mcp: a dead MCP endpoint no longer kills server startup ...

A failed transport connect inside the MCP SDK's anyio cancel scopes
surfaces as CancelledError without any task.cancel(). The runner mistook
that for a real teardown, cancelled the in-flight caller's future, and
McpManager.load_all (which only catches Exception) let it blow up the
whole lifespan startup — one unreachable server in mcp_servers.d/ meant
a dead Navi.

The runner now distinguishes real task cancellation
(asyncio.current_task().cancelling()) from the anyio artifact: the
latter is surfaced to the caller as a normal connect failure, the
server pool marks it disconnected and the health-check loop retries.
Also, when the runner dies for any reason, pending queue commands are
failed instead of leaving _send callers hanging forever.

compress: route every trigger path through compress_and_save_session ...

- CompressionWorker keeps the real-token gate (ctx.context_tokens) but now
  delegates to compress_and_save_session(reason="postturn") — it used to
  call compress_context directly with its own save logic and silently
  no-op'ed on any summarizer failure, leaving the session over the
  threshold until the next turn's gates
- pre-turn and /compact gates use real_baseline_estimate instead of the
  chars//3 heuristic (mid-turn already did), so code-heavy contexts
  compress in time instead of tripping ContextTooLargeError
- summarizer input keeps head + tail instead of head-only truncation,
  which silently dropped the newest summarized messages closest to the
  keep window
- critical tool results over the 4000-char budget keep head+tail halves
  instead of collapsing to the 800-char non-critical preview (a 3999-char
  read survived whole, a 4001-char one lost 98%)
- images count 500 tokens each, not 500 per message carrying them
- _plan_compression is the single partition decision shared by
  compress_context and would_compress, so the dry-run prediction cannot
  drift from the real path; the trigger reason is now logged
  (preturn/midturn/postturn/forced)

profiles: retire gate flags and retrain prompts for the plan tool ...

- drop planning_enabled / planning_mandatory / planning_phase2_enabled /
  observe_skips_plan_enabled / adaptive_replan_enabled from AgentProfile,
  the loader and admin serialization
- add `plan` to native tools of developer, navi_code, tool_developer,
  secretary, server_admin, modeler_3d — without the gate they would
  otherwise lose planning entirely
- system prompts: call plan for non-trivial multi-step work before
  execution; complex plans get presented for confirmation; stuck or goal
  changed -> plan with a reason

planning: replace the mandatory pre-turn gate with an agent-invoked plan tool ...

- Phase 2 (critique) retired; observe/MODE and the top-level DIRECT shortcut
  removed (sub-agents keep DIRECT for trivial subtasks)
- replan merged into plan: `reason` (+ updated_goal) packs the re-plan
  context, without a reason it is fresh planning
- both phases call the LLM with think=False — cloud reasoning models leak
  their chain-of-thought into structured output on non-streaming calls —
  and strip the gemma "thought<channel|>" content artifact
- Phase 1 conversation windowed to ~20k chars, newest-first with the
  original task pinned (28.7k-token prompts came back as 1-token output)
- confirmation by COMPLEXITY: the tool result tells the agent to present
  complex plans and wait; sub-agents keep the execute-now injection
- PlanningStatus/PlanReady reach the UI mid-turn via current_event_sink
  (ctx.event_sink is None in the agent loop — events silently never
  reached the WS before)
- agent gate, casual-message detector and adaptive re-plan nudges removed;
  anti_stall keeps only stall detection

tests: fake_run_agent accepts hidden kwarg (merged navi_ui form_submit path)

Merge branch 'master' into feature/navi-code ...

# Conflicts:
#	navi/api/websocket.py
#	navi/config.py
#	navi/core/agent.py
#	navi/core/orchestrator.py
#	navi/main.py

security: critical batch 1 — RCE/XSS/CORS/webhook hardening ...

