query: string;
+  skills: Skill[];
+  anchorRect: { top: number; left: number };
+  onSelect: (skillName: string) => void;
+  onClose: () => void;
+}
+
+// Batch 9.6: slash-command dropdown. Models FileMentionPopover's pattern —
+// fixed-positioned popover, keyboard nav, click-outside-to-close. shadcn
+// `Command` (cmdk) isn't installed in this project; per the addendum we use
+// a plain div + Tailwind instead of pulling a new primitive autonomously.
+
+// Case-insensitive prefix match on `name` only. Description is display-only
+// in v1 (substring search across description is deferred to a polish batch).
+function filterByPrefix(skills: Skill[], query: string): Skill[] {
+  const q = query.toLowerCase();
+  const filtered = q
+    ? skills.filter((s) => s.name.toLowerCase().startsWith(q))
+    : skills;
+  // Stable alphabetical ordering matches the server's cache order (skills.ts
+  // sorts on name asc) but we re-sort here so a stale client cache doesn't
+  // surprise the user.
+  return [...filtered].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function SkillSlashCommand({ query, skills, anchorRect, onSelect, onClose }: Props) {
+  const [highlightIndex, setHighlightIndex] = useState(0);
+  const popoverRef = useRef<HTMLDivElement>(null);
+  const filtered = useMemo(() => filterByPrefix(skills, query), [skills, query]);
+
+  useEffect(() => { setHighlightIndex(0); }, [query]);
+
+  // Arrow / Enter / Tab / Escape. Bound on document so keystrokes from the
+  // textarea reach the popover even though focus stays in the textarea.
+  useEffect(() => {
+    function handleKeyDown(e: KeyboardEvent) {
+      if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        setHighlightIndex((prev) => (prev < filtered.length - 1 ? prev + 1 : 0));
+      } else if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        setHighlightIndex((prev) => (prev > 0 ? prev - 1 : filtered.length - 1));
+      } else if (e.key === 'Enter' || e.key === 'Tab') {
+        if (filtered.length === 0) return;
+        e.preventDefault();
+        const target = filtered[highlightIndex] ?? filtered[0];
+        if (target) onSelect(target.name);
+      } else if (e.key === 'Escape') {
+        e.preventDefault();
+        onClose();
+      }
+    }
+    document.addEventListener('keydown', handleKeyDown);
+    return () => document.removeEventListener('keydown', handleKeyDown);
+  }, [filtered, highlightIndex, onSelect, onClose]);
+
+  useEffect(() => {
+    function handleMouseDown(e: MouseEvent) {
+      if (popoverRef.current && !popoverRef.current.contains(e.target as Node)) {
+        onClose();
+      }
+    }
+    document.addEventListener('mousedown', handleMouseDown);
+    return () => document.removeEventListener('mousedown', handleMouseDown);
+  }, [onClose]);
+
+  useEffect(() => {
+    const el = popoverRef.current?.querySelector('[data-highlighted="true"]');
+    if (el) el.scrollIntoView({ block: 'nearest' });
+  }, [highlightIndex]);
+
+  // Anchor sits above the input — translate(-100%) on Y so the dropdown
+  // expands upward from the anchor point rather than over the textarea.
+  const style = {
+    top: anchorRect.top,
+    left: anchorRect.left,
+    transform: 'translateY(-100%)',
+  } as const;
+
+  if (filtered.length === 0) {
+    return (
+      <div
+        ref={popoverRef}
+        className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[320px] p-2"
+        style={style}
+      >
+        <div className="text-xs text-muted-foreground px-2 py-1">
+          {query ? `No skill starts with "/${query}"` : 'No skills available'}
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div
+      ref={popoverRef}
+      className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[320px] max-w-[420px] max-h-[320px] overflow-y-auto"
+      style={style}
+    >
+      {filtered.map((skill, i) => (
+        <button
+          key={skill.name}
+          type="button"
+          data-highlighted={i === highlightIndex}
+          className={cn(
+            'w-full text-left px-2.5 py-2 cursor-pointer block',
+            i === highlightIndex && 'bg-muted',
+          )}
+          onMouseEnter={() => setHighlightIndex(i)}
+          onMouseDown={(e) => {
+            // mousedown not click — click runs after blur/focus shuffles which
+            // can race with the textarea's onBlur close path.
+            e.preventDefault();
+            onSelect(skill.name);
+          }}
+        >
+          <div className="font-mono text-xs font-bold text-foreground">/{skill.name}</div>
+          <div
+            className="text-xs text-muted-foreground overflow-hidden"
+            style={{
+              display: '-webkit-box',
+              WebkitLineClamp: 2,
+              WebkitBoxOrient: 'vertical',
+            }}
+          >
+            {skill.description}
+          </div>
+        </button>
+      ))}
+    </div>
+  );
+}

apps/web/src/components/StatusDot.tsx

@@ -0,0 +1,36 @@
+import { useChatStatus, type DerivedStatus } from '@/hooks/useChatStatus';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  chatId: string | null | undefined;
+  className?: string;
+}
+
+const STATUS_CLASS: Record<DerivedStatus, string> = {
+  working: 'bg-amber-500 animate-pulse',
+  idle_warm: 'bg-emerald-500',
+  idle_cold: 'bg-muted-foreground/40',
+  error: 'bg-destructive',
+};
+
+const STATUS_LABEL: Record<DerivedStatus, string> = {
+  working: 'working',
+  idle_warm: 'idle',
+  idle_cold: 'idle',
+  error: 'error',
+};
+
+export function StatusDot({ chatId, className }: Props) {
+  const status = useChatStatus(chatId);
+  return (
+    <span
+      aria-label={`Status: ${STATUS_LABEL[status]}`}
+      title={STATUS_LABEL[status]}
+      className={cn(
+        'inline-block w-1.5 h-1.5 rounded-full shrink-0',
+        STATUS_CLASS[status],
+        className,
+      )}
+    />
+  );
+}

apps/web/src/components/SwipeablePaneTab.tsx

@@ -0,0 +1,103 @@
+import { useRef, useState } from 'react';
+import type { TouchEvent } from 'react';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  label: string;
+  isActive: boolean;
+  onTap: () => void;
+  onClose: () => void;
+  canClose: boolean;
+}
+
+const CLOSE_THRESHOLD = 60;
+const MAX_TRAVEL = 120;
+const VERTICAL_BAIL = 30;
+
+// Pane tab with horizontal swipe-to-close (mobile only). Tracks horizontal
+// finger movement; if vertical exceeds VERTICAL_BAIL the gesture is cancelled
+// (so vertical scroll still works). On release past CLOSE_THRESHOLD, the
+// onClose callback fires. Otherwise the tab snaps back. Hand-rolled per spec.
+export function SwipeablePaneTab({ label, isActive, onTap, onClose, canClose }: Props) {
+  const [translateX, setTranslateX] = useState(0);
+  const [dragging, setDragging] = useState(false);
+  const startRef = useRef<{ x: number; y: number; bailed: boolean } | null>(null);
+
+  const onTouchStart = (e: TouchEvent) => {
+    if (!canClose) return;
+    const t = e.touches[0];
+    if (!t) return;
+    startRef.current = { x: t.clientX, y: t.clientY, bailed: false };
+    setDragging(true);
+  };
+
+  const onTouchMove = (e: TouchEvent) => {
+    const start = startRef.current;
+    if (!start || start.bailed) return;
+    const t = e.touches[0];
+    if (!t) return;
+    const dx = t.clientX - start.x;
+    const dy = t.clientY - start.y;
+    if (Math.abs(dy) > VERTICAL_BAIL) {
+      start.bailed = true;
+      setTranslateX(0);
+      setDragging(false);
+      return;
+    }
+    if (dx < 0) {
+      setTranslateX(Math.max(dx, -MAX_TRAVEL));
+    } else {
+      setTranslateX(0);
+    }
+  };
+
+  const onTouchEnd = () => {
+    const start = startRef.current;
+    startRef.current = null;
+    setDragging(false);
+    if (!start || start.bailed) {
+      setTranslateX(0);
+      return;
+    }
+    const tx = translateX;
+    if (tx <= -CLOSE_THRESHOLD) {
+      onClose();
+      // Don't reset translateX; the parent will unmount this tab.
+    } else {
+      setTranslateX(0);
+    }
+  };
+
+  // Opacity fades from 1 -> 0.4 as the tab approaches the close threshold.
+  const opacity =
+    translateX < 0
+      ? Math.max(0.4, 1 - (Math.abs(translateX) / CLOSE_THRESHOLD) * 0.6)
+      : 1;
+
+  return (
+    <button
+      type="button"
+      onClick={onTap}
+      onTouchStart={onTouchStart}
+      onTouchMove={onTouchMove}
+      onTouchEnd={onTouchEnd}
+      onTouchCancel={onTouchEnd}
+      style={{
+        transform: `translateX(${translateX}px)`,
+        opacity,
+        // Only animate when releasing (snap-back); during drag the transform
+        // tracks the finger 1:1 for a tight feel.
+        transition: dragging ? undefined : 'transform 0.15s ease, opacity 0.15s ease',
+      }}
+      className={cn(
+        'shrink-0 px-3 py-2 text-xs rounded min-h-[44px] min-w-[44px]',
+        isActive
+          ? 'bg-background text-foreground border'
+          : 'text-muted-foreground hover:bg-muted/40',
+      )}
+      aria-current={isActive ? 'true' : undefined}
+    >
+      <span className="truncate max-w-[140px] inline-block">{label}</span>
+    </button>
+  );
+}

apps/web/src/components/ThemePicker.tsx

@@ -0,0 +1,122 @@
+import { useState } from 'react';
+import { Check } from 'lucide-react';
+import { toast } from 'sonner';
+import { Card } from '@/components/ui/card';
+import { Label } from '@/components/ui/label';
+import { RadioGroup, RadioGroupItem } from '@/components/ui/radio-group';
+import { THEMES, setTheme, useTheme, type ThemeId, type ThemeMode } from '@/lib/theme';
+import { cn } from '@/lib/utils';
+
+// v1.9: lifted out of pages/Settings.tsx so the SettingsPane Theme tab and
+// the standalone /settings route render the same picker. Theme is global —
+// not per-project, not per-session — so no contextual props are needed.
+
+const MODES: { value: ThemeMode; label: string; hint: string }[] = [
+  { value: 'dark', label: 'Dark', hint: 'Use the dark variant.' },
+  { value: 'light', label: 'Light', hint: 'Use the light variant.' },
+  { value: 'system', label: 'System', hint: 'Follow OS preference.' },
+];
+
+export function ThemePicker() {
+  const { id: currentId, mode: currentMode } = useTheme();
+  // Track the most recent in-flight pick so the picker can show a subtle
+  // "applying…" state on the targeted card while the PATCH is in flight.
+  const [pending, setPending] = useState<
+    { kind: 'theme'; id: ThemeId } | { kind: 'mode'; mode: ThemeMode } | null
+  >(null);
+
+  async function pickTheme(id: ThemeId) {
+    if (id === currentId || pending) return;
+    setPending({ kind: 'theme', id });
+    try {
+      await setTheme(id, currentMode);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to apply theme');
+    } finally {
+      setPending(null);
+    }
+  }
+
+  async function pickMode(mode: ThemeMode) {
+    if (mode === currentMode || pending) return;
+    setPending({ kind: 'mode', mode });
+    try {
+      await setTheme(currentId, mode);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to apply mode');
+    } finally {
+      setPending(null);
+    }
+  }
+
+  return (
+    <div className="space-y-8">
+      <section className="space-y-3">
+        <h2 className="text-sm font-medium">Mode</h2>
+        <RadioGroup
+          value={currentMode}
+          onValueChange={(v) => void pickMode(v as ThemeMode)}
+          className="flex flex-wrap gap-4"
+        >
+          {MODES.map((m) => (
+            <div key={m.value} className="flex items-center gap-2">
+              <RadioGroupItem id={`mode-${m.value}`} value={m.value} />
+              <Label htmlFor={`mode-${m.value}`} className="cursor-pointer">
+                <span className="font-medium">{m.label}</span>
+                <span className="ml-2 text-xs text-muted-foreground">{m.hint}</span>
+              </Label>
+            </div>
+          ))}
+        </RadioGroup>
+      </section>
+
+      <section className="space-y-3">
+        <h2 className="text-sm font-medium">Theme</h2>
+        <div className="grid grid-cols-2 md:grid-cols-3 gap-3">
+          {THEMES.map((t) => {
+            const isActive = t.id === currentId;
+            const isPending = pending?.kind === 'theme' && pending.id === t.id;
+            const isLightOnly = !t.supportsDark;
+            return (
+              <Card
+                key={t.id}
+                onClick={() => void pickTheme(t.id)}
+                className={cn(
+                  'p-3 cursor-pointer transition-colors',
+                  'hover:bg-accent/10',
+                  isActive && 'ring-2 ring-ring',
+                  isPending && 'opacity-60',
+                )}
+              >
+                <div className="flex items-center justify-between gap-2">
+                  <div className="min-w-0">
+                    <div className="font-mono text-sm truncate">{t.name}</div>
+                    <div className="text-xs text-muted-foreground">{t.family}</div>
+                  </div>
+                  {isActive && (
+                    <span className="inline-flex items-center gap-1 text-xs text-primary shrink-0">
+                      <Check className="size-3" /> Selected
+                    </span>
+                  )}
+                </div>
+                <div className="flex mt-2 rounded overflow-hidden border border-border/40">
+                  {t.anchors.map((hex, i) => (
+                    <div
+                      key={i}
+                      className="flex-1 h-6"
+                      style={{ backgroundColor: hex }}
+                      aria-hidden="true"
+                    />
+                  ))}
+                </div>
+                {isLightOnly && (
+                  <div className="mt-2 text-xs text-muted-foreground italic">Light only</div>
+                )}
+              </Card>
+            );
+          })}
+        </div>
+      </section>
+    </div>
+  );
+}

apps/web/src/components/ToolCallCard.tsx

@@ -1,102 +0,0 @@
-import { useState } from 'react';
-import type { ReactNode } from 'react';
-import { ChevronRight, Wrench } from 'lucide-react';
-import type { Message, ToolCall } from '@/api/types';
-import { sessionEvents } from '@/hooks/sessionEvents';
-
-interface Props {
-  message?: Message;
-  toolCall?: ToolCall;
-}
-
-// Same regex/heuristic as MessageBubble: paths ending in `.ext` with at
-// least one `/`. Linkifies file paths emitted by tools like grep / find_files
-// so they're clickable.
-const PATH_REGEX = /([a-zA-Z0-9._/-]+\.[a-zA-Z0-9]+)/g;
-
-function linkifyOutput(text: string): ReactNode[] {
-  const out: ReactNode[] = [];
-  let lastIdx = 0;
-  let idx = 0;
-  for (const match of text.matchAll(PATH_REGEX)) {
-    const matchedText = match[0];
-    const start = match.index ?? 0;
-    if (!matchedText.includes('/')) continue;
-    if (start > lastIdx) out.push(text.slice(lastIdx, start));
-    out.push(
-      <button
-        key={idx}
-        type="button"
-        onClick={() =>
-          sessionEvents.emit({
-            type: 'open_file_in_browser',
-            path: matchedText,
-          })
-        }
-        className="text-primary underline cursor-pointer hover:text-primary/80"
-      >
-        {matchedText}
-      </button>
-    );
-    lastIdx = start + matchedText.length;
-    idx += 1;
-  }
-  if (lastIdx < text.length) out.push(text.slice(lastIdx));
-  return out.length > 0 ? out : [text];
-}
-
-export function ToolCallCard({ message, toolCall }: Props) {
-  const [open, setOpen] = useState(false);
-  const tc = toolCall ?? message?.tool_calls?.[0];
-  const result = message?.tool_results;
-
-  const name = tc?.name ?? 'tool';
-  const args = tc?.args ?? {};
-  const error = result?.error;
-  const output = result?.output;
-  const truncated = result?.truncated;
-
-  return (
-    <div className="rounded-md border border-border bg-muted/30 text-sm overflow-hidden">
-      <button
-        type="button"
-        onClick={() => setOpen((v) => !v)}
-        className="w-full flex items-center gap-2 px-2.5 py-1.5 hover:bg-muted/60 text-left"
-      >
-        <ChevronRight
-          className={`size-3.5 transition-transform ${open ? 'rotate-90' : ''}`}
-        />
-        <Wrench className="size-3.5 opacity-70" />
-        <span className="font-mono font-medium">{name}</span>
-        <span className="font-mono text-xs text-muted-foreground truncate min-w-0 flex-1">
-          {JSON.stringify(args)}
-        </span>
-        {error && (
-          <span className="text-xs text-destructive font-medium ml-2">error</span>
-        )}
-        {truncated && (
-          <span className="text-xs text-muted-foreground ml-2">truncated</span>
-        )}
-      </button>
-      {open && (
-        <div className="px-2.5 py-2 border-t bg-background/40">
-          {error ? (
-            <pre className="text-xs text-destructive font-mono whitespace-pre-wrap">
-              {error}
-            </pre>
-          ) : output !== undefined ? (
-            <pre className="text-xs font-mono whitespace-pre-wrap overflow-x-auto max-h-72 overflow-y-auto">
-              {linkifyOutput(
-                typeof output === 'string'
-                  ? output
-                  : JSON.stringify(output, null, 2)
-              )}
-            </pre>
-          ) : (
-            <div className="text-xs text-muted-foreground">no result yet</div>
-          )}
-        </div>
-      )}
-    </div>
-  );
-}

apps/web/src/components/ToolCallGroup.tsx

@@ -0,0 +1,64 @@
+import { useState } from 'react';
+import { ChevronRight } from 'lucide-react';
+import { ToolCallLine, runStatus, type ToolRun } from './ToolCallLine';
+
+interface Props {
+  // All runs must share the same tool name. Caller (MessageList grouping
+  // pass) enforces that invariant.
+  runs: ToolRun[];
+}
+
+export function ToolCallGroup({ runs }: Props) {
+  const [open, setOpen] = useState(false);
+  if (runs.length === 0) return null;
+  const toolName = runs[0]!.call.name;
+  const count = runs.length;
+
+  // Group-level status: pending if any are still running, error if any
+  // finished with an error, otherwise success. Matches the visual the user
+  // gets when scanning a long run of greps / view_files.
+  let pending = 0;
+  let errored = 0;
+  for (const r of runs) {
+    const s = runStatus(r);
+    if (s === 'pending') pending += 1;
+    else if (s === 'error') errored += 1;
+  }
+  const summaryParts: string[] = [];
+  if (pending > 0) summaryParts.push(`${pending} running`);
+  if (errored > 0) summaryParts.push(`${errored} failed`);
+  const summary = summaryParts.length > 0 ? ` (${summaryParts.join(', ')})` : '';
+
+  return (
+    <div className="rounded border border-border/60 bg-muted/20 text-xs">
+      <button
+        type="button"
+        onClick={() => setOpen((v) => !v)}
+        className="w-full flex items-center gap-1.5 px-2 py-1 hover:bg-muted/40 text-left"
+      >
+        <ChevronRight
+          className={`size-3 text-muted-foreground/60 shrink-0 transition-transform ${open ? 'rotate-90' : ''}`}
+        />
+        <span className="text-muted-foreground/60 select-none shrink-0">⊞</span>
+        <span className="font-mono text-foreground/90">
+          {count} {toolName} call{count === 1 ? '' : 's'}
+        </span>
+        {summary && (
+          <span className="text-muted-foreground truncate">{summary}</span>
+        )}
+        <span className="ml-auto text-muted-foreground/60 shrink-0">tap</span>
+      </button>
+      {open && (
+        <div className="border-t border-border/40 px-2 py-1 space-y-0.5">
+          {runs.map((run, i) => (
+            <ToolCallLine
+              key={`${run.call.id}-${i}`}
+              run={run}
+              insideGroup
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}

apps/web/src/components/ToolCallLine.tsx

@@ -0,0 +1,167 @@
+import { useState } from 'react';
+import type { ReactNode } from 'react';
+import { Check, ChevronRight, Loader2, X } from 'lucide-react';
+import type { ToolCall, ToolResult } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
+
+// v1.8.2: cap on the inline arg-summary length. Expanded view shows full
+// args + full result, so this is purely a single-line render budget.
+const ARG_SUMMARY_MAX = 60;
+
+export interface ToolRun {
+  call: ToolCall;
+  // null while the call is in flight or the matching tool result hasn't
+  // arrived yet on the WS stream.
+  result: ToolResult | null;
+}
+
+function truncate(s: string, n: number): string {
+  return s.length > n ? s.slice(0, n - 1) + '…' : s;
+}
+
+// Per-tool argument summary mapping from the v1.8.2 spec. Goal is a single
+// scannable line that surfaces the *what* (path / pattern) without
+// overwhelming the chat with full JSON.
+export function formatToolArgs(name: string, args: Record<string, unknown>): string {
+  if (name === 'view_file') {
+    const path = String(args.path ?? '');
+    const start = args.start_line;
+    const end = args.end_line;
+    if (typeof start === 'number' && typeof end === 'number') {
+      return truncate(`${path}:${start}-${end}`, ARG_SUMMARY_MAX);
+    }
+    if (typeof start === 'number') {
+      return truncate(`${path}:${start}`, ARG_SUMMARY_MAX);
+    }
+    return truncate(path, ARG_SUMMARY_MAX);
+  }
+  if (name === 'list_dir') {
+    return truncate(String(args.path ?? '.'), ARG_SUMMARY_MAX);
+  }
+  if (name === 'grep') {
+    const pattern = String(args.pattern ?? '');
+    const path = args.path ? ` ${String(args.path)}` : '';
+    return truncate(`"${pattern}"${path}`, ARG_SUMMARY_MAX);
+  }
+  if (name === 'find_files') {
+    return truncate(String(args.pattern ?? ''), ARG_SUMMARY_MAX);
+  }
+  if (name === 'git_status') {
+    return '';
+  }
+  // Unknown tool — surface first arg value or the literal {} so the user can
+  // see something happened. Forward-compatible with future tools.
+  const keys = Object.keys(args);
+  if (keys.length === 0) return '{}';
+  const first = keys[0]!;
+  return truncate(`${first}: ${String(args[first])}`, ARG_SUMMARY_MAX);
+}
+
+export function runStatus(run: ToolRun): 'pending' | 'success' | 'error' {
+  if (run.result === null) return 'pending';
+  if (run.result.error) return 'error';
+  return 'success';
+}
+
+// Path-shaped paths in tool output text get a click handler so users can
+// jump to the file. Same heuristic as MessageBubble.linkifyPaths.
+const PATH_REGEX = /([a-zA-Z0-9._/-]+\.[a-zA-Z0-9]+)/g;
+function linkifyOutput(text: string): ReactNode[] {
+  const out: ReactNode[] = [];
+  let lastIdx = 0;
+  let idx = 0;
+  for (const match of text.matchAll(PATH_REGEX)) {
+    const matchedText = match[0];
+    const start = match.index ?? 0;
+    if (!matchedText.includes('/')) continue;
+    if (start > lastIdx) out.push(text.slice(lastIdx, start));
+    out.push(
+      <button
+        key={idx}
+        type="button"
+        onClick={() =>
+          sessionEvents.emit({ type: 'open_file_in_browser', path: matchedText })
+        }
+        className="text-primary underline cursor-pointer hover:text-primary/80"
+      >
+        {matchedText}
+      </button>
+    );
+    lastIdx = start + matchedText.length;
+    idx += 1;
+  }
+  if (lastIdx < text.length) out.push(text.slice(lastIdx));
+  return out.length > 0 ? out : [text];
+}
+
+interface Props {
+  run: ToolRun;
+  // When rendered inside a ToolCallGroup the line is already nested under a
+  // shared header, so the leading arrow is dropped to avoid double indent.
+  insideGroup?: boolean;
+}
+
+export function ToolCallLine({ run, insideGroup }: Props) {
+  const [open, setOpen] = useState(false);
+  const status = runStatus(run);
+  const args = run.call.args ?? {};
+  const summary = formatToolArgs(run.call.name, args);
+
+  return (
+    <div className="text-xs">
+      <button
+        type="button"
+        onClick={() => setOpen((v) => !v)}
+        className="flex items-center gap-1.5 w-full text-left hover:bg-muted/40 rounded px-1 py-0.5 -mx-1"
+      >
+        {!insideGroup && (
+          <span className="text-muted-foreground/60 select-none shrink-0">↳</span>
+        )}
+        <ChevronRight
+          className={`size-3 text-muted-foreground/60 shrink-0 transition-transform ${open ? 'rotate-90' : ''}`}
+        />
+        <span className="font-mono text-foreground/90 shrink-0">{run.call.name}</span>
+        {summary && (
+          <span className="font-mono text-muted-foreground truncate min-w-0 flex-1">
+            {summary}
+          </span>
+        )}
+        {!summary && <span className="flex-1" />}
+        <span className="shrink-0 ml-1">
+          {status === 'pending' && (
+            <Loader2 className="size-3 text-muted-foreground animate-spin" aria-label="running" />
+          )}
+          {status === 'success' && (
+            <Check className="size-3 text-emerald-500" aria-label="success" />
+          )}
+          {status === 'error' && (
+            <X className="size-3 text-destructive" aria-label="error" />
+          )}
+        </span>
+      </button>
+      {open && (
+        <div className="ml-5 mt-1 mb-1 space-y-1">
+          <pre className="text-[10px] text-muted-foreground font-mono whitespace-pre-wrap break-all bg-muted/30 rounded px-2 py-1">
+            {JSON.stringify(args, null, 2)}
+          </pre>
+          {run.result && (
+            <pre className="text-[11px] font-mono whitespace-pre-wrap bg-muted/30 rounded px-2 py-1 max-h-72 overflow-y-auto">
+              {run.result.error ? (
+                <span className="text-destructive">{run.result.error}</span>
+              ) : (
+                linkifyOutput(
+                  typeof run.result.output === 'string'
+                    ? run.result.output
+                    : JSON.stringify(run.result.output, null, 2)
+                )
+              )}
+              {run.result.truncated && (
+                <div className="text-muted-foreground/60 mt-1">— output truncated —</div>
+              )}
+            </pre>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}

apps/web/src/components/Workspace.tsx

@@ -1,339 +1,262 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import type { DragEvent } from 'react';
-import { Plus } from 'lucide-react';
-import { usePanes } from '@/hooks/usePanes';
-import { sessionEvents } from '@/hooks/sessionEvents';
-import type { FileBrowserPaneState, Pane, PaneKind } from '@/api/types';
-import { PaneTab } from '@/components/PaneTab';
-import { PaneShell } from '@/components/panes/PaneShell';
+import { useEffect, useState } from 'react';
+import { PanelRight, MessageSquare, Terminal, Bot } from 'lucide-react';
+import type { Chat, Project, Session, WorkspacePane } from '@/api/types';
+import { MAX_PANES, type UseWorkspacePanesResult } from '@/hooks/useWorkspacePanes';
+import type { UseSessionChatsResult } from '@/hooks/useSessionChats';
+import { useViewport } from '@/hooks/useViewport';
 import { ChatPane } from '@/components/panes/ChatPane';
-import { FileBrowserPane } from '@/components/panes/FileBrowserPane';
+import { SettingsPane } from '@/components/panes/SettingsPane';
+import { ChatTabBar } from '@/components/ChatTabBar';
+import { SessionLandingPage } from '@/components/SessionLandingPage';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
 import { cn } from '@/lib/utils';
 
 interface Props {
   sessionId: string;
   projectId: string;
+  // Batch 9: threaded down to ChatPane → ChatInput → AgentPicker.
+  agentId?: string | null;
+  onAgentChange?: (agentId: string | null) => void | Promise<void>;
+  // v1.8: panes + chats hoisted into Session.tsx so the mobile header pill
+  // (MobileTabSwitcher) can share state with the pane grid.
+  panesHook: UseWorkspacePanesResult;
+  chatsHook: UseSessionChatsResult;
+  // v1.9: passed through to SettingsPane when one is mounted in the grid.
+  session: Session;
+  project: Project | null;
 }
 
-const MAX_PANES = 5;
+export function Workspace({
+  sessionId,
+  projectId,
+  agentId,
+  onAgentChange,
+  panesHook,
+  chatsHook,
+  session,
+  project,
+}: Props) {
+  const {
+    panes,
+    activePaneIdx,
+    setActivePaneIdx,
+    openChatInPane,
+    switchTab,
+    removeTab,
+    closeOtherTabs,
+    closeTabsToRight,
+    closeAllTabs,
+    showLandingPage,
+    addSplitPane,
+    removePane,
+    handlePaneDragStart,
+    handlePaneDragOver,
+    handlePaneDragLeave,
+    handlePaneDrop,
+    handlePaneDragEnd,
+    dragOverIdx,
+    draggingIdxRef,
+  } = panesHook;
+  const {
+    chats,
+    createChat,
+    archiveChat,
+    unarchiveChat,
+    deleteChat,
+    renameChat,
+    handleLandingSend,
+  } = chatsHook;
 
-function PaneSkeleton() {
-  return (
-    <div className="flex flex-col h-full">
-      <div className="flex items-center border-b border-border bg-muted/20 h-8" />
-      <div className="flex-1 flex items-center justify-center text-xs text-muted-foreground">
-        Loading panes...
-      </div>
-    </div>
-  );
-}
+  const { isMobile } = useViewport();
 
-function PaneError({
-  message,
-  onRetry,
-}: {
-  message: string;
-  onRetry: () => void | Promise<void>;
-}) {
-  return (
-    <div className="flex flex-col h-full items-center justify-center gap-2 text-sm">
-      <span className="text-destructive">{message}</span>
-      <button
-        type="button"
-        onClick={() => void onRetry()}
-        className="text-xs underline text-muted-foreground hover:text-foreground"
-      >
-        Retry
-      </button>
-    </div>
-  );
-}
+  // v1.9: workspace-level maximize state for the settings pane. CSS-only:
+  // sibling panes get display:none, the maximized pane fills the grid cell.
+  // ESC listener only mounted while maximized. Mobile is always full-width
+  // for a single pane so maximize doesn't apply.
+  const [maximized, setMaximized] = useState(false);
+  const settingsIdx = panes.findIndex((p) => p.kind === 'settings');
 
-export function Workspace({ sessionId, projectId }: Props) {
-  const { panes, loading, error, create, update, remove, refresh } =
-    usePanes(sessionId);
-  const [activeId, setActiveId] = useState<string | null>(null);
-  const draggingIdRef = useRef<string | null>(null);
-
-  // Keep latest panes in a ref so the event-bus subscription doesn't need
-  // to re-subscribe whenever the list changes (which would race with rapid
-  // updates).
-  const panesRef = useRef<Pane[] | null>(null);
-  panesRef.current = panes;
-
-  // Default active: first pane (and reset if the active one disappears)
+  // Esc semantics: maximized → restore; otherwise → close settings pane (only
+  // when it's the active pane). Bail when the user is typing in a field or
+  // inside an open dialog so we don't eat their cancel keystroke.
   useEffect(() => {
-    if (!panes || panes.length === 0) {
-      if (activeId !== null) setActiveId(null);
-      return;
+    if (settingsIdx < 0) return;
+    function onKey(e: KeyboardEvent) {
+      if (e.key !== 'Escape') return;
+      const t = e.target;
+      if (t instanceof HTMLElement) {
+        if (t.tagName === 'INPUT' || t.tagName === 'TEXTAREA' || t.isContentEditable) return;
+        if (t.closest('[role="dialog"]')) return;
+      }
+      if (maximized) {
+        setMaximized(false);
+      } else if (activePaneIdx === settingsIdx) {
+        removePane(settingsIdx);
+      }
     }
-    if (!panes.some((p) => p.id === activeId)) {
-      setActiveId(panes[0]!.id);
-    }
-  }, [panes, activeId]);
+    window.addEventListener('keydown', onKey);
+    return () => window.removeEventListener('keydown', onKey);
+  }, [maximized, settingsIdx, activePaneIdx, removePane]);
 
-  // Tracks an in-flight create() call so rapid open_file_in_browser events
-  // don't race to each spawn a new file_browser pane. While a create is in
-  // progress the subsequent events wait for it and update the same pane.
-  const creatingRef = useRef<{ id: string; promise: Promise<string> } | null>(
-    null
-  );
-
-  // Subscribe to open_file_in_browser events: focus an existing file_browser
-  // pane (updating its open_file) or spawn one if room is available.
+  // If the settings pane was closed (no longer in panes) while maximized,
+  // clear the maximize state so the grid renders normally.
   useEffect(() => {
-    return sessionEvents.subscribe((event) => {
-      if (event.type !== 'open_file_in_browser') return;
-      void (async () => {
-        // If a create is already in flight, wait for it to finish then update
-        // the newly-created pane rather than spawning a second one.
-        if (creatingRef.current) {
-          const { id: pendingId, promise } = creatingRef.current;
-          const resolvedId = await promise;
-          const targetId = resolvedId || pendingId;
-          const current = panesRef.current;
-          const fb = current?.find((p) => p.id === targetId);
-          const nextState: FileBrowserPaneState = {
-            ...(fb?.kind === 'file_browser' ? fb.state : {}),
-            open_file: event.path,
-          };
-          await update(targetId, { state: nextState });
-          setActiveId(targetId);
-          return;
-        }
+    if (maximized && settingsIdx < 0) setMaximized(false);
+  }, [maximized, settingsIdx]);
 
-        const current = panesRef.current;
-        if (!current) return;
-        const fb = current.find(
-          (p): p is Pane & { kind: 'file_browser' } =>
-            p.kind === 'file_browser'
-        );
-        if (fb) {
-          const nextState: FileBrowserPaneState = {
-            ...fb.state,
-            open_file: event.path,
-          };
-          await update(fb.id, { state: nextState });
-          setActiveId(fb.id);
-        } else if (current.length < MAX_PANES) {
-          // Reserve the slot immediately so concurrent events see the flag.
-          const createPromise = (async (): Promise<string> => {
-            const newPane = await create({ kind: 'file_browser' });
-            return newPane.id;
-          })();
-          // Use a stable object; id is filled in once resolved.
-          const entry: { id: string; promise: Promise<string> } = {
-            id: '',
-            promise: createPromise,
-          };
-          creatingRef.current = entry;
-          try {
-            const newId = await createPromise;
-            entry.id = newId;
-            const nextState: FileBrowserPaneState = {
-              open_file: event.path,
-              filter: '',
-              expanded_dirs: [],
-            };
-            await update(newId, { state: nextState });
-            setActiveId(newId);
-          } finally {
-            if (creatingRef.current === entry) {
-              creatingRef.current = null;
-            }
-          }
-        }
-      })();
-    });
-  }, [create, update]);
-
-  const handleClose = useCallback(
-    async (id: string) => {
-      try {
-        await remove(id);
-      } catch {
-        /* error surfaced via hook state */
-      }
-    },
-    [remove]
-  );
-
-  const handleSplit = useCallback(
-    async (afterIdx: number, kind: PaneKind) => {
-      const current = panesRef.current;
-      if (!current || current.length >= MAX_PANES) return;
-      try {
-        const created = await create({ kind, position: afterIdx + 1 });
-        setActiveId(created.id);
-      } catch {
-        /* error surfaced via hook state */
-      }
-    },
-    [create]
-  );
-
-  const handleCloseOthers = useCallback(
-    async (id: string) => {
-      const current = panesRef.current;
-      if (!current) return;
-      const targets = current.filter((p) => p.id !== id).map((p) => p.id);
-      for (const targetId of targets) {
-        try {
-          await remove(targetId);
-        } catch {
-          // Stop on first failure to avoid cascading errors.
-          return;
-        }
-      }
-    },
-    [remove]
-  );
-
-  const handleCloseToRight = useCallback(
-    async (idx: number) => {
-      const current = panesRef.current;
-      if (!current) return;
-      const targets = current.slice(idx + 1).map((p) => p.id);
-      for (const targetId of targets) {
-        try {
-          await remove(targetId);
-        } catch {
-          return;
-        }
-      }
-    },
-    [remove]
-  );
-
-  const handleCloseAll = useCallback(async () => {
-    const current = panesRef.current;
-    if (!current) return;
-    const targets = current.map((p) => p.id);
-    for (const targetId of targets) {
-      try {
-        await remove(targetId);
-      } catch {
-        return;
-      }
-    }
-  }, [remove]);
-
-  const handleAdd = useCallback(async () => {
-    const current = panesRef.current;
-    if (current && current.length >= MAX_PANES) return;
-    try {
-      const created = await create({ kind: 'chat' });
-      setActiveId(created.id);
-    } catch {
-      /* error surfaced via hook state */
-    }
-  }, [create]);
-
-  const handleDragStart = useCallback(
-    (id: string) => (e: DragEvent<HTMLDivElement>) => {
-      draggingIdRef.current = id;
-      e.dataTransfer.effectAllowed = 'move';
-      e.dataTransfer.setData('text/plain', id);
-    },
-    []
-  );
-
-  const handleDragOver = useCallback((e: DragEvent<HTMLDivElement>) => {
-    e.preventDefault();
-    e.dataTransfer.dropEffect = 'move';
-  }, []);
-
-  const handleDrop = useCallback(
-    (targetIdx: number) => async (e: DragEvent<HTMLDivElement>) => {
-      e.preventDefault();
-      const draggedId =
-        draggingIdRef.current || e.dataTransfer.getData('text/plain');
-      draggingIdRef.current = null;
-      if (!draggedId) return;
-      const current = panesRef.current;
-      if (!current) return;
-      const draggedIdx = current.findIndex((p) => p.id === draggedId);
-      if (draggedIdx < 0 || draggedIdx === targetIdx) return;
-      try {
-        await update(draggedId, { position: targetIdx });
-      } catch {
-        /* error surfaced via hook state */
-      }
-    },
-    [update]
-  );
-
-  if (loading && !panes) return <PaneSkeleton />;
-  if (error && !panes) return <PaneError message={error} onRetry={refresh} />;
-  if (!panes) return <PaneSkeleton />;
+  function chatsForPane(pane: WorkspacePane): Chat[] {
+    return pane.chatIds
+      .map((id) => chats.find((c) => c.id === id))
+      .filter((c): c is Chat => c !== undefined);
+  }
 
   return (
     <div className="flex flex-col h-full min-h-0">
-      <div
-        className="flex items-center border-b border-border bg-muted/20"
-        role="tablist"
-      >
-        {panes.map((pane, idx) => (
-          <PaneTab
-            key={pane.id}
-            pane={pane}
-            isActive={pane.id === activeId}
-            onClick={() => setActiveId(pane.id)}
-            onClose={() => void handleClose(pane.id)}
-            onSplit={(kind) => void handleSplit(idx, kind)}
-            onCloseOthers={() => void handleCloseOthers(pane.id)}
-            onCloseToRight={() => void handleCloseToRight(idx)}
-            onCloseAll={() => void handleCloseAll()}
-            onDragStart={handleDragStart(pane.id)}
-            onDragOver={handleDragOver}
-            onDrop={handleDrop(idx)}
-          />
-        ))}
-        <button
-          type="button"
-          onClick={() => void handleAdd()}
-          disabled={panes.length >= MAX_PANES}
-          className={cn(
-            'p-1.5 ml-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground',
-            panes.length >= MAX_PANES && 'opacity-40 cursor-not-allowed hover:bg-transparent'
-          )}
-          aria-label="Add pane"
-        >
-          <Plus size={14} />
-        </button>
-      </div>
-      {panes.length === 0 ? (
-        <div className="flex-1 flex items-center justify-center text-xs text-muted-foreground">
-          No panes. Click + to add one.
-        </div>
-      ) : (
-        <div
-          className="flex-1 grid min-h-0"
-          style={{
-            gridTemplateColumns: `repeat(${panes.length}, minmax(0, 1fr))`,
-          }}
-        >
-          {panes.map((pane) => (
-            <PaneShell
-              key={pane.id}
-              pane={pane}
-              onClose={() => void handleClose(pane.id)}
-            >
-              {pane.kind === 'chat' ? (
-                <ChatPane sessionId={sessionId} />
-              ) : (
-                <FileBrowserPane
-                  pane={pane}
-                  projectId={projectId}
-                  onStateChange={(state) =>
-                    void update(pane.id, { state })
-                  }
-                />
-              )}
-            </PaneShell>
-          ))}
+      {!isMobile && (
+        <div className="flex items-center gap-2 border-b border-border bg-muted/20 px-3 py-1.5 shrink-0">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <button
+                type="button"
+                // v1.9: settings panes excluded from the MAX cap (decision c).
+                disabled={panes.filter((p) => p.kind !== 'settings').length >= MAX_PANES}
+                className={cn(
+                  'flex items-center gap-1 text-xs px-2 py-1 rounded hover:bg-muted',
+                  panes.filter((p) => p.kind !== 'settings').length >= MAX_PANES &&
+                    'opacity-40 cursor-not-allowed hover:bg-transparent'
+                )}
+              >
+                <PanelRight size={14} />
+                Split
+              </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent>
+              <DropdownMenuItem onSelect={() => addSplitPane('chat')}>
+                <MessageSquare size={14} /> Chat
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => addSplitPane('terminal')}>
+                <Terminal size={14} /> Terminal
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => addSplitPane('agent')}>
+                <Bot size={14} /> Agent
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       )}
+
+      {/* v1.8: mobile multi-pane SwipeablePaneTab strip removed; the header
+          pill (MobileTabSwitcher) is the mobile pane switcher. */}
+
+      <div
+        className={cn('flex-1 min-h-0', isMobile ? 'flex' : 'grid')}
+        style={
+          isMobile
+            ? undefined
+            : maximized && settingsIdx >= 0
+              ? { gridTemplateColumns: 'minmax(0, 1fr)' }
+              : { gridTemplateColumns: `repeat(${panes.length}, minmax(0, 1fr))` }
+        }
+      >
+        {panes.map((pane, idx) => {
+          const isSettings = pane.kind === 'settings';
+          // v1.9: when maximized, hide every pane except the settings one.
+          // display:none keeps the React tree mounted so streams / drafts
+          // survive the toggle without re-mount cost.
+          const hiddenForMaximize = !isMobile && maximized && idx !== settingsIdx;
+          const visible = (!isMobile || idx === activePaneIdx) && !hiddenForMaximize;
+          if (!visible) {
+            if (hiddenForMaximize) {
+              return <div key={pane.id} className="hidden" />;
+            }
+            return null;
+          }
+          return (
+          <div
+            key={pane.id}
+            className={cn(
+              'flex flex-col h-full min-h-0 border-r border-border last:border-r-0 relative',
+              isMobile ? 'flex-1 w-full' : undefined,
+              !isMobile && idx === activePaneIdx && 'ring-1 ring-inset ring-ring/20',
+              !isMobile && dragOverIdx === idx && draggingIdxRef.current !== idx &&
+                'before:absolute before:inset-y-0 before:left-0 before:w-0.5 before:bg-primary before:z-10'
+            )}
+            onClick={() => setActivePaneIdx(idx)}
+            onDragOver={!isMobile && !isSettings && panes.length > 1 ? handlePaneDragOver(idx) : undefined}
+            onDragLeave={!isMobile && !isSettings && panes.length > 1 ? handlePaneDragLeave : undefined}
+            onDrop={!isMobile && !isSettings && panes.length > 1 ? handlePaneDrop(idx) : undefined}
+          >
+            <div
+              draggable={!isMobile && !isSettings && panes.length > 1}
+              onDragStart={!isMobile && !isSettings && panes.length > 1 ? handlePaneDragStart(idx) : undefined}
+              onDragEnd={!isMobile && !isSettings && panes.length > 1 ? handlePaneDragEnd : undefined}
+            >
+              {/* Hidden on mobile per v1.8; settings panes own their own
+                  section nav / maximize toggle so they skip ChatTabBar
+                  entirely. */}
+              {!isMobile && !isSettings && (
+                <ChatTabBar
+                  pane={pane}
+                  tabs={chatsForPane(pane)}
+                  onSwitchTab={(tabIdx) => switchTab(idx, tabIdx)}
+                  onRemoveTab={(chatId) => removeTab(idx, chatId)}
+                  onCloseOthers={(chatId) => closeOtherTabs(idx, chatId)}
+                  onCloseToRight={(chatId) => closeTabsToRight(idx, chatId)}
+                  onCloseAll={() => closeAllTabs(idx)}
+                  onNewChat={() => void createChat(idx)}
+                  onShowHistory={() => showLandingPage(idx)}
+                  onRename={renameChat}
+                  onRemovePane={panes.length > 1 ? () => removePane(idx) : undefined}
+                />
+              )}
+            </div>
+
+            <div className="flex-1 min-h-0 overflow-hidden">
+              {isSettings && project ? (
+                <SettingsPane
+                  session={session}
+                  project={project}
+                  maximized={maximized}
+                  onToggleMaximize={() => setMaximized((v) => !v)}
+                  onClose={() => removePane(idx)}
+                  isMobile={isMobile}
+                />
+              ) : pane.kind === 'chat' && pane.chatId ? (
+                <ChatPane
+                  sessionId={sessionId}
+                  chatId={pane.chatId}
+                  projectId={projectId}
+                  agentId={agentId}
+                  onAgentChange={onAgentChange}
+                  sessionChats={chats}
+                  webSearchEnabled={session.web_search_enabled}
+                />
+              ) : (
+                <SessionLandingPage
+                  sessionId={sessionId}
+                  projectId={projectId}
+                  chats={chats}
+                  onOpenChat={(chatId) => openChatInPane(idx, chatId)}
+                  onSend={(content) => void handleLandingSend(idx, content)}
+                  onReopenChat={async (chatId) => {
+                    await unarchiveChat(chatId);
+                    openChatInPane(idx, chatId);
+                  }}
+                  onArchiveChat={archiveChat}
+                  onRenameChat={renameChat}
+                  onDeleteChat={deleteChat}
+                />
+              )}
+            </div>
+          </div>
+          );
+        })}
+      </div>
     </div>
   );
 }

apps/web/src/components/panes/ChatPane.tsx

@@ -1,19 +1,39 @@
-import { useEffect, useRef } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { ChevronDown, Square, X } from 'lucide-react';
 import { toast } from 'sonner';
 import { api } from '@/api/client';
 import { useSessionStream } from '@/hooks/useSessionStream';
+import { useChatContextStats } from '@/hooks/useChatContextStats';
 import { MessageList } from '@/components/MessageList';
 import { ChatInput } from '@/components/ChatInput';
+import { ChatContextPopover } from '@/components/ChatContextPopover';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
 
 interface Props {
   sessionId: string;
+  chatId: string;
+  projectId: string;
+  // Batch 9: optional, threaded down to ChatInput's agent picker.
+  agentId?: string | null;
+  onAgentChange?: (agentId: string | null) => void | Promise<void>;
+  sessionChats?: import('@/api/types').Chat[];
+  // v1.9: threaded down to ChatInput's + menu (Web search quick toggle).
+  // null means "inherit project default" — ChatInput PATCHes with the
+  // opposite of the effective value.
+  webSearchEnabled?: boolean | null;
 }
 
-export function ChatPane({ sessionId }: Props) {
+export function ChatPane({ sessionId, chatId, projectId, agentId, onAgentChange, sessionChats, webSearchEnabled }: Props) {
   const stream = useSessionStream(sessionId);
   const lastErrorRef = useRef<string | null>(null);
+  const [queue, setQueue] = useState<string[]>([]);
+  const processingRef = useRef(false);
 
-  // Surface stream errors via toast — matches Session.tsx behavior.
   useEffect(() => {
     if (stream.error && stream.error !== lastErrorRef.current) {
       lastErrorRef.current = stream.error;
@@ -24,16 +44,160 @@ export function ChatPane({ sessionId }: Props) {
     }
   }, [stream.error]);
 
-  async function handleSend(content: string) {
-    await api.messages.send(sessionId, content);
+  const chatMessages = stream.messages.filter((m) => m.chat_id === chatId);
+  const streaming = chatMessages.some((m) => m.status === 'streaming');
+  const contextStats = useChatContextStats(chatId, chatMessages);
+
+  // Auto-send next queued message when streaming completes
+  useEffect(() => {
+    if (streaming || queue.length === 0 || processingRef.current) return;
+    processingRef.current = true;
+    const next = queue[0]!;
+    setQueue((prev) => prev.slice(1));
+    api.messages.send(chatId, next)
+      .catch((err) => toast.error(err instanceof Error ? err.message : 'queue send failed'))
+      .finally(() => { processingRef.current = false; });
+  }, [streaming, queue, chatId]);
+
+  const handleSend = useCallback(async (content: string) => {
+    const trimmed = content.trim();
+    if (!trimmed) return;
+    if (trimmed === '/compact') {
+      try {
+        await api.chats.compact(chatId);
+      } catch (err) {
+        toast.error(err instanceof Error ? err.message : 'compact failed');
+      }
+      return;
+    }
+    if (streaming) {
+      setQueue((prev) => [...prev, trimmed]);
+      return;
+    }
+    await api.messages.send(chatId, trimmed);
+  }, [chatId, streaming]);
+
+  async function handleStop() {
+    try {
+      await api.chats.stop(chatId);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'stop failed');
+    }
   }
 
-  const streaming = stream.messages.some((m) => m.status === 'streaming');
+  const handleForceSend = useCallback(async (content: string) => {
+    const trimmed = content.trim();
+    if (!trimmed) return;
+    try {
+      await api.chats.forceSend(chatId, trimmed);
+      setQueue([]);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    }
+  }, [chatId]);
+
+  // Batch 9.6: slash-command dispatch. Sent regardless of streaming state —
+  // matches the existing /compact precedent (which also fires immediately).
+  // Empty args go to the server as null; the server fills in a default user
+  // message ("Apply this skill.") so the model has something to act on.
+  const handleSlashCommand = useCallback(async (skillName: string, userMessage: string) => {
+    try {
+      await api.chats.skillInvoke(chatId, skillName, userMessage.length > 0 ? userMessage : null);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : `/${skillName} failed`);
+    }
+  }, [chatId]);
+
+  function removeQueued(idx: number) {
+    setQueue((prev) => prev.filter((_, i) => i !== idx));
+  }
+
+  async function forceSendQueued(idx: number) {
+    const msg = queue[idx];
+    if (!msg) return;
+    setQueue((prev) => prev.filter((_, i) => i !== idx));
+    try {
+      await api.chats.forceSend(chatId, msg);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    }
+  }
 
   return (
     <div className="flex flex-col h-full min-h-0">
-      <MessageList messages={stream.messages} sessionId={sessionId} />
-      <ChatInput disabled={streaming} onSend={handleSend} />
+      <MessageList messages={chatMessages} sessionChats={sessionChats} />
+
+      {/* Queued messages */}
+      {queue.length > 0 && (
+        <div className="border-t">
+          <div className="max-w-[1000px] mx-auto w-full px-4 py-1 space-y-1">
+          {queue.map((msg, i) => (
+            <div key={i} className="flex items-center gap-2 text-xs text-muted-foreground bg-muted/30 rounded px-2 py-1">
+              <span className="font-medium shrink-0">Queued:</span>
+              <span className="truncate flex-1">{msg}</span>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <button
+                    type="button"
+                    className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded shrink-0 max-md:min-h-[44px] max-md:min-w-[44px]"
+                    aria-label="Queued message options"
+                  >
+                    <ChevronDown size={12} />
+                  </button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem onSelect={() => { /* default: queued, nothing to do */ }}>
+                    Send when done
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => void forceSendQueued(i)}>
+                    Force send now
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+              <button
+                type="button"
+                onClick={() => removeQueued(i)}
+                className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded shrink-0 max-md:min-h-[44px] max-md:min-w-[44px]"
+                aria-label="Cancel queued message"
+              >
+                <X size={12} />
+              </button>
+            </div>
+          ))}
+          </div>
+        </div>
+      )}
+
+      {/* Stop button when streaming */}
+      {streaming && (
+        <div className="border-t py-1">
+          <div className="max-w-[1000px] mx-auto w-full flex justify-center">
+          <button
+            type="button"
+            onClick={() => void handleStop()}
+            className="flex items-center gap-1.5 text-xs px-3 py-1 rounded-full border hover:bg-muted text-muted-foreground hover:text-foreground max-md:min-h-[44px] max-md:px-5"
+          >
+            <Square size={10} className="fill-current" />
+            Stop generating
+          </button>
+          </div>
+        </div>
+      )}
+
+      <div className="relative">
+        <ChatContextPopover stats={contextStats} />
+        <ChatInput
+          disabled={false}
+          projectId={projectId}
+          sessionId={sessionId}
+          agentId={agentId}
+          onAgentChange={onAgentChange}
+          webSearchEnabled={webSearchEnabled}
+          onSend={handleSend}
+          onForceSend={streaming ? handleForceSend : undefined}
+          onSlashCommand={handleSlashCommand}
+        />
+      </div>
     </div>
   );
 }

apps/web/src/components/panes/FileBrowserPane.tsx

@@ -1,637 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import type { KeyboardEvent } from 'react';
-import { ChevronRight, ChevronDown, FileText, Folder, X } from 'lucide-react';
-import { api, ApiError } from '@/api/client';
-import type {
-  FileBrowserPaneState,
-  FileEntry,
-  Pane,
-  ViewFileResult,
-} from '@/api/types';
-import { CodeBlock } from '@/components/CodeBlock';
-import { cn } from '@/lib/utils';
-
-interface Props {
-  pane: Pane & { kind: 'file_browser' };
-  projectId: string;
-  onStateChange: (state: FileBrowserPaneState) => void;
-}
-
-const LANG_BY_EXT: Record<string, string> = {
-  ts: 'typescript',
-  tsx: 'tsx',
-  js: 'javascript',
-  jsx: 'jsx',
-  mjs: 'javascript',
-  cjs: 'javascript',
-  py: 'python',
-  go: 'go',
-  rs: 'rust',
-  rb: 'ruby',
-  java: 'java',
-  c: 'c',
-  h: 'c',
-  cpp: 'cpp',
-  hpp: 'cpp',
-  cs: 'csharp',
-  php: 'php',
-  sh: 'bash',
-  bash: 'bash',
-  zsh: 'bash',
-  yaml: 'yaml',
-  yml: 'yaml',
-  json: 'json',
-  toml: 'toml',
-  md: 'markdown',
-  markdown: 'markdown',
-  sql: 'sql',
-  dockerfile: 'dockerfile',
-  html: 'html',
-  htm: 'html',
-  css: 'css',
-  scss: 'scss',
-};
-
-function deriveLang(filePath: string): string | undefined {
-  // basename
-  const base = filePath.split('/').pop() ?? filePath;
-  if (base.toLowerCase() === 'dockerfile') return 'dockerfile';
-  const dot = base.lastIndexOf('.');
-  if (dot < 0 || dot === base.length - 1) return undefined;
-  const ext = base.slice(dot + 1).toLowerCase();
-  return LANG_BY_EXT[ext];
-}
-
-function basename(path: string): string {
-  if (!path) return '';
-  const parts = path.split('/');
-  return parts[parts.length - 1] ?? path;
-}
-
-function joinPath(parent: string, name: string): string {
-  if (!parent || parent === '.' || parent === '') return name;
-  return `${parent}/${name}`;
-}
-
-interface TreeNodeProps {
-  parentPath: string; // '' for root children
-  entries: FileEntry[];
-  cache: Map<string, FileEntry[]>;
-  expanded: Set<string>;
-  openFile: string | null;
-  highlightedPath: string | null;
-  depth: number;
-  onToggleDir: (dirPath: string) => void;
-  onSelectFile: (path: string) => void;
-  setHighlightedPath: (p: string) => void;
-}
-
-function TreeNode({
-  parentPath,
-  entries,
-  cache,
-  expanded,
-  openFile,
-  highlightedPath,
-  depth,
-  onToggleDir,
-  onSelectFile,
-  setHighlightedPath,
-}: TreeNodeProps) {
-  // Sort: dirs first, then files; alphabetical within each.
-  const sorted = useMemo(() => {
-    const copy = [...entries];
-    copy.sort((a, b) => {
-      if (a.kind !== b.kind) return a.kind === 'dir' ? -1 : 1;
-      return a.name.localeCompare(b.name);
-    });
-    return copy;
-  }, [entries]);
-
-  return (
-    <ul className="list-none">
-      {sorted.map((entry) => {
-        const fullPath = joinPath(parentPath, entry.name);
-        const isExpanded = entry.kind === 'dir' && expanded.has(fullPath);
-        const isActive = entry.kind === 'file' && openFile === fullPath;
-        const isHighlight = highlightedPath === fullPath;
-        return (
-          <li key={fullPath}>
-            <div
-              data-path={fullPath}
-              data-kind={entry.kind}
-              className={cn(
-                'flex items-center gap-1 px-1 py-0.5 text-xs cursor-default rounded hover:bg-muted/60',
-                isActive && 'bg-muted',
-                isHighlight && 'ring-1 ring-ring/40'
-              )}
-              style={{ paddingLeft: 4 + depth * 12 }}
-              onClick={() => {
-                setHighlightedPath(fullPath);
-                if (entry.kind === 'dir') {
-                  onToggleDir(fullPath);
-                } else {
-                  onSelectFile(fullPath);
-                }
-              }}
-            >
-              {entry.kind === 'dir' ? (
-                <button
-                  type="button"
-                  aria-label={isExpanded ? 'Collapse' : 'Expand'}
-                  className="p-0.5 hover:bg-muted rounded shrink-0"
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    setHighlightedPath(fullPath);
-                    onToggleDir(fullPath);
-                  }}
-                >
-                  {isExpanded ? (
-                    <ChevronDown size={10} />
-                  ) : (
-                    <ChevronRight size={10} />
-                  )}
-                </button>
-              ) : (
-                <span className="w-[16px] shrink-0" />
-              )}
-              {entry.kind === 'dir' ? (
-                <Folder size={12} className="text-muted-foreground shrink-0" />
-              ) : (
-                <FileText size={12} className="text-muted-foreground shrink-0" />
-              )}
-              <span className="truncate">{entry.name}</span>
-            </div>
-            {entry.kind === 'dir' && isExpanded && cache.has(fullPath) && (
-              <TreeNode
-                parentPath={fullPath}
-                entries={cache.get(fullPath) ?? []}
-                cache={cache}
-                expanded={expanded}
-                openFile={openFile}
-                highlightedPath={highlightedPath}
-                depth={depth + 1}
-                onToggleDir={onToggleDir}
-                onSelectFile={onSelectFile}
-                setHighlightedPath={setHighlightedPath}
-              />
-            )}
-          </li>
-        );
-      })}
-    </ul>
-  );
-}
-
-export function FileBrowserPane({ pane, projectId, onStateChange }: Props) {
-  const openFile = pane.state.open_file ?? null;
-  const filter = pane.state.filter ?? '';
-  const expandedDirs = useMemo(
-    () => pane.state.expanded_dirs ?? [],
-    [pane.state.expanded_dirs]
-  );
-
-  // Local filter (debounced 100ms before pushing to onStateChange)
-  const [filterDraft, setFilterDraft] = useState(filter);
-  const filterDebounceRef = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  // Track previous external filter so we can sync local draft when the
-  // canonical state changes from outside (e.g. server snapshot, other tab).
-  const lastExternalFilter = useRef(filter);
-  useEffect(() => {
-    if (filter !== lastExternalFilter.current) {
-      lastExternalFilter.current = filter;
-      setFilterDraft(filter);
-    }
-  }, [filter]);
-
-  function onFilterInput(value: string) {
-    setFilterDraft(value);
-    if (filterDebounceRef.current !== null) {
-      clearTimeout(filterDebounceRef.current);
-    }
-    filterDebounceRef.current = setTimeout(() => {
-      filterDebounceRef.current = null;
-      lastExternalFilter.current = value;
-      onStateChange({
-        ...pane.state,
-        filter: value,
-        open_file: openFile,
-        expanded_dirs: expandedDirs,
-      });
-    }, 100);
-  }
-
-  useEffect(() => {
-    return () => {
-      if (filterDebounceRef.current !== null) {
-        clearTimeout(filterDebounceRef.current);
-      }
-    };
-  }, []);
-
-  // Directory cache: dirPath -> entries
-  const [cache, setCache] = useState<Map<string, FileEntry[]>>(new Map());
-  const [loadingDirs, setLoadingDirs] = useState<Set<string>>(new Set());
-  const [dirErrors, setDirErrors] = useState<Map<string, string>>(new Map());
-
-  const loadDir = useCallback(
-    async (dirPath: string) => {
-      // dirPath '' is root; server expects '.'
-      const apiPath = dirPath === '' ? '.' : dirPath;
-      setLoadingDirs((prev) => {
-        if (prev.has(dirPath)) return prev;
-        const next = new Set(prev);
-        next.add(dirPath);
-        return next;
-      });
-      try {
-        const result = await api.projects.listDir(projectId, apiPath);
-        setCache((prev) => {
-          const next = new Map(prev);
-          next.set(dirPath, result.entries);
-          return next;
-        });
-        setDirErrors((prev) => {
-          if (!prev.has(dirPath)) return prev;
-          const next = new Map(prev);
-          next.delete(dirPath);
-          return next;
-        });
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : 'failed to list directory';
-        setDirErrors((prev) => {
-          const next = new Map(prev);
-          next.set(dirPath, msg);
-          return next;
-        });
-      } finally {
-        setLoadingDirs((prev) => {
-          if (!prev.has(dirPath)) return prev;
-          const next = new Set(prev);
-          next.delete(dirPath);
-          return next;
-        });
-      }
-    },
-    [projectId]
-  );
-
-  // Load root on mount + any expanded dirs from server state.
-  useEffect(() => {
-    if (!cache.has('')) {
-      void loadDir('');
-    }
-    for (const dir of expandedDirs) {
-      if (!cache.has(dir)) {
-        void loadDir(dir);
-      }
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [projectId]);
-
-  // When expandedDirs grows (e.g. user expands), ensure new dir is loaded.
-  useEffect(() => {
-    for (const dir of expandedDirs) {
-      if (!cache.has(dir) && !loadingDirs.has(dir)) {
-        void loadDir(dir);
-      }
-    }
-  }, [expandedDirs, cache, loadingDirs, loadDir]);
-
-  const expandedSet = useMemo(() => new Set(expandedDirs), [expandedDirs]);
-
-  function toggleDir(dirPath: string) {
-    let nextDirs: string[];
-    if (expandedSet.has(dirPath)) {
-      nextDirs = expandedDirs.filter((d) => d !== dirPath);
-    } else {
-      nextDirs = [...expandedDirs, dirPath];
-    }
-    onStateChange({
-      ...pane.state,
-      open_file: openFile,
-      filter: filterDraft,
-      expanded_dirs: nextDirs,
-    });
-  }
-
-  function selectFile(path: string) {
-    onStateChange({
-      ...pane.state,
-      open_file: path,
-      filter: filterDraft,
-      expanded_dirs: expandedDirs,
-    });
-  }
-
-  function closeOpenFile() {
-    onStateChange({
-      ...pane.state,
-      open_file: null,
-      filter: filterDraft,
-      expanded_dirs: expandedDirs,
-    });
-  }
-
-  // Build a flat list of all entries reachable through the loaded cache,
-  // for filter results and keyboard navigation.
-  interface FlatEntry {
-    path: string;
-    name: string;
-    kind: 'file' | 'dir';
-  }
-
-  const flattenedVisible = useMemo<FlatEntry[]>(() => {
-    const result: FlatEntry[] = [];
-    function walk(dirPath: string) {
-      const entries = cache.get(dirPath);
-      if (!entries) return;
-      const sorted = [...entries].sort((a, b) => {
-        if (a.kind !== b.kind) return a.kind === 'dir' ? -1 : 1;
-        return a.name.localeCompare(b.name);
-      });
-      for (const e of sorted) {
-        const full = joinPath(dirPath, e.name);
-        result.push({ path: full, name: e.name, kind: e.kind });
-        if (e.kind === 'dir' && expandedSet.has(full)) {
-          walk(full);
-        }
-      }
-    }
-    walk('');
-    return result;
-  }, [cache, expandedSet]);
-
-  const flattenedAll = useMemo<FlatEntry[]>(() => {
-    const result: FlatEntry[] = [];
-    function walk(dirPath: string) {
-      const entries = cache.get(dirPath);
-      if (!entries) return;
-      for (const e of entries) {
-        const full = joinPath(dirPath, e.name);
-        result.push({ path: full, name: e.name, kind: e.kind });
-        if (e.kind === 'dir') walk(full);
-      }
-    }
-    walk('');
-    return result;
-  }, [cache]);
-
-  const trimmedFilter = filterDraft.trim();
-  const filterActive = trimmedFilter.length > 0;
-  const filterResults = useMemo<FlatEntry[]>(() => {
-    if (!filterActive) return [];
-    const needle = trimmedFilter.toLowerCase();
-    return flattenedAll.filter((e) => e.path.toLowerCase().includes(needle));
-  }, [filterActive, trimmedFilter, flattenedAll]);
-
-  // Keyboard navigation
-  const [highlightedPath, setHighlightedPath] = useState<string | null>(null);
-  const treeRef = useRef<HTMLDivElement | null>(null);
-
-  // Reset highlight if it falls out of the current list (e.g. when filter
-  // changes or dirs collapse).
-  useEffect(() => {
-    if (!highlightedPath) return;
-    const list = filterActive ? filterResults : flattenedVisible;
-    if (!list.some((e) => e.path === highlightedPath)) {
-      setHighlightedPath(null);
-    }
-  }, [highlightedPath, filterActive, filterResults, flattenedVisible]);
-
-  function onTreeKeyDown(e: KeyboardEvent<HTMLDivElement>) {
-    const list = filterActive ? filterResults : flattenedVisible;
-    if (list.length === 0) return;
-    const idx = highlightedPath
-      ? list.findIndex((entry) => entry.path === highlightedPath)
-      : -1;
-
-    if (e.key === 'ArrowDown') {
-      e.preventDefault();
-      const next = idx < 0 ? 0 : Math.min(list.length - 1, idx + 1);
-      const target = list[next];
-      if (target) setHighlightedPath(target.path);
-      return;
-    }
-    if (e.key === 'ArrowUp') {
-      e.preventDefault();
-      const next = idx <= 0 ? 0 : idx - 1;
-      const target = list[next];
-      if (target) setHighlightedPath(target.path);
-      return;
-    }
-    if (e.key === 'Enter') {
-      if (idx < 0) return;
-      const target = list[idx];
-      if (!target) return;
-      e.preventDefault();
-      if (target.kind === 'dir') {
-        toggleDir(target.path);
-      } else {
-        selectFile(target.path);
-      }
-    }
-  }
-
-  // Viewer state
-  const [viewer, setViewer] = useState<{
-    path: string;
-    state: 'loading' | 'ready' | 'error';
-    result?: ViewFileResult;
-    error?: string;
-  } | null>(null);
-
-  useEffect(() => {
-    if (!openFile) {
-      setViewer(null);
-      return;
-    }
-    let cancelled = false;
-    setViewer({ path: openFile, state: 'loading' });
-    (async () => {
-      try {
-        const result = await api.projects.viewFile(projectId, openFile);
-        if (cancelled) return;
-        setViewer({ path: openFile, state: 'ready', result });
-      } catch (err) {
-        if (cancelled) return;
-        let message: string;
-        if (err instanceof ApiError) {
-          const apiMsg =
-            typeof err.body === 'object' &&
-            err.body !== null &&
-            'error' in err.body
-              ? String((err.body as { error: unknown }).error)
-              : err.message;
-          if (err.status === 404) {
-            message = 'File not found';
-          } else if (apiMsg.toLowerCase().includes('too large')) {
-            message = 'File too large to view';
-          } else if (
-            apiMsg.toLowerCase().includes('outside') ||
-            apiMsg.toLowerCase().includes('not a file') ||
-            apiMsg.toLowerCase().includes('path')
-          ) {
-            message = 'Cannot view files outside project';
-          } else {
-            message = apiMsg;
-          }
-        } else if (err instanceof Error) {
-          message = err.message;
-        } else {
-          message = 'Failed to load file';
-        }
-        setViewer({ path: openFile, state: 'error', error: message });
-      }
-    })();
-    return () => {
-      cancelled = true;
-    };
-  }, [openFile, projectId]);
-
-  // Root errors / loading
-  const rootEntries = cache.get('');
-  const rootLoading = loadingDirs.has('') && !rootEntries;
-  const rootError = dirErrors.get('');
-
-  return (
-    <div className="flex flex-col h-full min-h-0">
-      <div className="px-2 py-1.5 border-b border-border bg-muted/20">
-        <input
-          type="text"
-          value={filterDraft}
-          onChange={(e) => onFilterInput(e.target.value)}
-          placeholder="Filter files..."
-          className="w-full px-2 py-1 text-xs bg-background border border-border rounded outline-none focus:border-ring"
-          aria-label="Filter files"
-        />
-      </div>
-      <div className="flex-1 min-h-0 grid grid-cols-[minmax(0,260px)_1fr]">
-        <div
-          ref={treeRef}
-          tabIndex={0}
-          onKeyDown={onTreeKeyDown}
-          className="overflow-y-auto border-r border-border outline-none focus:ring-1 focus:ring-inset focus:ring-ring/40"
-          role="tree"
-          aria-label="Project files"
-        >
-          {rootLoading && (
-            <div className="text-xs text-muted-foreground px-2 py-1.5">
-              Loading...
-            </div>
-          )}
-          {rootError && (
-            <div className="text-xs text-destructive px-2 py-1.5">
-              {rootError}
-            </div>
-          )}
-          {!rootLoading && !rootError && filterActive && (
-            <ul className="list-none">
-              {filterResults.length === 0 ? (
-                <li className="text-xs text-muted-foreground px-2 py-1.5">
-                  No matches
-                </li>
-              ) : (
-                filterResults.map((entry) => {
-                  const isActive =
-                    entry.kind === 'file' && openFile === entry.path;
-                  const isHighlight = highlightedPath === entry.path;
-                  return (
-                    <li key={entry.path}>
-                      <div
-                        className={cn(
-                          'flex items-center gap-1 px-2 py-0.5 text-xs cursor-default rounded hover:bg-muted/60',
-                          isActive && 'bg-muted',
-                          isHighlight && 'ring-1 ring-ring/40'
-                        )}
-                        onClick={() => {
-                          setHighlightedPath(entry.path);
-                          if (entry.kind === 'dir') {
-                            toggleDir(entry.path);
-                          } else {
-                            selectFile(entry.path);
-                          }
-                        }}
-                      >
-                        {entry.kind === 'dir' ? (
-                          <Folder size={12} className="text-muted-foreground shrink-0" />
-                        ) : (
-                          <FileText size={12} className="text-muted-foreground shrink-0" />
-                        )}
-                        <span className="truncate">{entry.path}</span>
-                      </div>
-                    </li>
-                  );
-                })
-              )}
-            </ul>
-          )}
-          {!rootLoading && !rootError && !filterActive && rootEntries && (
-            <TreeNode
-              parentPath=""
-              entries={rootEntries}
-              cache={cache}
-              expanded={expandedSet}
-              openFile={openFile}
-              highlightedPath={highlightedPath}
-              depth={0}
-              onToggleDir={toggleDir}
-              onSelectFile={selectFile}
-              setHighlightedPath={setHighlightedPath}
-            />
-          )}
-        </div>
-        <div className="flex flex-col min-h-0">
-          {!openFile && (
-            <div className="flex-1 flex items-center justify-center text-xs text-muted-foreground">
-              Select a file to view
-            </div>
-          )}
-          {openFile && (
-            <>
-              <div className="flex items-center justify-between px-2 py-1 border-b border-border bg-muted/20 shrink-0">
-                <span
-                  className="text-xs font-mono truncate"
-                  title={openFile}
-                >
-                  {basename(openFile)}
-                </span>
-                <button
-                  type="button"
-                  onClick={closeOpenFile}
-                  className="p-0.5 hover:bg-muted rounded shrink-0"
-                  aria-label="Close file"
-                >
-                  <X size={12} />
-                </button>
-              </div>
-              <div className="flex-1 min-h-0 overflow-y-auto">
-                {viewer?.state === 'loading' && (
-                  <div className="text-xs text-muted-foreground px-2 py-1.5">
-                    Loading...
-                  </div>
-                )}
-                {viewer?.state === 'error' && (
-                  <div className="text-xs text-destructive px-2 py-1.5">
-                    {viewer.error}
-                  </div>
-                )}
-                {viewer?.state === 'ready' && viewer.result && (
-                  <div className="p-2">
-                    {viewer.result.truncated && (
-                      <div className="text-[11px] text-muted-foreground mb-1 px-2 py-1 rounded bg-muted/40 border border-border">
-                        Showing first {viewer.result.bytes_returned} bytes; file is {viewer.result.total_bytes} bytes total.
-                      </div>
-                    )}
-                    <CodeBlock code={viewer.result.content} lang={deriveLang(openFile)} />
-                  </div>
-                )}
-              </div>
-            </>
-          )}
-        </div>
-      </div>
-    </div>
-  );
-}

apps/web/src/components/panes/PaneShell.tsx

@@ -1,31 +0,0 @@
-import type { ReactNode } from 'react';
-import type { Pane } from '@/api/types';
-import { X } from 'lucide-react';
-import { cn } from '@/lib/utils';
-
-interface Props {
-  pane: Pane;
-  onClose: () => void;
-  className?: string;
-  children: ReactNode;
-}
-
-export function PaneShell({ pane, onClose, className, children }: Props) {
-  const label = pane.kind === 'chat' ? 'Chat' : 'Files';
-  return (
-    <div className={cn('flex flex-col h-full min-h-0 border-r border-border last:border-r-0', className)}>
-      <div className="flex items-center justify-between px-3 py-1.5 border-b border-border bg-muted/30">
-        <span className="text-xs font-medium text-muted-foreground">{label}</span>
-        <button
-          type="button"
-          onClick={onClose}
-          className="p-0.5 hover:bg-muted rounded"
-          aria-label="Close pane"
-        >
-          <X size={12} />
-        </button>
-      </div>
-      <div className="flex-1 min-h-0 overflow-hidden">{children}</div>
-    </div>
-  );
-}

apps/web/src/components/panes/SettingsPane.tsx

@@ -0,0 +1,530 @@
+import { useEffect, useState } from 'react';
+import { Archive, Maximize2, Minimize2, X } from 'lucide-react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import type { Project, Session } from '@/api/types';
+import { Button } from '@/components/ui/button';
+import { Textarea } from '@/components/ui/textarea';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { ModelPicker } from '@/components/ModelPicker';
+import { ThemePicker } from '@/components/ThemePicker';
+import { cn } from '@/lib/utils';
+
+type Section = 'session' | 'project' | 'theme';
+
+interface Props {
+  session: Session;
+  project: Project;
+  maximized: boolean;
+  onToggleMaximize: () => void;
+  onClose: () => void;
+  isMobile: boolean;
+}
+
+// v1.9: hand-rolled Switch primitive. No shadcn switch in the existing
+// ui/ set and the dispatch said don't pnpm dlx for v1.9 either. Single
+// purpose — clicking flips aria-checked + calls onCheckedChange.
+function Switch({
+  checked,
+  onCheckedChange,
+  disabled,
+  id,
+}: {
+  checked: boolean;
+  onCheckedChange: (v: boolean) => void;
+  disabled?: boolean;
+  id?: string;
+}) {
+  return (
+    <button
+      id={id}
+      type="button"
+      role="switch"
+      aria-checked={checked}
+      disabled={disabled}
+      onClick={() => onCheckedChange(!checked)}
+      className={cn(
+        'relative inline-flex h-5 w-9 shrink-0 cursor-pointer items-center rounded-full transition-colors',
+        checked ? 'bg-primary' : 'bg-muted',
+        disabled && 'opacity-50 cursor-not-allowed',
+      )}
+    >
+      <span
+        className={cn(
+          'inline-block h-4 w-4 transform rounded-full bg-background transition-transform',
+          checked ? 'translate-x-[1.125rem]' : 'translate-x-0.5',
+        )}
+      />
+    </button>
+  );
+}
+
+export function SettingsPane({ session, project, maximized, onToggleMaximize, onClose, isMobile }: Props) {
+  const [activeSection, setActiveSection] = useState<Section>('session');
+
+  return (
+    <div className="flex flex-col h-full min-h-0">
+      <div className="flex items-center gap-2 border-b border-border bg-muted/20 px-3 py-1.5 shrink-0">
+        <div className="flex items-center gap-1 flex-1 min-w-0">
+          {(['session', 'project', 'theme'] as const).map((s) => (
+            <button
+              key={s}
+              type="button"
+              onClick={() => setActiveSection(s)}
+              className={cn(
+                'text-xs px-2 py-1 rounded capitalize',
+                activeSection === s
+                  ? 'bg-background text-foreground'
+                  : 'text-muted-foreground hover:bg-muted',
+              )}
+            >
+              {s}
+            </button>
+          ))}
+        </div>
+        {!isMobile && (
+          <button
+            type="button"
+            onClick={onToggleMaximize}
+            className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground"
+            aria-label={maximized ? 'Restore' : 'Maximize'}
+            title={maximized ? 'Restore (Esc)' : 'Maximize'}
+          >
+            {maximized ? <Minimize2 size={14} /> : <Maximize2 size={14} />}
+          </button>
+        )}
+        <button
+          type="button"
+          onClick={onClose}
+          className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Close settings"
+          title="Close (Esc)"
+        >
+          <X size={14} />
+        </button>
+      </div>
+
+      <div className="flex-1 overflow-y-auto">
+        <div className="max-w-[720px] mx-auto w-full px-4 py-4 space-y-6">
+          {activeSection === 'session' && <SessionSection session={session} project={project} />}
+          {activeSection === 'project' && <ProjectSection project={project} />}
+          {activeSection === 'theme' && <ThemePicker />}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function SessionSection({ session, project }: { session: Session; project: Project }) {
+  const [name, setName] = useState(session.name);
+  const [systemPrompt, setSystemPrompt] = useState(session.system_prompt);
+  // v1.9: tri-state on the wire (null = inherit). UI surfaces a 3-way toggle
+  // via "Inherit project default" checkbox plus the override switch.
+  const [webSearch, setWebSearch] = useState<boolean | null>(session.web_search_enabled);
+  const [saving, setSaving] = useState(false);
+  // v1.9: bulk-archive chats. Two-step: openChatsCount → confirm dialog →
+  // archiveAllChats. Server publishes one chat_archived frame per id so
+  // useSidebar / chat lists update incrementally.
+  const [archiveOpen, setArchiveOpen] = useState(false);
+  const [archiveCount, setArchiveCount] = useState(0);
+  const [archiving, setArchiving] = useState(false);
+
+  useEffect(() => {
+    setName(session.name);
+    setSystemPrompt(session.system_prompt);
+    setWebSearch(session.web_search_enabled);
+  }, [session.id, session.name, session.system_prompt, session.web_search_enabled]);
+
+  const dirty =
+    name !== session.name ||
+    systemPrompt !== session.system_prompt ||
+    webSearch !== session.web_search_enabled;
+
+  const effectiveWebSearch = webSearch ?? project.default_web_search_enabled;
+  const projectPreview = project.default_system_prompt.trim().slice(0, 200);
+
+  async function save() {
+    if (saving) return;
+    setSaving(true);
+    try {
+      await api.sessions.update(session.id, {
+        name: name.trim() || session.name,
+        system_prompt: systemPrompt,
+        web_search_enabled: webSearch,
+      });
+      toast.success('Session saved');
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'save failed');
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function resetSystemPrompt() {
+    if (saving) return;
+    setSaving(true);
+    try {
+      await api.sessions.update(session.id, { system_prompt: '' });
+      toast.success('Reset to project default');
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'reset failed');
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function openArchiveDialog() {
+    if (archiving) return;
+    try {
+      const { count } = await api.sessions.openChatsCount(session.id);
+      if (count === 0) {
+        toast('No open chats to archive.');
+        return;
+      }
+      setArchiveCount(count);
+      setArchiveOpen(true);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to count chats');
+    }
+  }
+
+  async function confirmArchive() {
+    if (archiving) return;
+    setArchiving(true);
+    try {
+      const { archived } = await api.sessions.archiveAllChats(session.id);
+      toast.success(`Archived ${archived} chat${archived === 1 ? '' : 's'}`);
+      setArchiveOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'archive failed');
+    } finally {
+      setArchiving(false);
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="space-y-1.5">
+        <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+          Session name
+        </label>
+        <input
+          type="text"
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          className="w-full bg-background border border-border rounded px-2 py-1.5 text-sm outline-none focus:border-ring"
+        />
+      </div>
+
+      <div className="space-y-1.5">
+        <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+          Model
+        </label>
+        <div className="inline-flex items-center rounded-full bg-muted/40 hover:bg-muted/70 px-1">
+          <ModelPicker
+            value={session.model}
+            onChange={async (model) => {
+              try {
+                await api.sessions.update(session.id, { model });
+                toast.success('Model updated');
+              } catch (err) {
+                toast.error(err instanceof Error ? err.message : 'failed to set model');
+              }
+            }}
+          />
+        </div>
+      </div>
+
+      <div className="space-y-1.5">
+        <div className="flex items-center justify-between gap-3">
+          <label htmlFor="session-web-search" className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+            Web search
+          </label>
+          <Switch
+            id="session-web-search"
+            checked={effectiveWebSearch}
+            onCheckedChange={(v) => setWebSearch(v)}
+          />
+        </div>
+        <div className="flex items-center gap-2 text-xs text-muted-foreground">
+          <input
+            type="checkbox"
+            id="session-web-search-inherit"
+            checked={webSearch === null}
+            onChange={(e) => setWebSearch(e.target.checked ? null : project.default_web_search_enabled)}
+          />
+          <label htmlFor="session-web-search-inherit" className="cursor-pointer">
+            Inherit project default ({project.default_web_search_enabled ? 'on' : 'off'})
+          </label>
+        </div>
+        <p className="text-xs text-muted-foreground italic">
+          Plumbed for Batch 8 (web_search tool). No effect yet.
+        </p>
+      </div>
+
+      <div className="space-y-1.5">
+        <div className="flex items-center justify-between gap-3">
+          <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+            System prompt
+          </label>
+          <button
+            type="button"
+            onClick={() => void resetSystemPrompt()}
+            disabled={saving || session.system_prompt === ''}
+            className="text-xs text-muted-foreground hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed"
+          >
+            Reset to project default
+          </button>
+        </div>
+        <Textarea
+          value={systemPrompt}
+          onChange={(e) => setSystemPrompt(e.target.value)}
+          rows={6}
+          className="resize-y min-h-[120px] max-h-[60vh]"
+          placeholder="Per-session override (optional). Empty = inherit project default."
+        />
+        {systemPrompt.trim().length === 0 && projectPreview.length > 0 && (
+          <p className="text-xs text-muted-foreground">
+            Falls back to project default: <span className="italic">{projectPreview}{projectPreview.length === 200 ? '…' : ''}</span>
+          </p>
+        )}
+      </div>
+
+      <div className="flex justify-end gap-2">
+        <Button onClick={() => void save()} disabled={!dirty || saving}>
+          {saving ? 'Saving…' : 'Save'}
+        </Button>
+      </div>
+
+      <div className="border-t pt-4">
+        <Button
+          variant="outline"
+          onClick={() => void openArchiveDialog()}
+          disabled={archiving}
+          className="gap-1.5"
+        >
+          <Archive size={14} /> Archive all chats
+        </Button>
+      </div>
+
+      <Dialog open={archiveOpen} onOpenChange={(open) => { if (!archiving) setArchiveOpen(open); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive all chats?</DialogTitle>
+            <DialogDescription>
+              Archive {archiveCount} open chat{archiveCount === 1 ? '' : 's'} in this session?
+              Archived chats stay accessible via the archive view.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setArchiveOpen(false)} disabled={archiving}>
+              Cancel
+            </Button>
+            <Button onClick={() => void confirmArchive()} disabled={archiving}>
+              {archiving ? 'Archiving…' : `Archive ${archiveCount}`}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </div>
+  );
+}
+
+function ProjectSection({ project }: { project: Project }) {
+  const [name, setName] = useState(project.name);
+  const [defaultPrompt, setDefaultPrompt] = useState(project.default_system_prompt);
+  const [defaultWebSearch, setDefaultWebSearch] = useState(project.default_web_search_enabled);
+  const [saving, setSaving] = useState(false);
+  // v1.9: bulk-archive sessions. Same shape as the chats-archive flow in
+  // SessionSection — count, confirm, fire.
+  const [archiveOpen, setArchiveOpen] = useState(false);
+  const [archiveCount, setArchiveCount] = useState(0);
+  const [archiving, setArchiving] = useState(false);
+
+  useEffect(() => {
+    setName(project.name);
+    setDefaultPrompt(project.default_system_prompt);
+    setDefaultWebSearch(project.default_web_search_enabled);
+  }, [
+    project.id,
+    project.name,
+    project.default_system_prompt,
+    project.default_web_search_enabled,
+  ]);
+
+  const dirty =
+    name !== project.name ||
+    defaultPrompt !== project.default_system_prompt ||
+    defaultWebSearch !== project.default_web_search_enabled;
+
+  async function save() {
+    if (saving) return;
+    setSaving(true);
+    try {
+      await api.projects.update(project.id, {
+        name: name.trim() || project.name,
+        default_system_prompt: defaultPrompt,
+        default_web_search_enabled: defaultWebSearch,
+      });
+      toast.success('Project saved');
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'save failed');
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function clearDefaultPrompt() {
+    if (saving) return;
+    setSaving(true);
+    try {
+      await api.projects.update(project.id, { default_system_prompt: '' });
+      toast.success('Cleared');
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'clear failed');
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function openArchiveDialog() {
+    if (archiving) return;
+    try {
+      const { count } = await api.projects.openSessionsCount(project.id);
+      if (count === 0) {
+        toast('No open sessions to archive.');
+        return;
+      }
+      setArchiveCount(count);
+      setArchiveOpen(true);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to count sessions');
+    }
+  }
+
+  async function confirmArchive() {
+    if (archiving) return;
+    setArchiving(true);
+    try {
+      const { archived } = await api.projects.archiveAllSessions(project.id);
+      toast.success(`Archived ${archived} session${archived === 1 ? '' : 's'}`);
+      setArchiveOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'archive failed');
+    } finally {
+      setArchiving(false);
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="space-y-1.5">
+        <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+          Project name
+        </label>
+        <input
+          type="text"
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          className="w-full bg-background border border-border rounded px-2 py-1.5 text-sm outline-none focus:border-ring"
+        />
+      </div>
+
+      <div className="space-y-1.5">
+        <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+          Root path
+        </label>
+        <div className="font-mono text-xs text-muted-foreground bg-muted/40 rounded px-2 py-1.5 select-all">
+          {project.path}
+        </div>
+      </div>
+
+      <div className="space-y-1.5">
+        <div className="flex items-center justify-between gap-3">
+          <label htmlFor="project-default-web-search" className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+            Default web search
+          </label>
+          <Switch
+            id="project-default-web-search"
+            checked={defaultWebSearch}
+            onCheckedChange={setDefaultWebSearch}
+          />
+        </div>
+        <p className="text-xs text-muted-foreground italic">
+          Applies to new sessions only. Plumbed for Batch 8.
+        </p>
+      </div>
+
+      <div className="space-y-1.5">
+        <div className="flex items-center justify-between gap-3">
+          <label className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
+            Default system prompt
+          </label>
+          <button
+            type="button"
+            onClick={() => void clearDefaultPrompt()}
+            disabled={saving || project.default_system_prompt === ''}
+            className="text-xs text-muted-foreground hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed"
+          >
+            Clear
+          </button>
+        </div>
+        <Textarea
+          value={defaultPrompt}
+          onChange={(e) => setDefaultPrompt(e.target.value)}
+          rows={6}
+          className="resize-y min-h-[120px] max-h-[60vh]"
+          placeholder="Prepended to every new session's system prompt (when its own is empty). Empty = no project default."
+        />
+      </div>
+
+      <p className="text-xs text-muted-foreground">
+        Existing sessions are not affected by changes here.
+      </p>
+
+      <div className="flex justify-end gap-2">
+        <Button onClick={() => void save()} disabled={!dirty || saving}>
+          {saving ? 'Saving…' : 'Save'}
+        </Button>
+      </div>
+
+      <div className="border-t pt-4">
+        <Button
+          variant="outline"
+          onClick={() => void openArchiveDialog()}
+          disabled={archiving}
+          className="gap-1.5"
+        >
+          <Archive size={14} /> Archive all sessions
+        </Button>
+      </div>
+
+      <Dialog open={archiveOpen} onOpenChange={(open) => { if (!archiving) setArchiveOpen(open); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive all sessions?</DialogTitle>
+            <DialogDescription>
+              Archive {archiveCount} open session{archiveCount === 1 ? '' : 's'} in this project?
+              Archived sessions stay accessible via the archive view.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setArchiveOpen(false)} disabled={archiving}>
+              Cancel
+            </Button>
+            <Button onClick={() => void confirmArchive()} disabled={archiving}>
+              {archiving ? 'Archiving…' : `Archive ${archiveCount}`}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </div>
+  );
+}

apps/web/src/components/ui/card.tsx

@@ -0,0 +1,103 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+function Card({
+  className,
+  size = "default",
+  ...props
+}: React.ComponentProps<"div"> & { size?: "default" | "sm" }) {
+  return (
+    <div
+      data-slot="card"
+      data-size={size}
+      className={cn(
+        "group/card flex flex-col gap-4 overflow-hidden rounded-xl bg-card py-4 text-sm text-card-foreground ring-1 ring-foreground/10 has-data-[slot=card-footer]:pb-0 has-[>img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-header"
+      className={cn(
+        "group/card-header @container/card-header grid auto-rows-min items-start gap-1 rounded-t-xl px-4 group-data-[size=sm]/card:px-3 has-data-[slot=card-action]:grid-cols-[1fr_auto] has-data-[slot=card-description]:grid-rows-[auto_auto] [.border-b]:pb-4 group-data-[size=sm]/card:[.border-b]:pb-3",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-title"
+      className={cn(
+        "text-base leading-snug font-medium group-data-[size=sm]/card:text-sm",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  )
+}
+
+function CardAction({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-action"
+      className={cn(
+        "col-start-2 row-span-2 row-start-1 self-start justify-self-end",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-content"
+      className={cn("px-4 group-data-[size=sm]/card:px-3", className)}
+      {...props}
+    />
+  )
+}
+
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-footer"
+      className={cn(
+        "flex items-center rounded-b-xl border-t bg-muted/50 p-4 group-data-[size=sm]/card:p-3",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export {
+  Card,
+  CardHeader,
+  CardFooter,
+  CardTitle,
+  CardAction,
+  CardDescription,
+  CardContent,
+}

apps/web/src/components/ui/radio-group.tsx

@@ -0,0 +1,42 @@
+import * as React from "react"
+import { RadioGroup as RadioGroupPrimitive } from "radix-ui"
+
+import { cn } from "@/lib/utils"
+
+function RadioGroup({
+  className,
+  ...props
+}: React.ComponentProps<typeof RadioGroupPrimitive.Root>) {
+  return (
+    <RadioGroupPrimitive.Root
+      data-slot="radio-group"
+      className={cn("grid w-full gap-2", className)}
+      {...props}
+    />
+  )
+}
+
+function RadioGroupItem({
+  className,
+  ...props
+}: React.ComponentProps<typeof RadioGroupPrimitive.Item>) {
+  return (
+    <RadioGroupPrimitive.Item
+      data-slot="radio-group-item"
+      className={cn(
+        "group/radio-group-item peer relative flex aspect-square size-4 shrink-0 rounded-full border border-input outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
+        className
+      )}
+      {...props}
+    >
+      <RadioGroupPrimitive.Indicator
+        data-slot="radio-group-indicator"
+        className="flex size-4 items-center justify-center"
+      >
+        <span className="absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 rounded-full bg-primary-foreground" />
+      </RadioGroupPrimitive.Indicator>
+    </RadioGroupPrimitive.Item>
+  )
+}
+
+export { RadioGroup, RadioGroupItem }

apps/web/src/hooks/sessionEvents.ts

@@ -2,7 +2,8 @@
 // across hooks (e.g. AI rename arriving via WS in the session view needs to
 // also refresh the sidebar's session list).
 
-import type { Project, Session } from '@/api/types';
+import type { Chat, ErrorReason, Project, Session } from '@/api/types';
+import type { Attachment } from '@/lib/attachments';
 
 export interface SessionRenamedEvent {
   type: 'session_renamed';
@@ -51,6 +52,90 @@ export interface OpenFileInBrowserEvent {
   path: string; // project-relative
 }
 
+export interface AttachChatFileEvent {
+  type: 'attach_chat_file';
+  attachment: Omit<Attachment, 'id'>;
+}
+
+export interface OpenChatInActivePaneEvent {
+  type: 'open_chat_in_active_pane';
+  chat_id: string;
+}
+
+// Client-side event fired by the sidebar Settings button when a session is
+// currently mounted. Session.tsx subscribes and calls
+// panesHook.toggleSettingsPane() (open on first click, close on second).
+// Sidebar handles the no-session case by navigating to /settings directly.
+export interface OpenSettingsPaneEvent {
+  type: 'open_settings_pane';
+}
+
+export interface SessionArchivedEvent {
+  type: 'session_archived';
+  session_id: string;
+  project_id: string;
+}
+
+export interface ChatCreatedEvent {
+  type: 'chat_created';
+  chat: Chat;
+  session_id: string;
+}
+
+export interface ChatUpdatedEvent {
+  type: 'chat_updated';
+  chat_id: string;
+  session_id: string;
+  name: string | null;
+  updated_at: string;
+}
+
+export interface ChatArchivedEvent {
+  type: 'chat_archived';
+  chat_id: string;
+  session_id: string;
+}
+
+export interface ChatUnarchivedEvent {
+  type: 'chat_unarchived';
+  chat: Chat;
+}
+
+export interface ChatDeletedEvent {
+  type: 'chat_deleted';
+  chat_id: string;
+  session_id: string;
+}
+
+export interface ProjectArchivedEvent {
+  type: 'project_archived';
+  project_id: string;
+}
+
+export interface ProjectUnarchivedEvent {
+  type: 'project_unarchived';
+  project: Project;
+}
+
+export interface ProjectUpdatedEvent {
+  type: 'project_updated';
+  project_id: string;
+  name: string;
+}
+
+// v1.8 mobile-tabs: broadcast on user channel from inference.ts so any device
+// subscribed sees a chat working/idle/error. Frontend stores per-chat; panes
+// derive their dot from pane.activeChatId.
+// v1.8.2: optional `reason` carries a machine-readable code when status is
+// 'error'. UI prefers reason for inline error rendering.
+export interface ChatStatusEvent {
+  type: 'chat_status';
+  chat_id: string;
+  status: 'working' | 'idle' | 'error';
+  at: string;
+  reason?: ErrorReason;
+}
+
 export type SessionEvent =
   | SessionRenamedEvent
   | ProjectCreatedEvent
@@ -59,7 +144,20 @@ export type SessionEvent =
   | SessionDeletedEvent
   | SessionUpdatedEvent
   | SessionLoadedEvent
-  | OpenFileInBrowserEvent;
+  | OpenFileInBrowserEvent
+  | AttachChatFileEvent
+  | OpenChatInActivePaneEvent
+  | OpenSettingsPaneEvent
+  | SessionArchivedEvent
+  | ChatCreatedEvent
+  | ChatUpdatedEvent
+  | ChatArchivedEvent
+  | ChatUnarchivedEvent
+  | ChatDeletedEvent
+  | ProjectArchivedEvent
+  | ProjectUnarchivedEvent
+  | ProjectUpdatedEvent
+  | ChatStatusEvent;
 type Listener = (event: SessionEvent) => void;
 
 const listeners = new Set<Listener>();

apps/web/src/hooks/useActivePane.ts

@@ -0,0 +1,61 @@
+import { useEffect, useState } from 'react';
+import type { WorkspacePaneKind } from '@/api/types';
+
+export interface ActivePaneSnapshot {
+  sessionId: string | null;
+  paneId: string | null;
+  kind: WorkspacePaneKind | null;
+  activeFile: string | null;
+}
+
+const EMPTY: ActivePaneSnapshot = {
+  sessionId: null,
+  paneId: null,
+  kind: null,
+  activeFile: null,
+};
+
+let current: ActivePaneSnapshot = EMPTY;
+const subs = new Set<() => void>();
+
+function notify(): void {
+  for (const sub of subs) {
+    try {
+      sub();
+    } catch {
+      // swallow — one bad listener shouldn't break others
+    }
+  }
+}
+
+function isSame(a: ActivePaneSnapshot, b: ActivePaneSnapshot): boolean {
+  return (
+    a.sessionId === b.sessionId &&
+    a.paneId === b.paneId &&
+    a.kind === b.kind &&
+    a.activeFile === b.activeFile
+  );
+}
+
+export function setActivePaneInfo(next: ActivePaneSnapshot): void {
+  if (isSame(current, next)) return;
+  current = next;
+  notify();
+}
+
+export function clearActivePane(): void {
+  setActivePaneInfo(EMPTY);
+}
+
+export function useActivePane(): ActivePaneSnapshot {
+  const [snap, setSnap] = useState<ActivePaneSnapshot>(current);
+  useEffect(() => {
+    const sub = () => setSnap(current);
+    subs.add(sub);
+    sub();
+    return () => {
+      subs.delete(sub);
+    };
+  }, []);
+  return snap;
+}

apps/web/src/hooks/useChatContextStats.ts

@@ -0,0 +1,37 @@
+import { useMemo } from 'react';
+import type { Message } from '@/api/types';
+
+export interface ChatContextStats {
+  used: number;
+  max: number;
+  percent: number;
+}
+
+/**
+ * Returns the latest context-window usage for the given chat, derived from the
+ * assistant message (with both ctx_used and ctx_max populated) having the most
+ * recent created_at. Returns null when no such message exists.
+ *
+ * Re-evaluates whenever the `messages` reference or `chatId` changes, which
+ * matches the cadence of streaming updates from `useSessionStream`.
+ */
+export function useChatContextStats(
+  chatId: string,
+  messages: Message[],
+): ChatContextStats | null {
+  return useMemo(() => {
+    let latest: Message | null = null;
+    for (const m of messages) {
+      if (m.chat_id !== chatId) continue;
+      if (m.role !== 'assistant') continue;
+      if (m.ctx_used == null || m.ctx_max == null) continue;
+      if (!latest || m.created_at > latest.created_at) latest = m;
+    }
+    if (!latest || latest.ctx_used == null || latest.ctx_max == null) return null;
+    const used = latest.ctx_used;
+    const max = latest.ctx_max;
+    if (max <= 0) return null;
+    const percent = Math.round((used / max) * 100);
+    return { used, max, percent };
+  }, [chatId, messages]);
+}

apps/web/src/hooks/useChatStatus.ts

@@ -0,0 +1,71 @@
+import { useEffect, useState } from 'react';
+import { sessionEvents } from './sessionEvents';
+
+export type RawStatus = 'working' | 'idle' | 'error';
+export type DerivedStatus = 'working' | 'idle_warm' | 'idle_cold' | 'error';
+
+// Window during which an idle dot stays green; after this, it fades to gray.
+const WARM_WINDOW_MS = 30_000;
+const TICK_MS = 5_000;
+
+interface Entry {
+  status: RawStatus;
+  at: string;
+}
+
+// Module-scope shared state so every StatusDot in the app shares one map
+// (mirrors useSidebar's singleton pattern). The map is ephemeral — cleared on
+// page reload; WS reconnect repopulates as new frames arrive.
+const statuses = new Map<string, Entry>();
+const subscribers = new Set<() => void>();
+
+function notify(): void {
+  for (const s of subscribers) {
+    try { s(); } catch { /* swallow */ }
+  }
+}
+
+// Guard against duplicate listeners during Vite HMR.
+const G = globalThis as Record<string, unknown>;
+if (!G.__boocode_chat_status_subscribed) {
+  G.__boocode_chat_status_subscribed = true;
+  sessionEvents.subscribe((ev) => {
+    if (ev.type !== 'chat_status') return;
+    statuses.set(ev.chat_id, { status: ev.status, at: ev.at });
+    notify();
+  });
+  // Single shared ticker: re-notify so any green dot whose 30s window just
+  // expired re-renders as gray. We only notify if there's something warm —
+  // avoids waking sleeping components for nothing.
+  setInterval(() => {
+    const now = Date.now();
+    for (const entry of statuses.values()) {
+      if (entry.status === 'idle') {
+        const age = now - new Date(entry.at).getTime();
+        if (age < WARM_WINDOW_MS + TICK_MS) {
+          notify();
+          return;
+        }
+      }
+    }
+  }, TICK_MS);
+}
+
+function derive(entry: Entry | undefined): DerivedStatus {
+  if (!entry) return 'idle_cold';
+  if (entry.status === 'working') return 'working';
+  if (entry.status === 'error') return 'error';
+  const age = Date.now() - new Date(entry.at).getTime();
+  return age < WARM_WINDOW_MS ? 'idle_warm' : 'idle_cold';
+}
+
+export function useChatStatus(chatId: string | null | undefined): DerivedStatus {
+  const [, force] = useState({});
+  useEffect(() => {
+    const sub = () => force({});
+    subscribers.add(sub);
+    return () => { subscribers.delete(sub); };
+  }, []);
+  if (!chatId) return 'idle_cold';
+  return derive(statuses.get(chatId));
+}

apps/web/src/hooks/useLongPress.ts

@@ -0,0 +1,75 @@
+import { useCallback, useRef } from 'react';
+import type { TouchEvent } from 'react';
+
+interface LongPressHandlers {
+  onTouchStart: (e: TouchEvent) => void;
+  onTouchMove: (e: TouchEvent) => void;
+  onTouchEnd: (e: TouchEvent) => void;
+  onTouchCancel: (e: TouchEvent) => void;
+}
+
+interface Options {
+  ms?: number;
+  // Suppress the synthetic click that follows touchend when long-press fired.
+  suppressClickOnFire?: boolean;
+}
+
+// Hand-rolled long-press detector. Starts a timer on touchstart; cancels on
+// touchmove or early touchend; fires the callback on timer expiry. Caller is
+// expected to suppress text-selection callout via CSS (-webkit-touch-callout).
+export function useLongPress(
+  callback: (touch: { clientX: number; clientY: number; target: EventTarget | null }) => void,
+  { ms = 500, suppressClickOnFire = true }: Options = {},
+): LongPressHandlers {
+  const timerRef = useRef<number | null>(null);
+  const firedRef = useRef(false);
+
+  const clear = useCallback(() => {
+    if (timerRef.current !== null) {
+      window.clearTimeout(timerRef.current);
+      timerRef.current = null;
+    }
+  }, []);
+
+  const onTouchStart = useCallback(
+    (e: TouchEvent) => {
+      firedRef.current = false;
+      const touch = e.touches[0];
+      if (!touch) return;
+      const x = touch.clientX;
+      const y = touch.clientY;
+      const target = e.target;
+      clear();
+      timerRef.current = window.setTimeout(() => {
+        firedRef.current = true;
+        callback({ clientX: x, clientY: y, target });
+      }, ms);
+    },
+    [callback, ms, clear],
+  );
+
+  const onTouchMove = useCallback(() => {
+    clear();
+  }, [clear]);
+
+  const onTouchEnd = useCallback(
+    (e: TouchEvent) => {
+      clear();
+      if (firedRef.current && suppressClickOnFire) {
+        // Block the synthetic click that follows touchend; the long-press
+        // already handled the gesture.
+        e.preventDefault();
+      }
+    },
+    [clear, suppressClickOnFire],
+  );
+
+  const onTouchCancel = useCallback(
+    (_e: TouchEvent) => {
+      clear();
+    },
+    [clear],
+  );
+
+  return { onTouchStart, onTouchMove, onTouchEnd, onTouchCancel };
+}

apps/web/src/hooks/usePanes.ts

@@ -1,149 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import { api } from '@/api/client';
-import type { Pane, PaneCreateRequest, PaneState, PaneUpdateRequest } from '@/api/types';
-
-export function usePanes(sessionId: string | undefined): {
-  panes: Pane[] | null;
-  loading: boolean;
-  error: string | null;
-  refresh: () => Promise<void>;
-  create: (body: PaneCreateRequest) => Promise<Pane>;
-  update: (id: string, body: PaneUpdateRequest) => Promise<void>;
-  remove: (id: string) => Promise<void>;
-} {
-  const [panes, setPanes] = useState<Pane[] | null>(null);
-  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  // Pending debounced state PATCHes: pane id -> latest PaneState
-  const pendingState = useRef<Map<string, PaneState>>(new Map());
-  const debounceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  const refresh = useCallback(async () => {
-    if (!sessionId) {
-      setPanes(null);
-      return;
-    }
-    setLoading(true);
-    try {
-      const { panes: list } = await api.panes.getForSession(sessionId);
-      setPanes(list);
-      setError(null);
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'pane operation failed');
-    } finally {
-      setLoading(false);
-    }
-  }, [sessionId]);
-
-  const flushPendingState = useCallback(async () => {
-    if (debounceTimer.current !== null) {
-      clearTimeout(debounceTimer.current);
-      debounceTimer.current = null;
-    }
-    const updates = Array.from(pendingState.current.entries());
-    pendingState.current.clear();
-    if (updates.length === 0) return;
-    try {
-      await Promise.all(updates.map(([id, state]) => api.panes.update(id, { state })));
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'pane state PATCH failed');
-      // server truth may diverge from optimistic local state; resync
-      void refresh();
-    }
-  }, [refresh]);
-
-  // Fetch on mount / sessionId change; preserve previous list while reloading
-  // (loading=true but panes stays non-null after first fetch to avoid flash)
-  useEffect(() => {
-    void refresh();
-  }, [refresh]);
-
-  // Flush debounced PATCHes on unmount
-  useEffect(() => {
-    return () => {
-      flushPendingState();
-    };
-  }, [flushPendingState]);
-
-  const create = useCallback(
-    async (body: PaneCreateRequest): Promise<Pane> => {
-      if (!sessionId) throw new Error('no session');
-      const created = await api.panes.create(sessionId, body);
-      await refresh();
-      return created;
-    },
-    [sessionId, refresh]
-  );
-
-  const update = useCallback(
-    async (id: string, body: PaneUpdateRequest): Promise<void> => {
-      if (body.state !== undefined && body.position === undefined) {
-        const nextState = body.state;
-        // Optimistic local update
-        setPanes((prev) => {
-          if (!prev) return prev;
-          let changed = false;
-          const next = prev.map((pane) => {
-            if (pane.id !== id) return pane;
-            changed = true;
-            // Narrow via discriminated union to satisfy TypeScript
-            if (pane.kind === 'chat') {
-              return { ...pane, state: nextState as typeof pane.state };
-            }
-            if (pane.kind === 'file_browser') {
-              return { ...pane, state: nextState as typeof pane.state };
-            }
-            return pane;
-          });
-          return changed ? next : prev;
-        });
-
-        // Coalesce: last state wins within debounce window
-        pendingState.current.set(id, nextState);
-
-        if (debounceTimer.current !== null) {
-          clearTimeout(debounceTimer.current);
-        }
-        debounceTimer.current = setTimeout(() => {
-          debounceTimer.current = null;
-          flushPendingState();
-        }, 300);
-      } else {
-        // position involved — fire immediately
-        try {
-          await api.panes.update(id, body);
-          await refresh();
-        } catch (err) {
-          setError(err instanceof Error ? err.message : 'pane operation failed');
-          throw err;
-        }
-      }
-    },
-    [refresh, flushPendingState]
-  );
-
-  const remove = useCallback(
-    async (id: string): Promise<void> => {
-      // Optimistic remove — capture snapshot inside functional updater to avoid stale closure
-      let snapshot: Pane[] | null = null;
-      setPanes((prev) => {
-        snapshot = prev;
-        return prev ? prev.filter((p) => p.id !== id) : prev;
-      });
-
-      try {
-        await api.panes.remove(id);
-        await refresh();
-      } catch (err) {
-        // Rollback to the truly-most-recent value captured above
-        setPanes(snapshot);
-        setError(err instanceof Error ? err.message : 'pane operation failed');
-        throw err;
-      }
-    },
-    [refresh]
-  );
-
-  return { panes, loading, error, refresh, create, update, remove };
-}

apps/web/src/hooks/useProjectGit.ts

@@ -0,0 +1,41 @@
+import { useEffect, useState } from 'react';
+import { api } from '@/api/client';
+import type { GitMeta } from '@/api/types';
+
+const POLL_INTERVAL_MS = 30_000;
+
+// Live-ish git meta for the project header indicator. Backed by the server's
+// 30s cache, so a 30s client poll plus the cache TTL bounds total staleness
+// to ~60s in the worst case. Returns null while the first fetch is in flight
+// or if the request failed.
+export function useProjectGit(projectId: string | null | undefined): GitMeta | null {
+  const [meta, setMeta] = useState<GitMeta | null>(null);
+
+  useEffect(() => {
+    if (!projectId) {
+      setMeta(null);
+      return;
+    }
+    let cancelled = false;
+
+    const fetchOnce = () => {
+      api.projects
+        .git(projectId)
+        .then((m) => {
+          if (!cancelled) setMeta(m);
+        })
+        .catch(() => {
+          if (!cancelled) setMeta(null);
+        });
+    };
+
+    fetchOnce();
+    const t = setInterval(fetchOnce, POLL_INTERVAL_MS);
+    return () => {
+      cancelled = true;
+      clearInterval(t);
+    };
+  }, [projectId]);
+
+  return meta;
+}

apps/web/src/hooks/useProjects.ts

@@ -1,7 +1,6 @@
 import { useCallback, useEffect, useState } from 'react';
 import { api } from '@/api/client';
 import type { Project } from '@/api/types';
-import { sessionEvents } from './sessionEvents';
 
 export function useProjects() {
   const [projects, setProjects] = useState<Project[] | null>(null);
@@ -33,7 +32,6 @@ export function useProjects() {
   const remove = useCallback(
     async (id: string) => {
       await api.projects.remove(id);
-      sessionEvents.emit({ type: 'project_deleted', project_id: id });
       await refresh();
     },
     [refresh]

apps/web/src/hooks/usePullToRefresh.ts

@@ -0,0 +1,77 @@
+import { useCallback, useRef, useState } from 'react';
+import type { TouchEvent } from 'react';
+
+interface Options {
+  threshold?: number;
+  enabled?: boolean;
+  maxPull?: number;
+}
+
+interface Handlers {
+  onTouchStart: (e: TouchEvent<HTMLElement>) => void;
+  onTouchMove: (e: TouchEvent<HTMLElement>) => void;
+  onTouchEnd: () => void;
+  pullDist: number;
+  refreshing: boolean;
+}
+
+// Hand-rolled pull-to-refresh: records the initial Y on touchstart only if
+// the target is scrolled to the top, then tracks downward pull on touchmove.
+// On touchend, fires onRefresh if the pull exceeded the threshold.
+export function usePullToRefresh(
+  onRefresh: () => void | Promise<void>,
+  { threshold = 80, enabled = true, maxPull = 120 }: Options = {},
+): Handlers {
+  const [pullDist, setPullDist] = useState(0);
+  const [refreshing, setRefreshing] = useState(false);
+  const startYRef = useRef<number | null>(null);
+
+  const onTouchStart = useCallback(
+    (e: TouchEvent<HTMLElement>) => {
+      if (!enabled || refreshing) return;
+      const target = e.currentTarget as HTMLElement;
+      if (target.scrollTop > 0) return;
+      const t = e.touches[0];
+      if (!t) return;
+      startYRef.current = t.clientY;
+    },
+    [enabled, refreshing],
+  );
+
+  const onTouchMove = useCallback(
+    (e: TouchEvent<HTMLElement>) => {
+      if (!enabled || refreshing || startYRef.current === null) return;
+      const t = e.touches[0];
+      if (!t) return;
+      const delta = t.clientY - startYRef.current;
+      if (delta > 0) {
+        setPullDist(Math.min(delta, maxPull));
+      } else {
+        setPullDist(0);
+      }
+    },
+    [enabled, refreshing, maxPull],
+  );
+
+  const onTouchEnd = useCallback(() => {
+    if (!enabled || refreshing) {
+      startYRef.current = null;
+      setPullDist(0);
+      return;
+    }
+    const fired = pullDist >= threshold && startYRef.current !== null;
+    startYRef.current = null;
+    setPullDist(0);
+    if (fired) {
+      setRefreshing(true);
+      Promise.resolve(onRefresh())
+        .catch(() => {})
+        .finally(() => {
+          // Hold the indicator briefly so the action feels intentional.
+          window.setTimeout(() => setRefreshing(false), 600);
+        });
+    }
+  }, [enabled, refreshing, pullDist, threshold, onRefresh]);
+
+  return { onTouchStart, onTouchMove, onTouchEnd, pullDist, refreshing };
+}

apps/web/src/hooks/useRightRailDrawer.tsx

@@ -0,0 +1,35 @@
+import { createContext, useCallback, useContext, useEffect, useState } from 'react';
+import type { ReactNode } from 'react';
+import { useLocation } from 'react-router-dom';
+
+interface RightRailDrawerState {
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  toggle: () => void;
+}
+
+const Ctx = createContext<RightRailDrawerState | null>(null);
+
+export function RightRailDrawerProvider({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const location = useLocation();
+
+  // Auto-close on route change. Same pattern as useSidebarDrawer — keeps the
+  // drawer from leaking between sessions when the user navigates.
+  useEffect(() => {
+    setOpen(false);
+  }, [location.pathname]);
+
+  const toggle = useCallback(() => setOpen((v) => !v), []);
+
+  return <Ctx.Provider value={{ open, setOpen, toggle }}>{children}</Ctx.Provider>;
+}
+
+export function useRightRailDrawer(): RightRailDrawerState {
+  const ctx = useContext(Ctx);
+  if (!ctx) {
+    // Soft fallback so consumers don't crash if rendered outside a provider.
+    return { open: false, setOpen: () => {}, toggle: () => {} };
+  }
+  return ctx;
+}

apps/web/src/hooks/useSessionChats.ts

@@ -0,0 +1,175 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import type { Chat } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
+
+export interface UseSessionChatsOpts {
+  removeChatFromPanes: (chatId: string) => void;
+  openChatInPane: (paneIdx: number, chatId: string) => void;
+  // Thin wrapper around openChatInPane(activePaneIdxRef.current, chatId);
+  // built by Workspace and passed in so this hook doesn't need to know
+  // about pane indexing.
+  openChatInActivePane: (chatId: string) => void;
+  initializeFirstChatIfEmpty: (chatId: string) => void;
+}
+
+export interface UseSessionChatsResult {
+  chats: Chat[];
+  setChats: React.Dispatch<React.SetStateAction<Chat[]>>;
+  createChat: (paneIdx: number) => Promise<void>;
+  archiveChat: (chatId: string) => Promise<void>;
+  unarchiveChat: (chatId: string) => Promise<void>;
+  deleteChat: (chatId: string) => Promise<void>;
+  renameChat: (chatId: string, name: string) => Promise<void>;
+  handleLandingSend: (paneIdx: number, content: string) => Promise<void>;
+}
+
+export function useSessionChats(
+  sessionId: string,
+  opts: UseSessionChatsOpts,
+): UseSessionChatsResult {
+  const [chats, setChats] = useState<Chat[]>([]);
+  const chatsRef = useRef<Chat[]>([]);
+  chatsRef.current = chats;
+
+  // Stable refs to opts callbacks so the subscription effect — which only
+  // re-runs on sessionId change — always sees the latest closures without
+  // unsubscribe/resubscribe churn.
+  const removeChatFromPanesRef = useRef(opts.removeChatFromPanes);
+  removeChatFromPanesRef.current = opts.removeChatFromPanes;
+  const openChatInPaneRef = useRef(opts.openChatInPane);
+  openChatInPaneRef.current = opts.openChatInPane;
+  const openChatInActivePaneRef = useRef(opts.openChatInActivePane);
+  openChatInActivePaneRef.current = opts.openChatInActivePane;
+  const initializeFirstChatIfEmptyRef = useRef(opts.initializeFirstChatIfEmpty);
+  initializeFirstChatIfEmptyRef.current = opts.initializeFirstChatIfEmpty;
+
+  useEffect(() => {
+    let cancelled = false;
+    api.chats.listForSession(sessionId).then((list) => {
+      if (cancelled) return;
+      setChats(list);
+      const openChat = list.find((c) => c.status === 'open');
+      if (openChat) {
+        initializeFirstChatIfEmptyRef.current(openChat.id);
+      }
+    }).catch(() => {});
+    return () => { cancelled = true; };
+  }, [sessionId]);
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type === 'chat_created' && event.session_id === sessionId) {
+        setChats((prev) => {
+          if (prev.some((c) => c.id === event.chat.id)) return prev;
+          return [event.chat, ...prev];
+        });
+      }
+      if (event.type === 'chat_updated') {
+        setChats((prev) => prev.map((c) =>
+          c.id === event.chat_id ? { ...c, name: event.name, updated_at: event.updated_at } : c
+        ));
+      }
+      if (event.type === 'chat_archived') {
+        setChats((prev) => prev.map((c) =>
+          c.id === event.chat_id ? { ...c, status: 'archived' as const } : c
+        ));
+        removeChatFromPanesRef.current(event.chat_id);
+      }
+      if (event.type === 'chat_unarchived') {
+        setChats((prev) => {
+          if (prev.some((c) => c.id === event.chat.id)) {
+            return prev.map((c) => c.id === event.chat.id ? { ...c, status: 'open' as const } : c);
+          }
+          return [event.chat, ...prev];
+        });
+      }
+      if (event.type === 'chat_deleted') {
+        setChats((prev) => prev.filter((c) => c.id !== event.chat_id));
+        removeChatFromPanesRef.current(event.chat_id);
+      }
+      if (event.type === 'open_chat_in_active_pane') {
+        openChatInActivePaneRef.current(event.chat_id);
+      }
+    });
+  }, [sessionId]);
+
+  const createChat = useCallback(async (paneIdx: number) => {
+    try {
+      const chat = await api.chats.create(sessionId);
+      // Optimistic local insert; the WS chat_created echo will be deduped by id.
+      setChats((prev) => {
+        if (prev.some((c) => c.id === chat.id)) return prev;
+        return [chat, ...prev];
+      });
+      openChatInPaneRef.current(paneIdx, chat.id);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to create chat');
+    }
+  }, [sessionId]);
+
+  const archiveChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.archive(chatId);
+      // Server publishes chat_archived; bus forwarder updates state.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to archive chat');
+    }
+  }, []);
+
+  const unarchiveChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.unarchive(chatId);
+      // Server publishes chat_unarchived.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to restore chat');
+    }
+  }, []);
+
+  const deleteChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.remove(chatId);
+      setChats((prev) => prev.filter((c) => c.id !== chatId));
+      removeChatFromPanesRef.current(chatId);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to delete chat');
+    }
+  }, []);
+
+  const renameChat = useCallback(async (chatId: string, name: string) => {
+    try {
+      await api.chats.update(chatId, { name });
+      setChats((prev) => prev.map((c) =>
+        c.id === chatId ? { ...c, name } : c
+      ));
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to rename chat');
+    }
+  }, []);
+
+  const handleLandingSend = useCallback(async (paneIdx: number, content: string) => {
+    try {
+      const chat = await api.chats.create(sessionId);
+      setChats((prev) => {
+        if (prev.some((c) => c.id === chat.id)) return prev;
+        return [chat, ...prev];
+      });
+      openChatInPaneRef.current(paneIdx, chat.id);
+      await api.messages.send(chat.id, content);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to send');
+    }
+  }, [sessionId]);
+
+  return {
+    chats,
+    setChats,
+    createChat,
+    archiveChat,
+    unarchiveChat,
+    deleteChat,
+    renameChat,
+    handleLandingSend,
+  };
+}

apps/web/src/hooks/useSessionStream.ts

@@ -2,6 +2,10 @@ import { useEffect, useRef, useState } from 'react';
 import type { Message, WsFrame } from '@/api/types';
 import { sessionEvents } from './sessionEvents';
 
+// session_renamed frame removed from WsFrame — it was declared but never
+// published on the per-session WS channel (server publishes via broker.publishUser
+// since v1.4). chat_renamed remains; auto_name.ts publishes it on session WS.
+
 interface State {
   messages: Message[];
   connected: boolean;
@@ -19,11 +23,15 @@ function applyFrame(state: State, frame: WsFrame): State {
       const newMsg: Message = {
         id: frame.message_id,
         session_id: '',
+        chat_id: frame.chat_id ?? '',
         role: frame.role,
         content: '',
+        kind: 'message',
         tool_calls: null,
         tool_results: null,
-        status: 'streaming',
+        // v1.8.2: cap-hit sentinels arrive role='system' and are static, so
+        // skipping the streaming dot for them keeps the UI accurate.
+        status: frame.role === 'system' ? 'complete' : 'streaming',
         last_seq: 0,
         tokens_used: null,
         ctx_used: null,
@@ -31,6 +39,7 @@ function applyFrame(state: State, frame: WsFrame): State {
         started_at: null,
         finished_at: null,
         created_at: new Date().toISOString(),
+        metadata: null,
       };
       return { ...state, messages: [...state.messages, newMsg] };
     }
@@ -71,8 +80,10 @@ function applyFrame(state: State, frame: WsFrame): State {
       const newMsg: Message = {
         id: frame.tool_message_id,
         session_id: '',
+        chat_id: frame.chat_id ?? '',
         role: 'tool',
         content: '',
+        kind: 'message',
         tool_calls: null,
         tool_results: {
           tool_call_id: frame.tool_call_id,
@@ -88,6 +99,7 @@ function applyFrame(state: State, frame: WsFrame): State {
         started_at: null,
         finished_at: null,
         created_at: new Date().toISOString(),
+        metadata: null,
       };
       return { ...state, messages: [...state.messages, newMsg] };
     }
@@ -102,6 +114,10 @@ function applyFrame(state: State, frame: WsFrame): State {
               ...(frame.ctx_max !== undefined ? { ctx_max: frame.ctx_max } : {}),
               ...(frame.started_at !== undefined ? { started_at: frame.started_at } : {}),
               ...(frame.finished_at !== undefined ? { finished_at: frame.finished_at } : {}),
+              // v1.8.2: cap-hit sentinels (and future stamped metadata) ride
+              // in on this terminal frame so the reducer can attach it
+              // without waiting for a refetch.
+              ...(frame.metadata !== undefined ? { metadata: frame.metadata } : {}),
             }
           : m
       );
@@ -114,19 +130,33 @@ function applyFrame(state: State, frame: WsFrame): State {
         messages: state.messages.filter((m) => !removeSet.has(m.id)),
       };
     }
-    case 'session_renamed': {
-      // Side-effect, not state — dispatch via event bus to other hooks.
+    case 'chat_renamed': {
       sessionEvents.emit({
-        type: 'session_renamed',
-        session_id: frame.session_id,
+        type: 'chat_updated',
+        chat_id: frame.chat_id,
+        session_id: '',
         name: frame.name,
+        updated_at: new Date().toISOString(),
       });
       return state;
     }
     case 'error': {
+      // v1.8.2: when the frame carries a structured reason, stamp it onto the
+      // failed message's metadata so the bubble can render specifics inline
+      // (the WS error frame is one-shot; refresh-safe rendering needs the
+      // value persisted on the message).
+      const errorMeta = frame.reason
+        ? { kind: 'error' as const, error_reason: frame.reason, error_text: frame.error }
+        : null;
       const next = frame.message_id
         ? state.messages.map((m) =>
-            m.id === frame.message_id ? { ...m, status: 'failed' as const } : m
+            m.id === frame.message_id
+              ? {
+                  ...m,
+                  status: 'failed' as const,
+                  ...(errorMeta ? { metadata: errorMeta } : {}),
+                }
+              : m
           )
         : state.messages;
       return { ...state, messages: next, error: frame.error };
@@ -134,6 +164,11 @@ function applyFrame(state: State, frame: WsFrame): State {
   }
 }
 
+// Matches useUserEvents — exponential backoff with the same ceiling so the
+// two channels reconnect on the same cadence after a network handoff.
+const RECONNECT_INITIAL_MS = 1000;
+const RECONNECT_MAX_MS = 30_000;
+
 export function useSessionStream(sessionId: string | undefined) {
   const [state, setState] = useState<State>({ messages: [], connected: false, error: null });
   const wsRef = useRef<WebSocket | null>(null);
@@ -143,32 +178,52 @@ export function useSessionStream(sessionId: string | undefined) {
 
     setState({ messages: [], connected: false, error: null });
 
-    const proto = window.location.protocol === 'https:' ? 'wss' : 'ws';
-    const url = `${proto}://${window.location.host}/api/ws/sessions/${sessionId}`;
-    const ws = new WebSocket(url);
-    wsRef.current = ws;
+    let unmounted = false;
+    let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
+    let reconnectDelay = RECONNECT_INITIAL_MS;
 
-    ws.onopen = () => {
-      setState((s) => ({ ...s, connected: true, error: null }));
-    };
-    ws.onmessage = (ev) => {
-      try {
-        const frame = JSON.parse(typeof ev.data === 'string' ? ev.data : '') as WsFrame;
-        setState((s) => applyFrame(s, frame));
-      } catch (err) {
-        console.warn('bad ws frame', err);
-      }
-    };
-    ws.onerror = () => {
-      setState((s) => ({ ...s, error: 'websocket error' }));
-    };
-    ws.onclose = () => {
-      setState((s) => ({ ...s, connected: false }));
+    const connect = () => {
+      if (unmounted) return;
+      const proto = window.location.protocol === 'https:' ? 'wss' : 'ws';
+      const url = `${proto}://${window.location.host}/api/ws/sessions/${sessionId}`;
+      const ws = new WebSocket(url);
+      wsRef.current = ws;
+
+      ws.onopen = () => {
+        reconnectDelay = RECONNECT_INITIAL_MS;
+        setState((s) => ({ ...s, connected: true, error: null }));
+      };
+      ws.onmessage = (ev) => {
+        try {
+          const frame = JSON.parse(typeof ev.data === 'string' ? ev.data : '') as WsFrame;
+          setState((s) => applyFrame(s, frame));
+        } catch (err) {
+          console.warn('bad ws frame', err);
+        }
+      };
+      // v1.8.1: WS errors no longer surface as user-facing toasts here. The
+      // user-channel hook (useUserEvents) owns the debounced "reconnecting…"
+      // UI; this channel just reconnects silently on the same backoff.
+      ws.onerror = () => {
+        try { ws.close(); } catch {}
+      };
+      ws.onclose = () => {
+        if (unmounted) return;
+        setState((s) => ({ ...s, connected: false }));
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+        reconnectTimer = setTimeout(connect, delay);
+      };
     };
 
+    connect();
+
     return () => {
+      unmounted = true;
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      const ws = wsRef.current;
       wsRef.current = null;
-      ws.close();
+      if (ws) try { ws.close(); } catch {}
     };
   }, [sessionId]);
 

apps/web/src/hooks/useSidebar.ts

@@ -52,9 +52,12 @@ function load(): Promise<void> {
 function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').SessionEvent): SidebarResponse {
   switch (event.type) {
     case 'project_created': {
+      if (prev.projects.some((p) => p.id === event.project.id)) return prev;
       const fresh: SidebarProject = {
         id: event.project.id,
         name: event.project.name,
+        path: event.project.path,
+        gitea_remote: event.project.gitea_remote ?? null,
         recent_sessions: [],
         total_sessions: 0,
       };
@@ -69,6 +72,7 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
       let changed = false;
       const projects = prev.projects.map((p) => {
         if (p.id !== event.project_id) return p;
+        if (p.recent_sessions.some((s) => s.id === event.session.id)) return p;
         changed = true;
         const fresh: SidebarSession = {
           id: event.session.id,
@@ -89,8 +93,10 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
       let changed = false;
       const projects = prev.projects.map((p) => {
         if (p.id !== event.project_id) return p;
-        changed = true;
         const recent = p.recent_sessions.filter((s) => s.id !== event.session_id);
+        const wasPresent = recent.length !== p.recent_sessions.length;
+        if (!wasPresent) return p;
+        changed = true;
         return {
           ...p,
           recent_sessions: recent,
@@ -140,26 +146,87 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
     case 'open_file_in_browser':
       // Consumed by Workspace (T7); no sidebar state change needed.
       return prev;
+    case 'attach_chat_file':
+      return prev;
+    case 'open_chat_in_active_pane':
+      // Consumed by Workspace; sidebar has no business with pane state.
+      return prev;
+    case 'open_settings_pane':
+      // Consumed by Session.tsx (calls toggleSettingsPane on its panesHook).
+      // Sidebar data is untouched.
+      return prev;
+    case 'session_archived': {
+      let changed = false;
+      const projects = prev.projects.map((p) => {
+        if (p.id !== event.project_id) return p;
+        const recent = p.recent_sessions.filter((s) => s.id !== event.session_id);
+        if (recent.length === p.recent_sessions.length) return p;
+        changed = true;
+        return {
+          ...p,
+          recent_sessions: recent,
+          total_sessions: Math.max(0, p.total_sessions - 1),
+        };
+      });
+      return changed ? { ...prev, projects } : prev;
+    }
+    case 'chat_created':
+    case 'chat_updated':
+    case 'chat_archived':
+    case 'chat_unarchived':
+    case 'chat_deleted':
+    case 'chat_status':
+      return prev;
+    case 'project_archived': {
+      const next = prev.projects.filter((p) => p.id !== event.project_id);
+      if (next.length === prev.projects.length) return prev;
+      return { ...prev, projects: next };
+    }
+    case 'project_unarchived': {
+      if (prev.projects.some((p) => p.id === event.project.id)) return prev;
+      const fresh: SidebarProject = {
+        id: event.project.id,
+        name: event.project.name,
+        path: event.project.path,
+        gitea_remote: event.project.gitea_remote ?? null,
+        recent_sessions: [],
+        total_sessions: 0,
+      };
+      return { ...prev, projects: [fresh, ...prev.projects] };
+    }
+    case 'project_updated': {
+      let changed = false;
+      const projects = prev.projects.map((p) => {
+        if (p.id !== event.project_id) return p;
+        if (p.name === event.name) return p;
+        changed = true;
+        return { ...p, name: event.name };
+      });
+      return changed ? { ...prev, projects } : prev;
+    }
   }
 }
 
