chore: land the open web UI and capability branches together

.changeset/derive-model-capabilities.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Report each model's real capabilities in the catalog. Until now `capabilities` carried only what a user had typed into their config file by hand, so for almost every model it was empty. It is now derived from the model itself when the config says nothing, while an explicit list in the config still wins. A provider whose capabilities are genuinely unknown keeps omitting the field rather than claiming the model can do nothing.

.changeset/desktop-update-toast.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Prompt for desktop updates with a toast that offers install or skip, centre the settings button in the sidebar footer, and start a new session when the sidebar brand is clicked.

.changeset/preserve-provider-ids.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep provider and model ids exactly as written when a config patch is saved, so an id containing an underscore still resolves.

.changeset/session-capability-wiring.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Make `agent_config.tools` and `agent_config.mcp_servers` reach the running agent. A session profile update now persists the selection, merges each field independently so supplying one half does not clear the other, resumes an inactive session before the mutation, and applies the result through a single `setActiveTools` call. MCP server names are turned into tool patterns with the shared naming helper, so a server whose name needs sanitizing still matches its tools.

.changeset/web-capability-menu-a11y.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Fix web capability and retry controls: the capability panel takes keyboard focus when it opens, Retry stays reachable with Tab, rapid capability toggles reach the daemon in order, and retrying a prompt keeps its attachments.

.changeset/web-capability-menu.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Add a capability menu to the composer. It picks which tools and MCP servers the current session may use, lists the session's skills, and turns plugins on or off. Each group states how far its change reaches, because the three differ: tool and MCP changes apply to this session at once, skills are read-only here, and plugin changes are global to the daemon. Selected tools and servers appear as chips beside the composer controls.

.changeset/web-composer-shell.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Widen the chat reading column to 928px and restyle the composer card: a 24px radius, a translucent blurred surface, a border that strengthens on hover and focus, and an input that grows to 384px before it scrolls. The toolbar controls are 30px circles with a divider after the attachment button.

.changeset/web-empty-suggestions.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Add starter suggestions to the empty conversation screen in the web UI. Each suggestion fills the composer for editing and does not send the message.

.changeset/web-message-actions.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Add a Retry action to the last assistant reply and a copy button to user messages in the web UI. Retry asks for confirmation, then sends the original prompt again.

.changeset/web-model-badges.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show model capabilities as badges in the model picker instead of a comma-separated string, and bring its rows and search field onto the app's row metrics, sized from `--ui-font-size` so the font-size setting still scales them. A model that reasons adaptively is now distinguishable from one that exposes an explicit thinking capability, and an unrecognised capability still renders rather than being dropped.

.changeset/web-provider-routes.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Point the web provider calls at routes that exist. Adding a provider now writes through `POST /config`, refreshing reads `GET /providers/{id}`, and a new `DELETE /providers/{provider_id}` route removes a provider together with the model aliases that referenced it.

.changeset/web-settings-tokens.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Make the web settings surface use the app design tokens: token corner radii, a theme-aware switch shadow, and control sizes that grow with the UI font size.

.changeset/web-sidebar-rows.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Quieten the sidebar session rows. Hover becomes a translucent wash instead of a solid fill, the selected row becomes a faint tint instead of a solid accent, and the radius and sizing match the shared menu row, so the row scales with the UI font-size setting. The same change is applied to the per-theme overrides, so all three themes agree.

.changeset/web-ui-primitives.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Add four shared UI primitives to the web app: `Popover`, `MenuRow`, `SwitchToggle` and `Chip`. `Popover` holds the anchored-menu positioning that each menu used to write for itself, including the flip above the trigger and the viewport clamp. `MenuRow` carries the standard list row, sized from `--ui-font-size` so the font-size setting still scales it. All four style themselves only from theme tokens, and a guard test fails on any colour literal.

apps/pythinker-web/src/App.vue

@@ -18,6 +18,7 @@ import SettingsPane from './components/settings/SettingsPane.vue';
 import SessionsDialog from './components/SessionsDialog.vue';
 import AddWorkspaceDialog from './components/AddWorkspaceDialog.vue';
 import StatusPanel from './components/StatusPanel.vue';
+import UpdateToast from './components/UpdateToast.vue';
 import WarningToasts from './components/WarningToasts.vue';
 import MobileTopBar from './components/MobileTopBar.vue';
 import MobileSwitcherSheet from './components/MobileSwitcherSheet.vue';
@@ -749,6 +750,17 @@ async function handleEditMessage(text: string): Promise<void> {
   conversationPaneRef.value?.loadComposerForEdit(text);
 }
 
+// Retry the last assistant reply: undo the exchange, then send its original
+// user prompt as a new prompt. Undo reports any failure and returns null.
+async function handleRegenerate(): Promise<void> {
+  const prompt = await client.undo(1);
+  if (prompt === null) return;
+  await client.sendPrompt(
+    prompt.text,
+    prompt.attachments.length > 0 ? prompt.attachments : undefined,
+  );
+}
+
 // Handler for slash commands emitted by Composer (via ConversationPane)
 function handleCommand(cmd: string): void {
   // `/compact <text>` carries an optional free-text instruction steering what
@@ -1090,6 +1102,7 @@ function openPr(url: string): void {
       @update-config="handleUpdateConfig($event)"
       @login="loginFromSettings"
       @open-onboarding="openOnboardingFromSettings"
+      @close="showSettings = false"
     />
 
     <ConversationPane
@@ -1167,6 +1180,7 @@ function openPr(url: string): void {
       @open-compaction="openCompactionPanel($event)"
       @open-agent="openAgentPanel($event)"
       @edit-message="handleEditMessage"
+      @regenerate="handleRegenerate"
     />
 
     <!-- Multi-workspace selection placeholder -->
@@ -1335,6 +1349,9 @@ function openPr(url: string): void {
     <!-- Floating warnings / agent errors (e.g. a 403 from the model provider) -->
     <WarningToasts :warnings="client.warnings.value" @dismiss="client.dismissWarning" />
 
+    <!-- Desktop update prompt (renders nothing in the browser) -->
+    <UpdateToast />
+
     <!-- KAP/daemon debug panel (opt-in, ?debug=1) -->
     <DebugPanel v-if="debugEnabled" />
 
@@ -1411,6 +1428,11 @@ function openPr(url: string): void {
   height: env(titlebar-area-height, 44px);
   -webkit-app-region: drag;
   user-select: none;
+  /* Windows has no vibrancy, so the bar earns its own tone: a shade darker than
+     the shell with a hairline under it, which also frames the window buttons. */
+  background: color-mix(in srgb, var(--ink) 4%, var(--panel));
+  border-bottom: 1px solid var(--line);
+  box-sizing: border-box;
 }
 .auth-page {
   flex: 1;

apps/pythinker-web/src/api/daemon/client.ts

@@ -14,6 +14,7 @@ import type {
   AppConnector,
   AppPlugin,
   AppSkill,
+  AppTool,
   AppSubagent,
   AppSessionCursor,
   AppSessionRuntimeStatus,
@@ -130,6 +131,14 @@ interface WireSkillDescriptor {
   disable_model_invocation?: boolean;
 }
 
+interface WireToolDescriptor {
+  name: string;
+  description: string;
+  input_schema: unknown;
+  source: 'builtin' | 'skill' | 'mcp';
+  mcp_server_id?: string;
+}
+
 interface WireMcpServer {
   id: string;
   name: string;
@@ -381,6 +390,8 @@ export class DaemonPythinkerWebApi implements PythinkerWebApi {
       goalObjective?: string;
       goalControl?: 'pause' | 'resume' | 'cancel';
       thinking?: string;
+      tools?: string[];
+      mcpServers?: string[];
     },
   ): Promise<AppSession> {
     const body: Record<string, unknown> = {};
@@ -394,6 +405,8 @@ export class DaemonPythinkerWebApi implements PythinkerWebApi {
     if (input.goalObjective !== undefined) agentConfig['goal_objective'] = input.goalObjective;
     if (input.goalControl !== undefined) agentConfig['goal_control'] = input.goalControl;
     if (input.thinking !== undefined) agentConfig['thinking'] = input.thinking;
+    if (input.tools !== undefined) agentConfig['tools'] = input.tools;
+    if (input.mcpServers !== undefined) agentConfig['mcp_servers'] = input.mcpServers;
     if (Object.keys(agentConfig).length > 0) body['agent_config'] = agentConfig;
     const data = await this.http.post<WireSession>(
       `/sessions/${encodeURIComponent(sessionId)}/profile`,
@@ -729,6 +742,23 @@ export class DaemonPythinkerWebApi implements PythinkerWebApi {
   }
 
   // -------------------------------------------------------------------------
+  // Tools — session-visible tool descriptors
+  // GET /tools?session_id={id} → { tools: WireToolDescriptor[] }
+  // -------------------------------------------------------------------------
+
+  async listTools(sessionId: string): Promise<AppTool[]> {
+    const data = await this.http.get<{ tools: WireToolDescriptor[] }>('/tools', {
+      session_id: sessionId,
+    });
+    return (data.tools ?? []).map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.input_schema,
+      source: tool.source,
+      mcpServerId: tool.mcp_server_id,
+    }));
+  }
+
   // Skills — session-scoped slash-invocable skills
   // GET  /sessions/{id}/skills              → { skills: WireSkillDescriptor[] }
   // POST /sessions/{id}/skills/{name}:activate body { args? } → { activated, skill_name }
@@ -1106,17 +1136,14 @@ export class DaemonPythinkerWebApi implements PythinkerWebApi {
 
   // -------------------------------------------------------------------------
   // Models + Providers
-  // PRESUMED — not in current daemon docs; isolated here, swap when backend defines them.
   // -------------------------------------------------------------------------
 
   async listModels(): Promise<AppModel[]> {
-    // PRESUMED endpoint: GET /v1/models → { items: WireModel[] }
     const data = await this.http.get<{ items: WireModel[] }>('/models');
     return data.items.map(toAppModel);
   }
 
   async listProviders(): Promise<AppProvider[]> {
-    // PRESUMED endpoint: GET /v1/providers → { items: WireProvider[] }
     const data = await this.http.get<{ items: WireProvider[] }>('/providers');
     return data.items.map(toAppProvider);
   }
@@ -1127,29 +1154,46 @@ export class DaemonPythinkerWebApi implements PythinkerWebApi {
     baseUrl?: string;
     defaultModel?: string;
   }): Promise<AppProvider> {
-    // PRESUMED endpoint: POST /v1/providers → WireProvider
-    const body: Record<string, unknown> = { type: input.type };
-    if (input.apiKey !== undefined) body['api_key'] = input.apiKey;
-    if (input.baseUrl !== undefined) body['base_url'] = input.baseUrl;
-    if (input.defaultModel !== undefined) body['default_model'] = input.defaultModel;
-    const data = await this.http.post<WireProvider>('/providers', body);
+    const providerId = input.type.replaceAll('_', '-');
+    const modelId = input.defaultModel ?? providerId;
+    const modelAlias = `${providerId}/${modelId}`.replaceAll('_', '-');
+    await this.http.post('/config', {
+      providers: {
+        [providerId]: {
+          type: input.type,
+          api_key: input.apiKey,
+          base_url: input.baseUrl,
+          default_model: input.defaultModel,
+        },
+      },
+      models: {
+        [modelAlias]: {
+          provider: providerId,
+          model: modelId,
+          max_context_size: 262_144,
+        },
+      },
+      default_model: modelAlias,
+    });
+    const data = await this.http.get<WireProvider>(
+      `/providers/${encodeURIComponent(providerId)}`,
+    );
     return toAppProvider(data);
   }
 
   async deleteProvider(id: string): Promise<{ deleted: true }> {
-    // PRESUMED endpoint: DELETE /v1/providers/{id} → { deleted: true }
     return this.http.delete<{ deleted: true }>(`/providers/${encodeURIComponent(id)}`);
   }
 
   async refreshProvider(id: string): Promise<AppProvider> {
-    // PRESUMED endpoint: POST /v1/providers/{id}:refresh → WireProvider
-    const data = await this.http.post<WireProvider>(
-      `/providers/${encodeURIComponent(id)}:refresh`,
+    const data = await this.http.get<WireProvider>(
+      `/providers/${encodeURIComponent(id)}`,
     );
     return toAppProvider(data);
   }
 
   async refreshOAuthProviderModels(): Promise<ProviderRefreshResult> {
+    // No server route or core RPC currently backs this presumed endpoint.
     const data = await this.http.post<WireProviderRefreshResult>('/providers:refresh_oauth');
     return {
       changed: data.changed.map((item) => ({

apps/pythinker-web/src/api/daemon/mappers.ts

@@ -101,6 +101,8 @@ export function toAppSession(wire: WireSession): AppSession {
     currentPromptId: wire.current_prompt_id,
     cwd: wire.metadata.cwd,
     model: wire.agent_config.model,
+    tools: wire.agent_config.tools,
+    mcpServers: wire.agent_config.mcp_servers,
     usage: toAppSessionUsage(wire.usage),
     messageCount: wire.message_count,
     lastSeq: wire.last_seq,

apps/pythinker-web/src/api/types.ts

@@ -69,6 +69,10 @@ export interface AppSession {
   currentPromptId?: string;
   cwd: string;
   model: string;
+  /** Exact tool names configured for this session, when explicitly set. */
+  tools?: string[];
+  /** MCP server ids configured for this session, when explicitly set. */
+  mcpServers?: string[];
   usage: AppSessionUsage;
   messageCount: number;
   lastSeq: number;
@@ -651,6 +655,15 @@ export interface AppConnector {
   lastError?: string;
 }
 
+/** One tool available to the current session. */
+export interface AppTool {
+  name: string;
+  description: string;
+  inputSchema: unknown;
+  source: 'builtin' | 'skill' | 'mcp';
+  mcpServerId?: string;
+}
+
 // ---------------------------------------------------------------------------
 // PythinkerWebApi — the app-facing interface
 // ---------------------------------------------------------------------------
@@ -662,7 +675,7 @@ export interface PythinkerWebApi {
   createSession(input: { title?: string; cwd?: string; model?: string; workspaceId?: string }): Promise<AppSession>;
   /** Fetch one session by id (deep links beyond the first listSessions page). */
   getSession(sessionId: string): Promise<AppSession>;
-  updateSession(sessionId: string, input: { title?: string; cwd?: string; model?: string; permissionMode?: string; planMode?: boolean; dynamicWorkflowMode?: boolean; goalObjective?: string; goalControl?: 'pause' | 'resume' | 'cancel'; thinking?: string }): Promise<AppSession>;
+  updateSession(sessionId: string, input: { title?: string; cwd?: string; model?: string; permissionMode?: string; planMode?: boolean; dynamicWorkflowMode?: boolean; goalObjective?: string; goalControl?: 'pause' | 'resume' | 'cancel'; thinking?: string; tools?: string[]; mcpServers?: string[] }): Promise<AppSession>;
   getSessionStatus(sessionId: string): Promise<AppSessionRuntimeStatus>;
   archiveSession(sessionId: string): Promise<{ archived: true }>;
   listMessages(sessionId: string, input?: PageRequest & { role?: AppMessageRole }): Promise<Page<AppMessage>>;
@@ -687,6 +700,7 @@ export interface PythinkerWebApi {
   respondQuestion(sessionId: string, questionId: string, response: QuestionResponse): Promise<{ resolved: true; resolvedAt: string }>;
   dismissQuestion(sessionId: string, questionId: string): Promise<{ dismissed: true; dismissedAt: string }>;
   listSkills(sessionId: string): Promise<AppSkill[]>;
+  listTools(sessionId: string): Promise<AppTool[]>;
   activateSkill(sessionId: string, skillName: string, args?: string): Promise<{ activated: true; skillName: string }>;
   /** Configured MCP servers — GET /mcp/servers. */
   listConnectors(): Promise<AppConnector[]>;