Backend:
- auth/deps: fix refresh-lock clock race (cleanup now monotonic like the cache)
- core/registry: add missing structlog logger (NameError on fallback path)
- config: GNAUTH_WEBHOOK_SECRET, NAVI_ALLOWED_ORIGINS (+list property)
- webhooks: HMAC-SHA256 signature verification (503 unconfigured in auth mode,
  unsigned+warning in no-auth mode, 403 bad/stale signature, 400 bad JSON)
- main: CORS from NAVI_ALLOWED_ORIGINS in auth mode (fail-fast on empty),
  eval router behind require_admin, /debug only registered in no-auth mode
- auth routes: mobile-done sid validation (32 hex) + CSP header + safe JS
  escaping (reflected XSS); Secure cookie flag via helper (https base URL)
- websocket: anonymous WS rejected in auth mode (closes legacy-session RCE);
  socket registered only after access checks; stop_session auth gate
- messages: REST agent start now takes session lock + busy flag (409 on
  active run), contextvars reset in finally

Webclient:
- useMarkdown: DOMPurify.sanitize on all rendered markdown (stored XSS),
  image-URL scheme whitelist, delegated error listener (no inline onerror)
- html.html artifact viewer: sandbox without allow-same-origin (opaque origin)
- tests: DOMPurify runs under jsdom (happy-dom Node.prototype.nodeName getter
  breaks DOMPurify); useWebSocket tests get localStorage stub + ui-kit alias

Tests: pytest 1049 passed, 1 skipped; vitest 61 passed

tui: dedicated code_exec renderer — highlighted code + structured result ...

code_exec went through the generic tool renderer: the whole script was dumped
as an escaped JSON string (unreadable), and the result was a dim wall of text
with stdout/stderr fused by a [stderr] marker. Give it a first-class card:

started: Python syntax highlighting via the shared highlight_code (follows
Theme.code_theme), long scripts folded at 60 lines, working_dir/timeout shown
as compact key/values instead of JSON bulk.

result: exit code anchored in the title (exit N), stdout and stderr split into
separate blocks with stderr in the warning colour, and a dedicated "timeout Ns"
status (detected from metadata or, for legacy sessions, the output text).
Registered before the generic tool renderers (first accepting wins).

code_exec: agent-controlled timeout (30s default, 300s max) + language metadata ...

The 30s timeout was a hard constant; long computations or test suites hit it
with no escape hatch. Expose it as a `timeout` param (clamped 1-300s, default
30) like terminal's. Also stamp `language: "python"` into metadata so the
TUI renderer can highlight without hard-coding, and record `timeout` on the
timeout result for a dedicated timeout status card.

tui: lower default visible chat window 200->60 (faster long-session resume) ...

The cold cost is dominated by the one-shot mount of the whole visible
window at load/switch time. 200 _ChatItemView widgets each parse Markdown,
build Content, compute height and run layout in one pass. 60 cuts that
peak ~3.3x with no loss for streaming (signature cache + throttle + render
cache keep per-token cost O(1) once mounted). Model cap (max_visible_items
* 3) follows automatically: 600 -> 180. Older items collapse into the
existing "... N earlier messages not shown" hint.

compress: raise budget 6000 + richer prompt detail + input headroom ...

Increase the compression summary budget and push the prompt toward more
detail and completeness, so the agent keeps more durable facts when old turns
are folded into a summary.

Budget (output):
- context_summary_max_tokens 4000 → 6000 (global default).
- navi_code compression_max_tokens 4000 → 6000 (profile override).

Prompt (base, all profiles):
- New 'Intermediate Findings' section: durable facts from read/grep/log/terminal
  that informed decisions (was forbidden by 'do not preserve intermediate
  reasoning'). Existing sections get richer instructions (Active Files: key
  symbol affected; Decisions: rationale + trigger; Completed: step + file +
  verification outcome; Errors: snippet + what was tried + outcome).
- Loosen 'tight bullet points' → 'specific and complete; prefer listing over
  generalizing — losing a fact costs more than a longer summary'.
- 'Do not write implementation code' → 'preserve short critical code verbatim
  (final signatures, one-line fixes, key config lines); drop long blocks'.

Input headroom (so the summarizer can SEE what it must preserve):
- Non-critical tool result preview 300 → 800 chars.
- _MAX_SUMMARY_INPUT_CHARS 24000 → 32000 (fits 65k–128k windows with 6k output).

Profile prompt (navi_code/compression_prompt.txt): preserve short diagnostic
snippets verbatim (exact error line, failing assertion, one-line fix) instead
of blanket 'do not preserve long output'; keep code signatures + short key
snippets, not just names.

Tests: Intermediate Findings section in base prompt; 'short critical code'
phrasing; non-critical preview keeps 800 chars; meta-summary threshold raised
(2×6000 chars). Fixed flaky test_attach_session_seeds_context_fill (relied on
_startup worker timing after Etap 4 lengthened attach; now explicit attach
like its sibling + mock get_todos to skip a 30s×2 real-network timeout).
Full suite: 1008 passed, 1 skipped.

todo: add op — append steps discovered mid-task (preserve statuses) ...

The todo tool only had set/view/update/clear. Adding a step that surfaced
mid-task meant either 'set' (which replaces the plan and resets every status
to pending) or 'replan' (1–3 LLM calls) — both heavy for a single new step, so
the agent usually skipped recording it. Add a cheap 'add' op:

- navi/tools/todo.py: op 'add' (tasks: list[str]) appends new _Task entries to
  the end of the existing plan in pending status; existing steps and their
  statuses are untouched. Requires an existing plan (points to 'set'
  otherwise). Schema enum + op description + tool description updated.
- system_prompt.txt: tell the agent to record new subtasks with 'todo add'
  right away (not held in head, not a replan); clarify the 'small todo edit'
  line — add via 'todo add', drop/merge/reorder via 'set' (re-apply statuses).
- renderers/todo.py: TodoStartedRenderer renders the add card
  ('→ todo · add (N)') listing the new pending steps, not a JSON dump.

Tests: add appends + preserves statuses / requires existing plan / requires
tasks; renderer add card + empty-tasks. Full suite: 1005 passed, 1 skipped.

tui: terminals picker — clearer two-line rows + Delete to close ...

- Each terminal row is now two lines: the name (bold, with status icon) on
  top, the description + pid + uptime as a dim meta line beneath, separated
  by '·' — easier to scan than a single run-on line.
- Close is bound to Delete/Backspace instead of Enter: Enter commonly means
  "open/select", Delete means "remove/close", which matches closing a
  terminal. Title updated: "Open terminals — Delete to close, Esc to cancel".
  No-op on an empty list.

Tests: close-on-delete (was close-on-enter), empty-list delete is a no-op.
Full suite: 1000 passed, 1 skipped.

tui: terminal tool_started renderer (action-aware card) ...

terminal tool_started cards used to fall through to the generic
ToolStartedRenderer (a raw JSON dump of the args — a wall of quoted strings for
a command or input). Add an action-aware started renderer, mirroring the result
renderer and the filesystem started renderer:

- Title: → terminal <action>.
- run: the command as a shell prompt in accent (the headline) + optional cwd.
- open: terminal name (accent) + description + background + command preview.
- close/status: terminal name. send_input: name + input preview.
- list: empty body (no per-call headline; the result card carries the table).

Registered before ToolStartedRenderer (first accepting wins).

Tests: started accepts gating + run/open/close/send_input/list cards;
render_plain covers the borderless reading-mode path. Full suite: 1000 passed,
1 skipped.

tui: /terminals command + modal to view and force-close terminals (Etap 5) ...

The final piece of the terminals plan: a modal to list the session's open
persistent terminals and force-close one.

- screens/terminals_picker.py: a modal (mirror of sessions_picker). Seeds the
  list from api.list_terminals on open, kept live by refresh_from_model — the
  app calls it as terminal_opened/closed events arrive while the modal is open
  (closed ones drop out, newly opened append). Each row shows status emoji +
  name (bold) + description + pid + uptime. Up/Down navigate, Enter force-closes
  the highlighted terminal via api.close_terminal (in a worker), Escape cancels.
  Empty list is a no-op for Enter (no crash, no close call).
- commands/builtin.py: TerminalsCommand (/terminals) opens the picker for the
  active session. Registered in the command registry.
- tui_app._open_terminals_picker pushes the screen; on_ws_event's terminal
  branch now also refreshes the picker live if it is the active screen.