 // One bus subscription for the lifetime of the module. Events arriving
 // before the initial fetch resolves are dropped; the eventual fetch
 // result is the source of truth.
-sessionEvents.subscribe((event) => {
-  // session_loaded updates activeSessionProjectId regardless of whether
-  // sharedData is populated yet — notify so subscribers can re-read.
-  if (event.type === 'session_loaded') {
-    activeSession = { session_id: event.session_id, project_id: event.project_id };
+// Guard prevents duplicate listeners during Vite HMR reloads.
+const G = globalThis as Record<string, unknown>;
+if (!G.__boocode_sidebar_subscribed) {
+  G.__boocode_sidebar_subscribed = true;
+  sessionEvents.subscribe((event) => {
+    if (event.type === 'session_loaded') {
+      activeSession = { session_id: event.session_id, project_id: event.project_id };
+      notify();
+      return;
+    }
+    if (!sharedData) return;
+    const next = applyEvent(sharedData, event);
+    if (next === sharedData) return;
+    sharedData = next;
     notify();
-    return;
-  }
-  if (!sharedData) return;
-  const next = applyEvent(sharedData, event);
-  if (next === sharedData) return;
-  sharedData = next;
-  notify();
-});
+  });
+}
 
 interface Snapshot {
   data: SidebarResponse | null;

apps/web/src/hooks/useSidebarDrawer.tsx

@@ -0,0 +1,36 @@
+import { createContext, useCallback, useContext, useEffect, useState } from 'react';
+import type { ReactNode } from 'react';
+import { useLocation } from 'react-router-dom';
+
+interface SidebarDrawerState {
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  toggle: () => void;
+}
+
+const Ctx = createContext<SidebarDrawerState | null>(null);
+
+export function SidebarDrawerProvider({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const location = useLocation();
+
+  // Auto-close on navigation. Effect fires once on mount too (open default
+  // is false, so no observable effect) and on every pathname change after.
+  useEffect(() => {
+    setOpen(false);
+  }, [location.pathname]);
+
+  const toggle = useCallback(() => setOpen((v) => !v), []);
+
+  return <Ctx.Provider value={{ open, setOpen, toggle }}>{children}</Ctx.Provider>;
+}
+
+export function useSidebarDrawer(): SidebarDrawerState {
+  const ctx = useContext(Ctx);
+  if (!ctx) {
+    // Soft fallback so consumers don't crash if rendered outside a provider.
+    // In practice all top-level routes are inside the provider.
+    return { open: false, setOpen: () => {}, toggle: () => {} };
+  }
+  return ctx;
+}

apps/web/src/hooks/useSkills.ts

@@ -0,0 +1,43 @@
+import { useEffect, useState } from 'react';
+import { api } from '@/api/client';
+import type { Skill } from '@/api/types';
+
+// Batch 9.6: shared in-memory cache for the slash-command dropdown. One fetch
+// per process; subsequent mounts of useSkills() return the cached list and
+// don't re-hit /api/skills. Matches the useSidebar / useChatStatus module-
+// singleton pattern so the dropdown stays cheap even with many ChatInputs
+// mounted at once.
+
+let cachedSkills: Skill[] | null = null;
+let inflight: Promise<Skill[]> | null = null;
+const subscribers = new Set<(s: Skill[]) => void>();
+
+async function loadSkills(): Promise<Skill[]> {
+  if (inflight) return inflight;
+  inflight = api.skills
+    .list()
+    .then((r) => {
+      cachedSkills = r.skills;
+      for (const sub of subscribers) {
+        try { sub(cachedSkills); } catch { /* swallow */ }
+      }
+      return cachedSkills;
+    })
+    .finally(() => { inflight = null; });
+  return inflight;
+}
+
+export function useSkills(): { skills: Skill[]; loaded: boolean } {
+  const [skills, setSkills] = useState<Skill[]>(cachedSkills ?? []);
+  const [loaded, setLoaded] = useState<boolean>(cachedSkills !== null);
+
+  useEffect(() => {
+    subscribers.add(setSkills);
+    if (cachedSkills === null) {
+      void loadSkills().then(() => setLoaded(true)).catch(() => setLoaded(true));
+    }
+    return () => { subscribers.delete(setSkills); };
+  }, []);
+
+  return { skills, loaded };
+}

apps/web/src/hooks/useUserEvents.ts

@@ -1,5 +1,6 @@
 import { useEffect } from 'react';
 import { sessionEvents } from './sessionEvents';
+import { createWsReconnectToast } from './wsReconnectToast';
 
 const RECONNECT_INITIAL_MS = 1000;
 const RECONNECT_MAX_MS = 30000;
@@ -11,6 +12,20 @@ export function useUserEvents(): void {
     let reconnectDelay = RECONNECT_INITIAL_MS;
     let unmounted = false;
 
+    // v1.8.1: silent on the first disconnect; gray "reconnecting…" after 3
+    // fails / 15 s; red "connection lost" with a Retry Now action after 60 s.
+    const reconnectToast = createWsReconnectToast({
+      label: 'Live updates',
+      onRetryNow: () => {
+        if (reconnectTimer) {
+          clearTimeout(reconnectTimer);
+          reconnectTimer = null;
+          reconnectDelay = RECONNECT_INITIAL_MS;
+          connect();
+        }
+      },
+    });
+
     const connect = () => {
       if (unmounted) return;
       const url = new URL('/api/ws/user', window.location.href);
@@ -19,6 +34,7 @@ export function useUserEvents(): void {
 
       ws.onopen = () => {
         reconnectDelay = RECONNECT_INITIAL_MS;
+        reconnectToast.onConnected();
       };
 
       ws.onmessage = (ev) => {
@@ -34,13 +50,15 @@ export function useUserEvents(): void {
 
       ws.onclose = () => {
         if (unmounted) return;
+        reconnectToast.onFailure();
         const delay = reconnectDelay;
         reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
         reconnectTimer = setTimeout(connect, delay);
       };
 
       ws.onerror = () => {
-        // close handler will trigger reconnect
+        // close handler will trigger reconnect; best-effort, ignore failure
+        // because the socket may already be closing
         try { ws?.close(); } catch {}
       };
     };
@@ -49,6 +67,7 @@ export function useUserEvents(): void {
 
     return () => {
       unmounted = true;
+      reconnectToast.dispose();
       if (reconnectTimer) clearTimeout(reconnectTimer);
       if (ws) try { ws.close(); } catch {}
     };

apps/web/src/hooks/useViewport.ts

@@ -0,0 +1,45 @@
+import { useEffect, useState } from 'react';
+
+// Breakpoints (px): mobile <768, tablet 768-1023, desktop >=1024.
+const MOBILE_MAX = 767;
+const TABLET_MAX = 1023;
+
+export interface ViewportSnapshot {
+  isMobile: boolean;
+  isTablet: boolean;
+  width: number;
+}
+
+function snapshot(): ViewportSnapshot {
+  if (typeof window === 'undefined') {
+    return { isMobile: false, isTablet: false, width: 1280 };
+  }
+  const width = window.innerWidth;
+  return {
+    isMobile: width <= MOBILE_MAX,
+    isTablet: width > MOBILE_MAX && width <= TABLET_MAX,
+    width,
+  };
+}
+
+// matchMedia-based, no resize polling. We listen to two breakpoint queries
+// and recompute the snapshot on any change.
+export function useViewport(): ViewportSnapshot {
+  const [state, setState] = useState<ViewportSnapshot>(snapshot);
+
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+    const mobileMq = window.matchMedia(`(max-width: ${MOBILE_MAX}px)`);
+    const tabletMq = window.matchMedia(`(min-width: ${MOBILE_MAX + 1}px) and (max-width: ${TABLET_MAX}px)`);
+    const update = () => setState(snapshot());
+    mobileMq.addEventListener('change', update);
+    tabletMq.addEventListener('change', update);
+    update();
+    return () => {
+      mobileMq.removeEventListener('change', update);
+      tabletMq.removeEventListener('change', update);
+    };
+  }, []);
+
+  return state;
+}

apps/web/src/hooks/useWorkspacePanes.ts

@@ -0,0 +1,394 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import type { DragEvent } from 'react';
+import { toast } from 'sonner';
+import type { WorkspacePane } from '@/api/types';
+import { setActivePaneInfo, clearActivePane } from '@/hooks/useActivePane';
+
+export const MAX_PANES = 5;
+const STORAGE_KEY = 'boocode.workspace.panes';
+
+function generateId(): string {
+  return crypto.randomUUID();
+}
+
+function emptyPane(): WorkspacePane {
+  return { id: generateId(), kind: 'empty', chatIds: [], activeChatIdx: -1 };
+}
+
+function chatPane(chatId: string): WorkspacePane {
+  return { id: generateId(), kind: 'chat', chatId, chatIds: [chatId], activeChatIdx: 0 };
+}
+
+// v1.9: settings pane factory. No chats, no state beyond identity — the
+// SettingsPane component renders Session/Project sections from the
+// surrounding session/project.
+function settingsPane(): WorkspacePane {
+  return { id: generateId(), kind: 'settings', chatIds: [], activeChatIdx: -1 };
+}
+
+// v1.9: settings panes are ephemeral. Filter them out before persisting so a
+// page reload always returns to a clean workspace; the user re-opens via the
+// sidebar Settings button when needed.
+function persistablePanes(panes: WorkspacePane[]): WorkspacePane[] {
+  return panes.filter((p) => p.kind !== 'settings');
+}
+
+// v1.9: per recon decision (c), settings panes don't count toward MAX_PANES.
+// Helper used at every pane-insertion site so the rule lives in one place.
+function nonSettingsCount(panes: WorkspacePane[]): number {
+  return panes.reduce((n, p) => n + (p.kind === 'settings' ? 0 : 1), 0);
+}
+
+function loadPanes(sessionId: string): WorkspacePane[] | null {
+  try {
+    const raw = localStorage.getItem(`${STORAGE_KEY}.${sessionId}`);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw) as WorkspacePane[];
+    if (!Array.isArray(parsed) || parsed.length === 0) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function savePanes(sessionId: string, panes: WorkspacePane[]): void {
+  try {
+    localStorage.setItem(
+      `${STORAGE_KEY}.${sessionId}`,
+      JSON.stringify(persistablePanes(panes)),
+    );
+  } catch { /* quota or disabled */ }
+}
+
+export interface UseWorkspacePanesResult {
+  panes: WorkspacePane[];
+  activePaneIdx: number;
+  setActivePaneIdx: React.Dispatch<React.SetStateAction<number>>;
+  activePaneIdxRef: React.MutableRefObject<number>;
+  openChatInPane: (paneIdx: number, chatId: string) => void;
+  switchTab: (paneIdx: number, tabIdx: number) => void;
+  removeTab: (paneIdx: number, chatId: string) => void;
+  closeOtherTabs: (paneIdx: number, keepChatId: string) => void;
+  closeTabsToRight: (paneIdx: number, pivotChatId: string) => void;
+  closeAllTabs: (paneIdx: number) => void;
+  showLandingPage: (paneIdx: number) => void;
+  addSplitPane: (kind: 'chat' | 'terminal' | 'agent') => void;
+  // Open-on-first-click, close-on-second-click. Singleton — settings panes
+  // don't count toward MAX_PANES. Closing the only remaining pane (edge case)
+  // falls back to an empty pane to preserve the "always one pane" invariant.
+  toggleSettingsPane: () => void;
+  removePane: (idx: number) => void;
+  removeChatFromPanes: (chatId: string) => void;
+  initializeFirstChatIfEmpty: (chatId: string) => void;
+  handlePaneDragStart: (idx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragOver: (idx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragLeave: () => void;
+  handlePaneDrop: (targetIdx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragEnd: () => void;
+  dragOverIdx: number | null;
+  draggingIdxRef: React.MutableRefObject<number | null>;
+}
+
+export function useWorkspacePanes(sessionId: string): UseWorkspacePanesResult {
+  const [panes, setPanes] = useState<WorkspacePane[]>(() => {
+    return loadPanes(sessionId) ?? [emptyPane()];
+  });
+  const [activePaneIdx, setActivePaneIdx] = useState(0);
+  const draggingIdxRef = useRef<number | null>(null);
+  const [dragOverIdx, setDragOverIdx] = useState<number | null>(null);
+
+  useEffect(() => {
+    savePanes(sessionId, panes);
+  }, [sessionId, panes]);
+
+  useEffect(() => {
+    const active = panes[activePaneIdx];
+    if (!active) {
+      clearActivePane();
+      return;
+    }
+    setActivePaneInfo({
+      sessionId,
+      paneId: active.id,
+      kind: active.kind,
+      activeFile: null,
+    });
+  }, [sessionId, panes, activePaneIdx]);
+
+  useEffect(() => {
+    return () => {
+      clearActivePane();
+    };
+  }, []);
+
+  const activePaneIdxRef = useRef(activePaneIdx);
+  activePaneIdxRef.current = activePaneIdx;
+
+  const openChatInPane = useCallback((paneIdx: number, chatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const existing = pane.chatIds.indexOf(chatId);
+      if (existing >= 0) {
+        next[paneIdx] = { ...pane, kind: 'chat', chatId, activeChatIdx: existing };
+      } else {
+        const newIds = [...pane.chatIds, chatId];
+        next[paneIdx] = {
+          ...pane,
+          kind: 'chat',
+          chatId,
+          chatIds: newIds,
+          activeChatIdx: newIds.length - 1,
+        };
+      }
+      return next;
+    });
+    setActivePaneIdx(paneIdx);
+  }, []);
+
+  const switchTab = useCallback((paneIdx: number, tabIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const chatId = pane.chatIds[tabIdx];
+      if (!chatId) return prev;
+      next[paneIdx] = { ...pane, chatId, activeChatIdx: tabIdx };
+      return next;
+    });
+  }, []);
+
+  const removeTab = useCallback((paneIdx: number, chatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const nextIds = pane.chatIds.filter((id) => id !== chatId);
+      if (nextIds.length === 0) {
+        next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      } else {
+        const nextActiveIdx = Math.min(pane.activeChatIdx, nextIds.length - 1);
+        next[paneIdx] = {
+          ...pane,
+          chatIds: nextIds,
+          activeChatIdx: nextActiveIdx,
+          chatId: nextIds[nextActiveIdx],
+        };
+      }
+      return next;
+    });
+  }, []);
+
+  // Keep only the right-clicked tab open in this pane.
+  const closeOtherTabs = useCallback((paneIdx: number, keepChatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const keepIdx = pane.chatIds.indexOf(keepChatId);
+      if (keepIdx < 0) return prev;
+      next[paneIdx] = {
+        ...pane,
+        kind: 'chat',
+        chatId: keepChatId,
+        chatIds: [keepChatId],
+        activeChatIdx: 0,
+      };
+      return next;
+    });
+  }, []);
+
+  // Close every tab to the right of the right-clicked one.
+  const closeTabsToRight = useCallback((paneIdx: number, pivotChatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const pivotIdx = pane.chatIds.indexOf(pivotChatId);
+      if (pivotIdx < 0 || pivotIdx === pane.chatIds.length - 1) return prev;
+      const nextIds = pane.chatIds.slice(0, pivotIdx + 1);
+      const nextActiveIdx = Math.min(pane.activeChatIdx, nextIds.length - 1);
+      next[paneIdx] = {
+        ...pane,
+        chatIds: nextIds,
+        activeChatIdx: nextActiveIdx,
+        chatId: nextIds[nextActiveIdx],
+      };
+      return next;
+    });
+  }, []);
+
+  // Close every tab in this pane; land on landing page.
+  const closeAllTabs = useCallback((paneIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      return next;
+    });
+  }, []);
+
+  const showLandingPage = useCallback((paneIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined };
+      return next;
+    });
+  }, []);
+
+  const addSplitPane = useCallback((kind: 'chat' | 'terminal' | 'agent') => {
+    if (kind === 'terminal') {
+      toast('Terminal panes coming in BooTerm');
+      return;
+    }
+    if (kind === 'agent') {
+      toast('Agent panes coming in BooCoder');
+      return;
+    }
+    setPanes((prev) => {
+      // v1.9: settings panes are excluded from the MAX cap (decision c).
+      if (nonSettingsCount(prev) >= MAX_PANES) {
+        toast.error(`Maximum ${MAX_PANES} panes`);
+        return prev;
+      }
+      const next = [...prev, emptyPane()];
+      setActivePaneIdx(next.length - 1);
+      return next;
+    });
+  }, []);
+
+  const toggleSettingsPane = useCallback(() => {
+    setPanes((prev) => {
+      const existingIdx = prev.findIndex((p) => p.kind === 'settings');
+      if (existingIdx < 0) {
+        const next = [...prev, settingsPane()];
+        setActivePaneIdx(next.length - 1);
+        return next;
+      }
+      if (prev.length <= 1) {
+        setActivePaneIdx(0);
+        return [emptyPane()];
+      }
+      const next = prev.filter((_, i) => i !== existingIdx);
+      setActivePaneIdx((ai) => Math.min(ai, next.length - 1));
+      return next;
+    });
+  }, []);
+
+  const removePane = useCallback((idx: number) => {
+    setPanes((prev) => {
+      if (prev.length <= 1) {
+        // Settings is the only kind that can be the last pane and still need
+        // closing (X / Esc / sidebar toggle). Fall back to empty.
+        if (prev[idx]?.kind === 'settings') {
+          setActivePaneIdx(0);
+          return [emptyPane()];
+        }
+        return prev;
+      }
+      const next = prev.filter((_, i) => i !== idx);
+      setActivePaneIdx((ai) => Math.min(ai, next.length - 1));
+      return next;
+    });
+  }, []);
+
+  // Replaces a single empty default pane with a chat pane. Used by the initial
+  // chat fetch to land on the most-recent open chat if no saved pane state.
+  const initializeFirstChatIfEmpty = useCallback((chatId: string) => {
+    setPanes((prev) => {
+      if (prev.length === 1 && prev[0]!.kind === 'empty') {
+        return [chatPane(chatId)];
+      }
+      return prev;
+    });
+  }, []);
+
+  const removeChatFromPanes = useCallback((chatId: string) => {
+    setPanes((prev) => prev.map((p) => {
+      const idx = p.chatIds.indexOf(chatId);
+      if (idx < 0) return p;
+      const nextIds = p.chatIds.filter((id) => id !== chatId);
+      if (nextIds.length === 0) {
+        return { ...p, kind: 'empty' as const, chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      }
+      const nextActiveIdx = Math.min(p.activeChatIdx, nextIds.length - 1);
+      return {
+        ...p,
+        chatIds: nextIds,
+        activeChatIdx: nextActiveIdx,
+        chatId: nextIds[nextActiveIdx],
+      };
+    }));
+  }, []);
+
+  const handlePaneDragStart = useCallback(
+    (idx: number) => (e: DragEvent<HTMLDivElement>) => {
+      draggingIdxRef.current = idx;
+      e.dataTransfer.effectAllowed = 'move';
+      e.dataTransfer.setData('text/plain', String(idx));
+    },
+    []
+  );
+
+  const handlePaneDragOver = useCallback(
+    (idx: number) => (e: DragEvent<HTMLDivElement>) => {
+      if (draggingIdxRef.current === null) return;
+      e.preventDefault();
+      e.dataTransfer.dropEffect = 'move';
+      if (dragOverIdx !== idx) setDragOverIdx(idx);
+    },
+    [dragOverIdx]
+  );
+
+  const handlePaneDragLeave = useCallback(() => {
+    setDragOverIdx(null);
+  }, []);
+
+  const handlePaneDrop = useCallback(
+    (targetIdx: number) => (e: DragEvent<HTMLDivElement>) => {
+      e.preventDefault();
+      const fromIdx = draggingIdxRef.current;
+      draggingIdxRef.current = null;
+      setDragOverIdx(null);
+      if (fromIdx === null || fromIdx === targetIdx) return;
+      setPanes((prev) => {
+        const next = [...prev];
+        const [moved] = next.splice(fromIdx, 1);
+        if (!moved) return prev;
+        next.splice(targetIdx, 0, moved);
+        // Keep active selection on the same logical pane (the one being dragged).
+        setActivePaneIdx(targetIdx);
+        return next;
+      });
+    },
+    []
+  );
+
+  const handlePaneDragEnd = useCallback(() => {
+    draggingIdxRef.current = null;
+    setDragOverIdx(null);
+  }, []);
+
+  return {
+    panes,
+    activePaneIdx,
+    setActivePaneIdx,
+    activePaneIdxRef,
+    openChatInPane,
+    switchTab,
+    removeTab,
+    closeOtherTabs,
+    closeTabsToRight,
+    closeAllTabs,
+    showLandingPage,
+    addSplitPane,
+    toggleSettingsPane,
+    removePane,
+    removeChatFromPanes,
+    initializeFirstChatIfEmpty,
+    handlePaneDragStart,
+    handlePaneDragOver,
+    handlePaneDragLeave,
+    handlePaneDrop,
+    handlePaneDragEnd,
+    dragOverIdx,
+    draggingIdxRef,
+  };
+}

apps/web/src/hooks/wsReconnectToast.ts

@@ -0,0 +1,95 @@
+import { toast } from 'sonner';
+
+// v1.8.1 thresholds. First disconnect is silent — mobile Authelia idle timeouts
+// and tab suspensions trip reconnects constantly and the old red "websocket
+// error" toast made the app feel broken. Only escalate once the failure is
+// sustained.
+const TOAST_AFTER_FAILS = 3;
+const TOAST_AFTER_MS = 15_000;
+const PERSISTENT_AFTER_MS = 60_000;
+
+export interface WsReconnectToast {
+  onFailure(): void;
+  onConnected(): void;
+  dispose(): void;
+}
+
+interface Options {
+  label: string;            // shown in the toast (e.g. "Live updates")
+  onRetryNow: () => void;   // user clicked the "Retry now" action
+}
+
+// Per-connection toast wrapper. Caller drives it from the WS lifecycle:
+//   onFailure   — after each failed connection attempt
+//   onConnected — after a successful onopen
+//   dispose     — on hook unmount
+// The wrapper itself runs no timers and does not change the caller's reconnect
+// cadence; it only decides when to show / dismiss the toast.
+export function createWsReconnectToast(opts: Options): WsReconnectToast {
+  let firstFailureAt: number | null = null;
+  let failureCount = 0;
+  let reconnectingId: string | number | null = null;
+  let persistentId: string | number | null = null;
+
+  function dismissReconnecting(): void {
+    if (reconnectingId !== null) {
+      toast.dismiss(reconnectingId);
+      reconnectingId = null;
+    }
+  }
+  function dismissPersistent(): void {
+    if (persistentId !== null) {
+      toast.dismiss(persistentId);
+      persistentId = null;
+    }
+  }
+
+  return {
+    onFailure() {
+      if (firstFailureAt === null) firstFailureAt = Date.now();
+      failureCount += 1;
+      const elapsed = Date.now() - firstFailureAt;
+
+      // Escalate to red error + Retry button after PERSISTENT_AFTER_MS. Replaces
+      // the gray toast if it's still showing.
+      if (persistentId === null && elapsed >= PERSISTENT_AFTER_MS) {
+        dismissReconnecting();
+        persistentId = toast.error(`${opts.label}: connection lost`, {
+          duration: Infinity,
+          action: {
+            label: 'Retry now',
+            onClick: () => {
+              dismissReconnecting();
+              dismissPersistent();
+              opts.onRetryNow();
+            },
+          },
+        });
+        return;
+      }
+
+      // Gray "reconnecting…" toast once we've crossed either threshold.
+      if (
+        reconnectingId === null &&
+        persistentId === null &&
+        (failureCount >= TOAST_AFTER_FAILS || elapsed >= TOAST_AFTER_MS)
+      ) {
+        reconnectingId = toast.warning(`${opts.label}: reconnecting…`, {
+          duration: Infinity,
+        });
+      }
+    },
+    onConnected() {
+      firstFailureAt = null;
+      failureCount = 0;
+      dismissReconnecting();
+      dismissPersistent();
+    },
+    dispose() {
+      firstFailureAt = null;
+      failureCount = 0;
+      dismissReconnecting();
+      dismissPersistent();
+    },
+  };
+}

apps/web/src/lib/attachments.ts

@@ -0,0 +1,72 @@
+export type Attachment = {
+  id: string;
+  kind: 'file' | 'lines' | 'paste';
+  filename: string;
+  language: string | null;
+  content: string;
+  range?: [number, number];
+  source: '@' | 'line-select' | 'drop' | 'paste';
+};
+
+// v1.7: caps shared between drag-drop and paste-as-attachment so both paths
+// reject the same way. Match the existing 10-attachment cap in
+// ChatInput.addAttachment.
+export const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024; // 5 MB
+export const PASTE_INLINE_MAX_LINES = 8;
+
+// First-8KB null-byte scan. Returns true if the content looks binary.
+// Accepts a string (post-decode), an ArrayBuffer (pre-decode), or a Uint8Array.
+// For binary files like PNG, scanning bytes is more reliable than scanning
+// post-UTF-8-decode strings because invalid sequences may be replaced rather
+// than preserved.
+export function looksBinary(content: string | ArrayBuffer | Uint8Array): boolean {
+  const SCAN_BYTES = 8192;
+  if (typeof content === 'string') {
+    const max = Math.min(content.length, SCAN_BYTES);
+    for (let i = 0; i < max; i++) {
+      if (content.charCodeAt(i) === 0) return true;
+    }
+    return false;
+  }
+  const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+  const max = Math.min(bytes.length, SCAN_BYTES);
+  for (let i = 0; i < max; i++) {
+    if (bytes[i] === 0) return true;
+  }
+  return false;
+}
+
+export const LANG_MAP: Record<string, string> = {
+  ts: 'typescript', tsx: 'tsx', js: 'javascript', jsx: 'jsx',
+  mjs: 'javascript', cjs: 'javascript',
+  py: 'python', go: 'go', rs: 'rust', rb: 'ruby', java: 'java',
+  c: 'c', h: 'c', cpp: 'cpp', cc: 'cpp', hpp: 'cpp', cs: 'csharp',
+  php: 'php', sh: 'bash', bash: 'bash', zsh: 'bash',
+  yml: 'yaml', yaml: 'yaml', json: 'json', toml: 'toml',
+  md: 'markdown', markdown: 'markdown', sql: 'sql', dockerfile: 'dockerfile',
+  html: 'html', htm: 'html', css: 'css', scss: 'scss',
+};
+
+export function inferLanguage(filename: string): string | null {
+  const base = filename.split('/').pop() ?? filename;
+  if (base.toLowerCase() === 'dockerfile') return 'dockerfile';
+  const m = base.match(/\.([^.]+)$/);
+  return m ? (LANG_MAP[m[1]!.toLowerCase()] ?? null) : null;
+}
+
+export function flattenToMessage(attachments: Attachment[], text: string): string {
+  if (attachments.length === 0) return text;
+  const blocks = attachments.map(a => {
+    const fence = '```' + (a.language ?? '');
+    let header: string;
+    if (a.kind === 'lines') {
+      header = `// from: ${a.filename}:${a.range?.[0] ?? '?'}-${a.range?.[1] ?? '?'}`;
+    } else if (a.kind === 'paste') {
+      header = `// from: pasted text (${a.content.split('\n').length} lines)`;
+    } else {
+      header = `// from: ${a.filename}`;
+    }
+    return `${fence}\n${header}\n${a.content}\n\`\`\``;
+  });
+  return [...blocks, text].filter(Boolean).join('\n\n');
+}

apps/web/src/lib/format.ts

@@ -0,0 +1,5 @@
+export function formatTokens(n: number | null | undefined): string | null {
+  if (n === null || n === undefined) return null;
+  if (n < 1000) return `${n} tok`;
+  return `${(n / 1000).toFixed(1)}k tok`;
+}

apps/web/src/lib/projectUrls.ts

@@ -0,0 +1,5 @@
+export function giteaUrlFor(project: { path: string; gitea_remote?: string | null }): string {
+  if (project.gitea_remote) return project.gitea_remote;
+  const folderName = project.path.split('/').filter(Boolean).pop() ?? '';
+  return `https://git.indifferentketchup.com/indifferentketchup/${folderName}`;
+}

apps/web/src/lib/theme.ts

@@ -0,0 +1,226 @@
+import { useEffect, useState } from 'react';
+import { api } from '@/api/client';
+
+// themes-v1: source of truth for the 18 presets. id and name are surfaced in
+// the picker; family groups visually; supportsDark/supportsLight reflect
+// whether the corresponding selector exists in styles/themes/<id>.css; anchors
+// are the 5 dark swatches (or the light palette for the two light-only themes)
+// used in the picker preview strip.
+export type ThemeId =
+  | 'obsidian'
+  | 'gunmetal'
+  | 'espresso'
+  | 'volcanic-brown'
+  | 'copper'
+  | 'gold'
+  | 'oxblood'
+  | 'crimson'
+  | 'elderflower'
+  | 'plum'
+  | 'steel-pink'
+  | 'fuchsia-noir'
+  | 'matrix'
+  | 'sage'
+  | 'ivory'
+  | 'chalk'
+  | 'cobalt'
+  | 'midnight-sapphire';
+
+export type ThemeMode = 'dark' | 'light' | 'system';
+
+export interface ThemeMeta {
+  id: ThemeId;
+  name: string;
+  family: string;
+  supportsDark: boolean;
+  supportsLight: boolean;
+  anchors: [string, string, string, string, string];
+}
+
+export const THEMES: readonly ThemeMeta[] = [
+  { id: 'obsidian', name: 'Obsidian', family: 'Charcoal', supportsDark: true, supportsLight: true,
+    anchors: ['#0c0c0e', '#15151a', '#1f1f23', '#6b6b75', '#8b5cf6'] },
+  { id: 'gunmetal', name: 'Gunmetal', family: 'Charcoal', supportsDark: true, supportsLight: true,
+    anchors: ['#0d1117', '#161b22', '#21262d', '#7d8590', '#388bfd'] },
+  { id: 'espresso', name: 'Espresso', family: 'Brown', supportsDark: true, supportsLight: true,
+    anchors: ['#1c1410', '#241a14', '#2e2218', '#8a7058', '#c8a880'] },
+  { id: 'volcanic-brown', name: 'Volcanic Brown', family: 'Brown', supportsDark: true, supportsLight: true,
+    anchors: ['#140906', '#1e0e0a', '#2e1610', '#7a4030', '#cc4a1a'] },
+  { id: 'copper', name: 'Copper', family: 'Amber', supportsDark: true, supportsLight: true,
+    anchors: ['#100800', '#1c1408', '#2e1f0a', '#8a6040', '#b87333'] },
+  { id: 'gold', name: 'Gold', family: 'Amber', supportsDark: true, supportsLight: true,
+    anchors: ['#0e0800', '#1a1200', '#2a1f00', '#a07c30', '#d4af37'] },
+  { id: 'oxblood', name: 'Oxblood', family: 'Crimson', supportsDark: true, supportsLight: true,
+    anchors: ['#0a0303', '#180606', '#2a0808', '#7a3028', '#8b1a1a'] },
+  { id: 'crimson', name: 'Crimson', family: 'Crimson', supportsDark: true, supportsLight: true,
+    anchors: ['#0e0404', '#1a0808', '#2e0a0a', '#8a3030', '#dc143c'] },
+  { id: 'elderflower', name: 'Elderflower', family: 'Violet', supportsDark: true, supportsLight: true,
+    anchors: ['#100818', '#1c1024', '#2c1830', '#8a78a0', '#b89cd8'] },
+  { id: 'plum', name: 'Plum', family: 'Violet', supportsDark: true, supportsLight: true,
+    anchors: ['#0c0814', '#180e20', '#241830', '#7a4878', '#8e4585'] },
+  { id: 'steel-pink', name: 'Steel Pink', family: 'Magenta', supportsDark: true, supportsLight: true,
+    anchors: ['#0e0408', '#1a080e', '#2e0c1a', '#9a4070', '#cc33aa'] },
+  { id: 'fuchsia-noir', name: 'Fuchsia Noir', family: 'Magenta', supportsDark: true, supportsLight: true,
+    anchors: ['#0a0610', '#14081a', '#2a0c2e', '#8a3878', '#ff1493'] },
+  { id: 'matrix', name: 'Matrix', family: 'Green', supportsDark: true, supportsLight: true,
+    anchors: ['#000a00', '#031403', '#0a200a', '#208030', '#00ff41'] },
+  { id: 'sage', name: 'Sage', family: 'Green', supportsDark: true, supportsLight: true,
+    anchors: ['#0a0e08', '#141a10', '#1e2e1a', '#7a8870', '#9caf88'] },
+  { id: 'ivory', name: 'Ivory', family: 'Light', supportsDark: false, supportsLight: true,
+    anchors: ['#fdfcf8', '#f5f2e8', '#e8e4d8', '#8a8478', '#3a3328'] },
+  { id: 'chalk', name: 'Chalk', family: 'Light', supportsDark: false, supportsLight: true,
+    anchors: ['#fafaf7', '#f0f0ec', '#e5e5e0', '#75756e', '#2a2a28'] },
+  { id: 'cobalt', name: 'Cobalt', family: 'Blue', supportsDark: true, supportsLight: true,
+    anchors: ['#020817', '#061434', '#0c2244', '#3060a0', '#0047ab'] },
+  { id: 'midnight-sapphire', name: 'Midnight Sapphire', family: 'Blue', supportsDark: true, supportsLight: true,
+    anchors: ['#02050e', '#060c1f', '#0e1a36', '#4a6088', '#1e3a8a'] },
+] as const;
+
+export const DEFAULT_THEME_ID: ThemeId = 'obsidian';
+export const DEFAULT_THEME_MODE: ThemeMode = 'dark';
+export const STORAGE_KEY = 'boocode.theme';
+
+const THEME_IDS_SET: ReadonlySet<string> = new Set(THEMES.map((t) => t.id));
+
+export function isThemeId(s: string): s is ThemeId {
+  return THEME_IDS_SET.has(s);
+}
+
+function resolvedMode(mode: ThemeMode): 'dark' | 'light' {
+  if (mode !== 'system') return mode;
+  if (typeof window === 'undefined') return 'dark';
+  return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+}
+
+// Light-only themes (ivory, chalk) can't render dark — fall back to obsidian
+// dark per spec §8 decision 1. Keeps the fallback explicit so the caller
+// doesn't accidentally apply theme-ivory.dark (which has no rule block).
+function effectiveThemeId(id: ThemeId, mode: 'dark' | 'light'): ThemeId {
+  if (mode === 'dark') {
+    const meta = THEMES.find((t) => t.id === id);
+    if (meta && !meta.supportsDark) return DEFAULT_THEME_ID;
+  }
+  return id;
+}
+
+export function applyTheme(id: ThemeId, mode: ThemeMode): void {
+  if (typeof document === 'undefined') return;
+  const resolved = resolvedMode(mode);
+  const effective = effectiveThemeId(id, resolved);
+  document.documentElement.className =
+    `theme-${effective}${resolved === 'dark' ? ' dark' : ''}`;
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify({ id, mode }));
+  } catch {
+    // quota / disabled storage — apply still succeeds, persistence falls
+    // back to the next /api/settings round-trip.
+  }
+}
+
+interface ThemeState {
+  id: ThemeId;
+  mode: ThemeMode;
+}
+
+// Module-level singleton, mirrors the useChatStatus / useSidebar pattern.
+// One shared state across every useTheme() consumer; setTheme() mutates it
+// and notifies subscribers so the App-level hook (which owns the matchMedia
+// listener) and the Settings picker stay in lockstep without prop drilling.
+function readCache(): ThemeState | null {
+  if (typeof localStorage === 'undefined') return null;
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw) as { id?: unknown; mode?: unknown };
+    if (typeof parsed.id !== 'string' || !isThemeId(parsed.id)) return null;
+    const m = parsed.mode;
+    if (m !== 'dark' && m !== 'light' && m !== 'system') return null;
+    return { id: parsed.id, mode: m };
+  } catch {
+    return null;
+  }
+}
+
+let _state: ThemeState = readCache() ?? { id: DEFAULT_THEME_ID, mode: DEFAULT_THEME_MODE };
+let _initialized = false;
+const _subscribers = new Set<(s: ThemeState) => void>();
+
+function notify(): void {
+  for (const sub of _subscribers) {
+    try {
+      sub(_state);
+    } catch {
+      // swallow — one bad subscriber shouldn't break others
+    }
+  }
+}
+
+// Optimistic update: applies immediately, PATCHes server, reverts on failure
+// so the picker can show a toast without manual state juggling. Throws on
+// failure so the caller can surface the error.
+export async function setTheme(id: ThemeId, mode: ThemeMode): Promise<void> {
+  const prev = _state;
+  _state = { id, mode };
+  applyTheme(id, mode);
+  notify();
+  try {
+    await api.settings.patch({ theme_id: id, theme_mode: mode });
+  } catch (err) {
+    _state = prev;
+    applyTheme(prev.id, prev.mode);
+    notify();
+    throw err;
+  }
+}
+
+// useTheme — mounts as many times as needed across the tree. The first mount
+// (initialized=false) triggers a single /api/settings fetch to reconcile the
+// local cache with the server. Every mount installs the matchMedia listener
+// when mode === 'system'; cleanup runs on unmount or when mode flips away.
+export function useTheme(): ThemeState {
+  const [state, setState] = useState<ThemeState>(_state);
+
+  useEffect(() => {
+    _subscribers.add(setState);
+    // Ensure the DOM reflects current state on mount — the FOUC script in
+    // index.html runs before this hook, but we re-apply in case the cache
+    // was stale relative to a fresh fetch above.
+    applyTheme(_state.id, _state.mode);
+    if (!_initialized) {
+      _initialized = true;
+      api.settings
+        .get()
+        .then((s) => {
+          const rawId = s['theme_id'];
+          const rawMode = s['theme_mode'];
+          const id =
+            typeof rawId === 'string' && isThemeId(rawId) ? rawId : DEFAULT_THEME_ID;
+          const mode: ThemeMode =
+            rawMode === 'dark' || rawMode === 'light' || rawMode === 'system'
+              ? rawMode
+              : DEFAULT_THEME_MODE;
+          _state = { id, mode };
+          applyTheme(id, mode);
+          notify();
+        })
+        .catch(() => {
+          // Settings fetch failed — keep whatever the FOUC script applied.
+          // The picker still works; PATCH will retry on next selection.
+        });
+    }
+    return () => {
+      _subscribers.delete(setState);
+    };
+  }, []);
+
+  useEffect(() => {
+    if (state.mode !== 'system') return;
+    if (typeof window === 'undefined') return;
+    const mql = window.matchMedia('(prefers-color-scheme: dark)');
+    const onChange = () => applyTheme(state.id, 'system');
+    mql.addEventListener('change', onChange);
+    return () => mql.removeEventListener('change', onChange);
+  }, [state.id, state.mode]);
+
+  return state;
+}

apps/web/src/pages/Home.tsx

@@ -1,35 +1,171 @@
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
+import { ChevronDown, ChevronRight, Folder, FolderTree, Menu, RotateCcw } from 'lucide-react';
+import { toast } from 'sonner';
 import { Button } from '@/components/ui/button';
 import { AddProjectModal } from '@/components/AddProjectModal';
+import { CreateProjectModal } from '@/components/CreateProjectModal';
+import { api } from '@/api/client';
+import type { Project } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSidebar } from '@/hooks/useSidebar';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
 
 export function Home() {
   const { data } = useSidebar();
-  const [open, setOpen] = useState(false);
+  const [addOpen, setAddOpen] = useState(false);
+  const [createOpen, setCreateOpen] = useState(false);
+  const [archived, setArchived] = useState<Project[] | null>(null);
+  const [showArchived, setShowArchived] = useState(false);
+  const { setOpen: setSidebarOpen } = useSidebarDrawer();
+  const { toggle: toggleRightRail } = useRightRailDrawer();
+  const { isMobile } = useViewport();
 
   const empty = data ? data.projects.length === 0 : false;
 
+  useEffect(() => {
+    api.projects.list({ status: 'archived' })
+      .then(setArchived)
+      .catch(() => {});
+  }, []);
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type === 'project_archived') {
+        setArchived((prev) => {
+          if (!prev) return prev;
+          if (prev.some((p) => p.id === event.project_id)) return prev;
+          const fromSidebar = data?.projects.find((p) => p.id === event.project_id);
+          if (!fromSidebar) return prev;
+          return [
+            {
+              id: fromSidebar.id,
+              name: fromSidebar.name,
+              path: fromSidebar.path,
+              added_at: new Date().toISOString(),
+              last_session_id: null,
+              status: 'archived' as const,
+              gitea_remote: fromSidebar.gitea_remote,
+              // v1.9: synthesized stub for an archived project that only the
+              // sidebar cache has — defaults match the schema NOT NULL DEFAULT
+              // values. The full row gets re-fetched on unarchive.
+              default_system_prompt: '',
+              default_web_search_enabled: false,
+            },
+            ...prev,
+          ];
+        });
+      }
+      if (event.type === 'project_unarchived') {
+        setArchived((prev) => prev ? prev.filter((p) => p.id !== event.project.id) : prev);
+      }
+      if (event.type === 'project_deleted') {
+        setArchived((prev) => prev ? prev.filter((p) => p.id !== event.project_id) : prev);
+      }
+      if (event.type === 'project_updated') {
+        setArchived((prev) =>
+          prev ? prev.map((p) => p.id === event.project_id ? { ...p, name: event.name } : p) : prev
+        );
+      }
+    });
+  }, [data]);
+
+  async function handleUnarchive(id: string) {
+    try {
+      await api.projects.unarchive(id);
+      // Server publishes project_unarchived; useUserEvents delivers it.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to restore project');
+    }
+  }
+
   return (
-    <div className="flex-1 flex items-center justify-center px-6">
-      <div className="max-w-md text-center space-y-4">
-        {empty ? (
-          <>
-            <h1 className="text-2xl font-semibold tracking-tight">No projects yet</h1>
-            <p className="text-sm text-muted-foreground">
-              Add a project from /opt to start chatting about its code.
-            </p>
-            <Button onClick={() => setOpen(true)}>Add project</Button>
-          </>
-        ) : (
-          <>
-            <h1 className="text-2xl font-semibold tracking-tight">BooCode</h1>
-            <p className="text-sm text-muted-foreground">
-              Pick a project from the sidebar.
-            </p>
-          </>
+    <div className="flex-1 flex flex-col min-h-0">
+      {isMobile && (
+        <header
+          className="border-b px-3 sm:px-4 py-2 flex items-center gap-1.5 shrink-0 text-sm"
+          style={{ paddingTop: 'max(0.5rem, env(safe-area-inset-top))' }}
+        >
+          <button
+            type="button"
+            onClick={() => setSidebarOpen(true)}
+            className="inline-flex items-center justify-center -ml-1 min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Open sidebar"
+          >
+            <Menu className="size-5" />
+          </button>
+          <button
+            type="button"
+            onClick={toggleRightRail}
+            className="inline-flex items-center justify-center -mr-1 ml-auto min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Toggle file browser"
+          >
+            <FolderTree className="size-5" />
+          </button>
+        </header>
+      )}
+      <div className="flex-1 flex flex-col items-center px-6 py-12 overflow-y-auto">
+        <div className="w-full max-w-md space-y-6">
+        <div className="text-center space-y-3">
+          {empty ? (
+            <>
+              <h1 className="text-2xl font-semibold tracking-tight">No projects yet</h1>
+              <p className="text-sm text-muted-foreground">
+                Add a project from /opt or create a new one.
+              </p>
+            </>
+          ) : (
+            <>
+              <h1 className="text-2xl font-semibold tracking-tight">BooCode</h1>
+              <p className="text-sm text-muted-foreground">
+                Pick a project from the sidebar, or add another.
+              </p>
+            </>
+          )}
+          <div className="flex gap-2 justify-center pt-2">
+            <Button variant="outline" onClick={() => setAddOpen(true)}>Add existing project</Button>
+            <Button onClick={() => setCreateOpen(true)}>Create new project</Button>
+          </div>
+        </div>
+
+        {archived && archived.length > 0 && (
+          <div className="border-t pt-6">
+            <button
+              type="button"
+              onClick={() => setShowArchived(!showArchived)}
+              className="flex items-center gap-1 text-xs font-medium text-muted-foreground mb-2 hover:text-foreground"
+            >
+              {showArchived ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+              Archived Projects ({archived.length})
+            </button>
+            {showArchived && (
+              <ul className="divide-y rounded-md border">
+                {archived.map((p) => (
+                  <li key={p.id} className="flex items-center justify-between px-3 py-2 hover:bg-muted/50">
+                    <div className="flex-1 flex items-center gap-2 min-w-0">
+                      <Folder className="size-3.5 opacity-40 shrink-0" />
+                      <span className="truncate text-sm text-muted-foreground" title={p.name}>{p.name}</span>
+                    </div>
+                    <Button
+                      variant="ghost"
+                      size="icon-sm"
+                      aria-label="Restore project"
+                      title="Restore project"
+                      onClick={() => void handleUnarchive(p.id)}
+                    >
+                      <RotateCcw size={14} />
+                    </Button>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
         )}
+        </div>
+        <AddProjectModal open={addOpen} onOpenChange={setAddOpen} onAdded={() => {}} />
+        <CreateProjectModal open={createOpen} onOpenChange={setCreateOpen} />
       </div>
-      <AddProjectModal open={open} onOpenChange={setOpen} onAdded={() => {}} />
     </div>
   );
 }