chore: consolidate the web UI, capability, and desktop stack

.changeset/derive-model-capabilities.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Report each model's real capabilities in the catalog. Until now `capabilities` carried only what a user had typed into their config file by hand, so for almost every model it was empty. It is now derived from the model itself when the config says nothing, while an explicit list in the config still wins. A provider whose capabilities are genuinely unknown keeps omitting the field rather than claiming the model can do nothing.

.changeset/desktop-update-toast.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Prompt for desktop updates with a toast that offers install or skip, centre the settings button in the sidebar footer, and start a new session when the sidebar brand is clicked.

.changeset/desktop-window-chrome.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Repaint the desktop chrome. The sidebar footer now carries a pill button, so Settings and the way back out of it match New Session and stay visible. The transcript reserves room for the floating work chips instead of letting them sit on the last line. Windows gets round window controls on the trailing edge, in place of the native caption buttons that could not be styled.

.changeset/pr-review-fixes.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep provider and model ids exactly as you type them, open the ChatGPT sign-in window reliably, stop a second sign-in attempt from holding the callback port, hide provider errors behind a safe message, and finish writing the event journals during shutdown.

.changeset/preserve-provider-ids.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep provider and model ids exactly as written when a config patch is saved, so an id containing an underscore still resolves.

.changeset/session-capability-wiring.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Make `agent_config.tools` and `agent_config.mcp_servers` reach the running agent. A session profile update now persists the selection, merges each field independently so supplying one half does not clear the other, resumes an inactive session before the mutation, and applies the result through a single `setActiveTools` call. MCP server names are turned into tool patterns with the shared naming helper, so a server whose name needs sanitizing still matches its tools.

.changeset/snapshot-stall.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Stop the session snapshot request from timing out on busy sessions. