Backend:
- navi/auth/_ddl.py: add api_tokens table with boot-time migration
- navi/auth/deps.py: _resolve_user now falls back to X-Api-Token header
  and ?api_token query param for WebSocket auth
- navi/auth/__init__.py: add ApiToken pydantic model
- navi/api/routes/api_tokens.py: CRUD endpoints (POST/GET/DELETE)
- navi/main.py: wire api_tokens router

Frontend:
- webclient/src/App.vue: add #settings hash routing
- webclient/src/components/settings/: SettingsView, ApiKeysPanel,
  CreateKeyModal with copy-to-clipboard flow
- webclient/src/api/index.js: token CRUD API functions
- webclient/src/stores/apiTokens.js: Pinia store
- webclient/src/components/sidebar/AppSidebar.vue: settings link
- webclient/src/composables/useWebSocket.js: append ?api_token= when
  localStorage token is present

Tests:
- tests/unit/auth/test_api_tokens.py: 10 unit tests covering token
  resolution (header + query param), revoke, missing/revoked tokens,
  orphan users, and CRUD endpoints

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Backend fixes:
- stop_session now stops headless recall runs via _busy_sessions dict
- _fire_recall sets user ContextVars so tools work correctly
- MaxIterationsReached treated as success, not failure
- skip_next_recall uses GREATEST(trigger_at, now) for overdue recalls
- schedule_recall rejects past trigger times
- timezone offset double-adjustment fixed for aware datetimes
- _fire_recall registers _AgentRun for reconnect/replay support
- session_sync race with stream_start fixed

Frontend improvements:
- Recall banner moved to ChatHeader with live Cancel/Skip buttons
- Recall messages styled with is_recall flag and badge
- Real-time recall updates via WebSocket (recall_update events)
- Recall filter moved to sessions-header as toggle button
- Session list shows clock icon for sessions with pending recall
- Empty state messages for empty/filtered session lists
- Fixed missing api import in ChatHeader.vue

Tests:
- Updated scheduler_loop tests for _busy_sessions dict change

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Replace opacity-based hiding with display:none on .input-group-addon > i.
  Move spinner pseudo-element to nested &::after inside .input-group-addon
  with display:block + margin:auto for reliable centering.
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- AppSidebar: use i.ph selector + !important for spinner overlay on
  input-group-addon icon. Add transition for smooth fade.
- SessionList: simplify DynamicScroller :key to 'search'/'all' only,
  removing sessions.length to prevent scroll reset on fetchMore.
- SessionList: pass empty searchQuery when searchActive is false,
  preventing stale highlights in normal session list.
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- AppSidebar: auto-focus input when search opens via querySelector.
  Spinner icon now hides via opacity:0 instead of visibility:hidden.
- SessionsStore: add searchCache ref + restoreSearch(). Cache stores last
  search results (items, hasMore, nextOffset) so reopening search avoids
  re-fetching when query hasn't changed.
- SessionList: add :key on DynamicScroller to force recreate when switching
  between search/normal mode, fixes pinned item spacing bug.
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- AppSidebar: spinner moved inside GnSearchField input-group-addon via CSS
  (:deep .input-group-addon overlay). Removed spinner from sessions-label.
- AppSidebar: closeSearch and handleSelect now call sessionsStore.exitSearch()
  and reload normal session list, so search results disappear after selection.
  toggleSearch restores previous query and re-activates search on reopen.
- CSS msg-flash: removed animation-fill-mode:both and background-color:transparent
  from keyframes, so message bubble keeps its original background after flash.
- SessionsStore: added exitSearch() method (preserves query, disables active flag).
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- MessageList: pass isFlashing prop to UserMessage/AssistantMessage instead
  of applying msg-flash on wrapper div. scrollToMessage now uses rawIndices
  to map backend match_index to grouped message index.
- UserMessage: add isFlashing prop, apply msg-flash to msg-user-bubble
- AssistantMessage: add isFlashing prop, apply msg-flash to msg-assistant-content
- ChatStore: add rawIndices to built messages (user, summary, assistant)
- AppSidebar: move spinner into sessions-label, remove from search field
- SessionList: accept searchOpen prop, pass empty searchQuery when closed
  so highlights disappear after selecting a session
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- AppSidebar: use GnSearchField from gnexus-ui-kit, spinner during search,
  search toggle button always visible in sessions-header, hide search on select
- MessageList: fix msg-flash timing — make content visible before scrolling,
  extend flash duration to 2.5s with background + brightness
- CSS: enhance msg-flash keyframe animation
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Backend:
- GET /sessions now accepts `search` query param
- _session_summary computes match_indices and match_preview from messages
- pg_session_store: messages ILIKE added to search_list and count_all
- In-memory store: search_list also filters by message content

Frontend:
- AppSidebar: search toggle icon + debounced input, Ctrl+K shortcut
- SessionItem: highlight matching text, show match_preview from search
- SessionList: pass searchQuery to SessionItem
- SessionsStore: searchQuery/searchActive state, setSearch/clearSearch
- API layer: getSessions accepts search param
- MessageList: scroll to target message + brightness flash animation
- ChatStore: loadSession accepts targetMessageIndex, scrollToMessageIndex ref
- CSS: msg-flash keyframe animation in app.scss
- Tests updated for new getSessions signature

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

GnAvatar render function ignores default slot content; it only reads
src, icon, and initials props. Fixes broken user avatar image display.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- ProfileBadge.vue: GnBadge → GnAvatar with profile initials
- AppSidebar.vue: custom user-avatar/img → GnAvatar with image or fallback initial
- WelcomeScreen.vue: profile-icon → GnAvatar with Phosphor icon + secondary variant

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gnexus-ui-kit's iconNode() does not prepend the base `ph` class
when the icon string starts with `ph-`; it only keeps the string
as-is. All icon props must include the base class explicitly:
`icon="ph ph-sidebar"` instead of `icon="ph-sidebar"`.

Updated 15 icon bindings across 9 components.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Update vendor/gnexus-ui-kit to v0.2.0 (Vue components + composables)
- Add Vite aliases for gnexus-ui-kit/vue and gnexus-ui-kit/css
- Install GnexusUiVue plugin in main.js + GnToastProvider in App.vue
- Migrate ProfileBadge → GnBadge
- Migrate ErrorMessage → GnAlert
- Migrate ConfirmDialog → GnConfirmDialog
- Migrate raw <button> elements → GnButton / GnIconButton in:
  WelcomeScreen, LoginScreen, ChatArea, ChatHeader, AppSidebar,
  ArtifactsPanel, UserMessage, AssistantMessage, SelectionToolbar

Build and tests pass (51/51).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- filesystem.py: add edit_lines action (deterministic line ops via operations array)
           + numbered param for read (1-based line numbers in output)
           + clarify four editing modes in tool description
- chat.js: fix rating IDs for streaming messages (assign h_ ID on stream_end)
- SessionList.vue: mobile pull-to-refresh with PTR_THRESHOLD=80
- AppSidebar.vue: desktop refresh button next to Conversations header
- planning.py: knowledge source assessment in Phase 1
- debug panel: MCP servers tab + resolved tools per profile
- NAVI.md: reposition as neutral quick-reference

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Android:
- Add /admin path to shouldOpenExternally so admin links open in
  the system browser instead of the WebView.

Webclient:
- Add target="_blank" and rel="noopener noreferrer" to the admin
  link in AppSidebar.vue so it opens in a new tab.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

In sidebar-footer-actions, replace text+icon Admin and Logout buttons
with icon-only btn-icon buttons (shield-check and sign-out icons).
Add without-hover class to suppress the default icon rotation hover
animation. Keep the Login button unchanged (text + icon as before).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Backend:
- Add count_all and search_list abstract methods to SessionStore
- Implement count_all and search_list in PgSessionStore (SQL with ILIKE)
- Implement count_all and search_list in InMemorySessionStore
- Update /admin/sessions to accept limit, offset, search, sort_by, sort_order
- Return {total, limit, offset, items} from /admin/sessions

Frontend:
- Add search input for sessions in admin panel
- Add clickable sortable column headers with asc/desc toggle
- Add pagination controls (prev/next, page size selector, item count)
- Debounce search input (300ms)

Tests:
- Add integration tests for pagination, offset, search, and sorting
- All 217 tests pass

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Backend:
- User model: add avatar_url field
- auth/deps.py: extract avatar_url from auth_user.profile (picture/avatar_url)
- auth.py /auth/me: return avatar_url + computed profile_url
- config.py: add gnauth_profile_path setting
- .env.example: document GNAUTH_PROFILE_PATH

Frontend:
- AppSidebar.vue: show user avatar (or initial fallback) next to name
- Clicking user info opens gnexus-auth profile in new tab
- Rebuild dist/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- auth.py: add from typing import Annotated and from fastapi import Depends
  to fix 422 Unprocessable Content on /auth/me and /auth/logout
- AppSidebar.vue: replace btn-ghost with btn-primary for login/logout buttons

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Integrate gnexus-auth-client-py (GAuthClient) for OAuth flow, token refresh,
  and webhook parsing
- Add navi/auth/ package: User model, Fernet encryptor, client singleton,
  deps (get_current_user, require_admin, require_permission)
- New tables: navi_users, user_auth_sessions (auto-created on startup)
- Session/memory isolation by user_id with legacy NULL support
- Cookie-based auth proxy: /auth/login, /callback, /logout, /me
- Webhook receiver /webhooks/gnexus-auth handling user events, global logout,
  session revocation, role/permission changes
- Admin endpoints (/admin/*) gated by role + permissions
- Webclient auth store with isAdmin/hasPermission guards
- Admin-only profile filtering in /agents/profiles
- 200/200 tests passing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- client/ → old_webclient/ (vanilla JS client preserved as reference)
- webclient/ — new Vue 3 + Pinia webclient (source + dist build)
- vite.config.js: outDir changed to webclient/dist/
- main.py: serve /assets and /images from webclient/dist/,
  index.html from webclient/dist/index.html
- .gitignore: exclude webclient/node_modules/, include webclient/dist/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>