Tests: list seed, Enter closes the highlighted terminal (api.close_terminal
called, drops from list), Escape cancels (dismiss None), live refresh filters
closed + adds opened, empty list Enter is a no-op. Input-box hint tests
adjusted for the new /t match order (terminals, thinking, themes). Full suite:
993 passed, 1 skipped.

Plan docs/terminal_tool_plan.md — Etap 5 of 5 (complete).

tui: handle terminal lifecycle events + status-bar count (Etap 4) ...

terminal_opened/output/closed WS events used to fall through to ChatModel's
unknown-event path (raw dict dumped into chat). Now they feed a dedicated
terminals state and a status-bar count, with no chat bubble:

- ChatModel: terminals dict (name → {description, pid, background, status,
  output_tail, closed}) updated by terminal_opened/output/closed in
  handle_ws_event (return None — no chat item). open_terminal_count property;
  seed_terminals(summaries) populates from a REST list (on attach). output_tail
  capped at 200 lines.
- tui_app.on_ws_event: a terminal-events branch forwards to the model (no _sync
  walk — background output can be frequent) and updates the StatusPanel count.
  attach_session seeds via api.list_terminals and sets the count (graceful 0 on
  failure).
- StatusPanel: the "Ctrl+P palette | /help commands" hint line is replaced with
  a live "Terminals: N" count (set_terminals_count). Key combos still live in
  the bottom StatusBar.
- Tests: mock_tui_api fixtures across 5 client test files gain an async
  fake_list_terminals so attach_session never hits a real network in tests.

Tests: ChatModel opened tracks state (no bubble) / output appends tail / unknown
ignored / closed decrements count / seed from REST; tui_app terminal events
update the status count with no chat bubble. Full suite: 988 passed, 1 skipped.

Plan: docs/terminal_tool_plan.md — Etap 4 of 5.

tui: terminal tool-call renderer (action-aware) (Etap 3) ...

terminal tool_call results used to fall through to the generic
ToolResultRenderer (flat Text, no awareness of the action). Add an
action-aware renderer registered before the generic one, mirroring filesystem:

- run: command echoed as a shell prompt + dim output + an exit-code anchor
  (green on 0, red otherwise). A failed run still shows what ran and the exit
  code, not just the raw error.
- open: terminal name (accent) + description + background flag + pid.
- list / status: dim, truncated (200-line cap like the generic tool renderer).
- send_input / close: dim echo. open failure surfaces the reason (already
  exists / max reached). Other action failures show the message in red.

Registered before ToolResultRenderer in default_registry (first accepting
renderer wins). ChatPanel._item_msg already spreads the WS payload into meta,
so the renderer reads args/result/success/metadata directly.

Tests: accepts gating, run success/failure with exit code, open name/desc/pid,
list/status/send_input/close, run truncation; render_plain covers the
borderless reading-mode path. Full suite: 982 passed, 1 skipped.

Plan: docs/terminal_tool_plan.md — Etap 3 of 5.

terminal: REST list/close endpoints + async client helpers (Etap 2) ...

The /terminals modal and the status-bar count need a server source for the
session's persistent terminals (background dev servers, etc.) and a way to
force-close one. Add REST endpoints over the existing TerminalManager:

- GET /sessions/{id}/terminals → terminal_manager.list(session_id) →
  {session_id, terminals: [summary,...]}. Access-checked (navi.sessions.read_all).
- POST /sessions/{id}/terminals/{name}/close → terminal_manager.close(...)
  → {session_id, terminal_name, closed: bool}. Name is URL-encoded by the
  client (terminal names may contain spaces).
- clients/terminal/api.py (async): list_terminals(session_id),
  close_terminal(session_id, name) — for the TUI modal + status-bar seed.

Tests: list empty / list returns active / close routes to manager / 404 on
unknown session (fake TerminalManager injected into the container, mirroring the
kv_store injection pattern). Full suite: 972 passed, 1 skipped.

Plan: docs/terminal_tool_plan.md — Etap 2 of 5.

terminal: session-broadcast sink + lifecycle events (Etap 1) ...

Persistent terminals emitted their stream only into a per-tool-call sink, which
closed once the open action returned — so a background dev server's output
stopped reaching the client immediately after open. TerminalClosed was never
emitted at all (the handler existed, the emitter did not).

Replace the per-tool event_sink with a single callback the orchestrator wires to
the session's WebSocket(s):

- TerminalManager: set_event_callback(cb) + _emit(session_id, event). Reader
  tasks and open/close deliver TerminalOutputDelta / TerminalOpened /
  TerminalClosed through the callback, which lives for the terminal's (and
  session's) lifetime — not the tool call's.
- New TerminalOpened event (terminal_opened: name/description/pid/background).
  TerminalClosed now actually emitted from _close_one (explicit/idle/shutdown/
  session_ended). Background output keeps streaming after open returns.
- terminal.py: drop the per-tool event_sink from _tm.open (no longer needed).
- orchestrator._on_terminal_event → _notify_session (per-session WS fan-out,
  same path recall/mcp updates use). container wires the callback after building
  the orchestrator.
- Events imported lazily inside terminal_manager methods to avoid a circular
  import (navi.core.events → navi.core.__init__ → agent → registry → navi.tools).

Tests: open emits TerminalOpened; background output streams via the callback
after open returns (gap-3 fix); close emits TerminalClosed; no callback does not
break readers. Existing terminal tests unchanged. Full suite: 968 passed, 1 skipped.

Plan: docs/terminal_tool_plan.md (5 etaps, this is Etap 1).

tui: bash-style message history (Up/Down recall, per-session, in-memory) ...

On an empty prompt with the hints list closed, Up recalls the previous
submitted message and Down moves toward the most recent; Down past the newest
restores the empty draft. Like a shell history:

- InputBox owns the per-session history (capped at the 10 most recent, with
  consecutive-duplicate suppression) plus the browsing index and saved draft.
- _PromptInput._on_key enters history mode on Up only when the field is empty
  and the hints list is not open; while hints are open Up/Down still navigate
  command matches, and a non-empty field uses TextArea's multiline cursor.
- Only plain user messages are recorded — slash commands and !shell are not
  remembered (they are not messages to the agent). The raw typed text is stored.
- on_user_submitted records a plain submit; attach_session resets the history
  on session switch/resume (the history is in-memory per session, not synced
  to the server, by design).

Tests: append cap/dedup/skip-commands, up/down navigation, reset, Up-recall /
Down-draft / Up-non-empty-no-recall over pilot, submit records plain (not
/commands). Full suite: 964 passed, 1 skipped.

tui: minor correctness/perf fixes (Etap 5) ...

The last batch from the code review — real bugs and edge cases, not cosmetics:

- tui_app._resolve_session: read session_id with .get and return None when a
  malformed server response omits it, instead of KeyError slipping past the
  api-call except (5.B3).
- cli /switch: surface the original error cause (404 vs network vs server) on
  a non-unique prefix match instead of swallowing it into a generic "not found"
  (6.B2).
- input_box _complete_command: a bare "/" with no hint list available no longer
  auto-picks the first command in the registry (3.B3).
- filesystem _render_grep: when the grep ran in regex mode, highlight with the
  actual regex so marked spans match what the server found — a literal highlight
  of a regex pattern would mark nothing (2.B2).
- file_refs _collect_files: filter sensitive entries out in the generator before
  sorted() so a huge directory is not fully materialized only to be mostly
  discarded (5.P1).
- renderers/tool ToolResultRenderer: cap a generic tool result at 200 lines
  (tail + marker) so a non-filesystem tool with huge output does not flood the
  chat bubble — filesystem has its own renderer (2.P3).

Tests: malformed-response /switch error surfacing, bare-slash no-auto-pick,
grep regex highlight, sensitive-subdir skip, tool-result truncation. Full
suite: 953 passed, 1 skipped.

tui: theme repaцвет chat + bounded history + tail purge (Etap 4) ...

- apply_theme now re-renders already-drawn chat bubbles in the new palette:
  ChatPanel.refresh_content() rebuilds each visible item's rich renderable (the
  item renderers read get_active_theme(), already switched) and drops the
  per-widget Content/height caches so the next paint rebuilds instead of
  returning the old-theme cached Content. Theme switch / live preview no longer
  leaves the conversation in the previous palette (5.B1).
- theme_picker live preview is debounced (~100 ms coalesce via set_timer):
  apply_theme now re-renders every bubble, so applying it on every highlight
  while scrolling the theme list would stutter — rapid moves collapse into one
  apply, with the freshest theme winning. Escape/cancel dismiss the pending
  timer so it cannot fire after a restore and re-apply the highlighted theme
  over the restored one (4.P2).
- ChatModel.items is now bounded: a cap (visible window * 3) trims the oldest
  items off the front via a single _append/_trim path, so a long autonomous
  session no longer grows items without limit. The visible window is much
  smaller than the cap, so trimming only drops already-off-screen items and the
  truncation hint still reads correctly (3.P3).
- stream_end purges empty assistant/thinking bubbles off the tail (while-pop)
  instead of a full-history list-comprehension copy — empty bubbles are created
  at the end of the turn, so O(tail) suffices (1.P1).

Tests: apply_theme re-renders bubbles; theme picker debounces + escape cancels;
chat_model cap trims front / cap=None keeps everything; stream_end keeps
non-empty assistant + purges trailing empty thinking. Full suite: 946 passed, 1 skipped.

tui: async REST api client — stop blocking the event loop (Etap 3) ...

The terminal client's REST helpers were synchronous (httpx.Client); every
caller inside the Textual event loop (attach/switch/resume/profile/stop) blocked
the whole TUI for the duration of each network round-trip — the spinner froze,
input stopped responding, the screen did not repaint. Move the network layer to
async and a shared pooled client:

- api.py: all 7 helpers are now `async def` over a single lazily-created
  httpx.AsyncClient (connection pooling) — awaits yield the loop while a request
  is in flight, so the TUI never blocks on the network.
- tui_app.py + commands/builtin.py: every `api.*` call site is now `await`-ed
  (all already ran in async workers / execute). _stop_stream_worker drops the
  dead `iscoroutine` check (api.stop_session is async, the await is real).
- cli.py: _resolve_session_id and _handle_command await api.*; _run_raw wraps
  the resolve + run in asyncio.run(_run_raw_async) so the sync click entrypoint
  stays unchanged. Removed the now-unused _run_one_shot wrapper.
- sessions_picker.on_mount: list_sessions runs in a worker (run_worker) instead
  of blocking on_mount — a slow/unreachable backend no longer hangs the modal;
  the input is focusable immediately and the list populates when the request
  returns.

Tests: every api mock across 6 client test files is now an `async def` fake
(test_tui_app, test_chat_panel, test_sessions_picker, test_terminal_client,
test_tui_export, test_input_box); the sessions picker tests use an async
_raise_not_found helper for the 404 path. Full suite: 939 passed, 1 skipped.

tui: throttle streaming markdown rebuild + cache height (Etap 2) ...

The assistant bubble re-parsed rich Markdown on every stream_delta and rich-rendered it
twice per delta (once to paint, once to measure height) — O(N^2) over the answer length.
Fix the cost while keeping live markdown formatting:

- _ChatItemView.maybe_update now throttles assistant_message rebuilds to ~one per 150 ms
  (coalesced via set_timer). The ChatItem content still updates per delta; only the
  Markdown parse + rich render is deferred. Plain renderables (thinking/planning are
  Text) bypass the throttle — they are cheap. The first mutating delta rebuilds
  immediately for a snappy start; rapid bursts coalesce.
- get_content_height is cached by (renderable identity, width) so the layout pass no
  longer re-renders the rich renderable to measure it between throttled rebuilds.
- stream_end flushes any pending throttled rebuild so the final chunk of streamed text
  appears immediately instead of after the throttle window.
- A deferred rebuild re-anchors scroll to the bottom (via ChatPanel._stick_to_bottom)
  so the freshly rendered streaming text stays in view after its height grows.
- ThemedMarkdownRenderable.__rich_console__ now streams segments straight through
  instead of materializing them into a list first (no per-paint O(N) allocation +
  double walk); the link rewrite is inline in the loop.

Tests: adapted test_per_token_refresh_renders_only_the_streaming_item to the throttled
semantics (a burst yields a couple of rebuilds, not one per token, all for the assistant
item); added throttle-coalesces and stream_end-flushes tests. Full suite: 939 passed, 1 skipped.

tui: code-review Etap 1 — crash/injection/reconnect fixes + drop artifact renderer ...

Point fixes from the full TUI/terminal-client code review (docs/code_review_tui.md),
each with a covering test:

- command_palette: guard on_list_view_selected against IndexError when the
  filter is empty and the placeholder row is selected.
- cli /profile: read session_id (not the absent "id") from the server — the
  handler no longer KeyErrors.
- todo_list: escape task text/validation/index/milestone before interpolating
  into rich markup so a task like "fix [bug]" no longer breaks the line styling.
- builtin /help: drop bold markup tags from status content — StatusRenderer
  builds a literal Text() that would show the tags as literal square brackets.
- tui_app on_user_submitted: always enqueue when a bridge exists (the input loop
  buffers across reconnect) instead of dropping the message on connected=False.
- chat_model stream_start: also reset _current_thinking so a dropped turn (no
  thinking_end) does not glue the next turn's reasoning onto the old block.
- todo renderer update: coerce validation to str before .strip() so a non-string
  JSON value does not AttributeError.
- renderers: remove the unused ArtifactRenderer (no production path emits
  type=artifact — TUI shows files via the OS); keep the diff renderer test.

Full suite: 937 passed, 1 skipped.

tui: unify syntax highlighting under Theme.code_theme; highlight filesystem read output ...

All syntax-highlighted code in the TUI now resolves one Pygments style per
theme from a single point: Theme.code_theme (gnexus-dark=dracula,
gnexus-light=paraiso-light). Previously the dracula/github-light name was
duplicated in artifact.py and markdown_content.py, and the light theme's
"github-light" is not a real Pygments style (only github-dark exists), so
rich silently fell back to "default" and light-mode code was never
highlighted — fixed by switching to paraiso-light.

New renderers/syntax.py::highlight_code() is the shared Syntax factory
(always theme.code_theme + background_color=theme.surface.hex); artifact.py
and the new filesystem read path build through it, and
_theme_aware_code_theme now reads Theme.code_theme via ThemeRegistry.

filesystem FilesystemToolResultRenderer._render_read: the file body is now
syntax-highlighted via highlight_code with the language guessed from the
read path (guess_language). The server's "{num:>width}: {line}" prefix is
stripped (_strip_number_prefix) so Syntax renders its own line-number column
and multi-line constructs (triple-quoted strings, block comments) highlight
correctly across line boundaries; numbered=False renders without numbers.
The header plaque (accent path) and the large-file warning stay as Text;
body is Group(header, [warning,] Text, Syntax). Unknown extensions fall back
to the "text" lexer (plain).

Diff content keeps marker-only coloring (combining Pygments token styles
with the +/- tint is non-trivial); grep/list/info/find unchanged.

Tests: tests/clients/test_code_theme.py pins the single-point contract
(markdown/artifact/read all resolve theme.code_theme, dark != light);
test_filesystem_renderer read tests rewritten for the Group+Syntax body,
plus language-guess and numbered=False coverage. Full suite: 932 passed.

mcp: dedicated runner task per client (fix cross-task cancel-scope on shutdown) ...

MCP client SDK transports (stdio/sse/streamable_http) + ClientSession are
anyio task groups whose cancel scopes require __aenter__/__aexit__ in the
SAME asyncio task. McpClient entered the transport in one task (lifespan
connect / health-check reconnect / request retry) and exited it in another
(lifespan teardown) -> RuntimeError: Attempted to exit cancel scope in a
different task than it was entered in.

Refactor McpClient to own a single long-running runner task that holds the
AsyncExitStack and performs ALL transport enter/exit + list_tools/call_tool.
The public async API (connect/disconnect/list_tools/call_tool/mark_disconnected)
just enqueues a _Cmd and awaits a Future, so callers from any task no longer
cross cancel-scope boundaries. connected/instructions mirror from the runner
onto the instance to stay sync-readable. disconnect() enqueues a stop command
and awaits shield(runner) so teardown isn't interrupted by lifespan cancel.

Also call mcp_manager.stop_health_check() BEFORE disconnect_all() in
AppContainer.shutdown() so the health-check task cannot enqueue onto a
client whose runner is being torn down. mark_disconnected() is now async
(queued) and its manager caller updated.

Regression test: connect in one task, list_tools in a second, disconnect in
a third — the exact scenario that raised the RuntimeError before.

tui: copy chat to system clipboard via reading mode + selection fixes ...

Two ways to copy chat content out of the TUI now work:

1. In-app selection (Ctrl+C, OSC 52): _ChatItemView.render() now builds a
   selection-aware Content from the rich renderable instead of letting Static
   wrap a Panel into a non-selection-aware RichVisual — so the magenta
   drag-select highlight actually renders and get_selection returns clean,
   chrome-free text. rich Segment styles are converted to Textual Style
   (Style.from_rich_style) so the selection_style merge doesn't crash, and
   None segment styles are guarded. get_content_height is overridden to
   compute auto-height straight from the rich renderable; without it the
   width-keyed Content churned new Visual objects per width change and spread
   the layout-settling cascade across refreshes, leaving a deferred scroll_end
   at an intermediate max_scroll_y (chat no longer stuck to bottom). Theme
   defines screen-selection-background/foreground so the highlight is visible.

2. Reading mode (Ctrl+R) for terminals without OSC 52 (e.g. GNOME Console,
   TERM_PROGRAM=kgx, which silently ignores OSC 52 so Ctrl+C never reaches the
   OS clipboard). Toggling the app's reading-mode class hides the chrome around
   the chat (right status/todo column, input prompt, status bar, chat outer
   border) and re-renders every message without its Panel borders via the
   registry's new render_plain — so Shift+drag + Ctrl+Shift+C copies just the
   conversation text to the system clipboard. ContentRenderer.render_plain
   defaults to unwrapping Panel/Padding(Panel) to its body; assistant messages
   and plan_ready override it to raw Text(content) so rich Markdown doesn't
   re-wrap fenced code blocks in their own bordered Panels. ChatPanel tracks
   reading mode and re-renders visible widgets in place (scroll preserved);
   new streamed items pick up the mode on mount.

Help (/help) now lists keys and documents both copy paths.

Tests: render_plain parametrized across all item types, message renderer
plain tests, chat panel reading-mode toggle (borders off/on, scroll kept,
new items borderless), tui_app reading-mode chrome hide, plus the existing
selection suite. Full suite green (922 passed, 1 skipped).

tui: make chat content selectable/copyable without bubble chrome ...

Chat items render rich Panels (rounded borders + Navi/You titles), but the
base Widget.get_selection only extracts text from widgets whose render is
Text/Content -- Panels return None, so a drag-select over a message or tool
output copied nothing (the highlight showed the borders, but Ctrl+C yielded
no message content).

Override _ChatItemView.get_selection: re-render the item's renderable via
the app console at the widget width (line layout identical to the screen),
strip the outer panel border lines and the │ / │ gutters, and remap the
mouse offsets onto the clean content so a partial-line selection lands on
the right characters. Plain renderables (status, turn_meta, filesystem tool
output) have no chrome and map 1:1. Ctrl+C (Screen.copy_text) then copies
the clean text via OSC 52.

tui: restore tool args/metadata, assistant-then-tool order, turn_meta on resume ...

ChatModel.load_history rebuilds the resumed session so the chat renders the
same way as a live turn:

- Recover tool-call args via tool_call_id (the persisted tool message stores
  only the result, not the call args) and forward the stored metadata. Without
  this the filesystem renderer saw args={} -> action=None and fell back to a
  plain, un-highlighted result -- the resume "no syntax highlighting" symptom.
- Emit assistant_message BEFORE tool_started when an assistant message has both
  text and tool_calls, matching the live stream where stream_delta precedes
  tool_started; previously the answer was stranded under its own tool cards.
- Append a turn_meta item when the persisted assistant message carries
  elapsed_seconds, reproducing the single duration line stream_end appends.

is_subagent for resumed tool calls is intentionally deferred (needs storage).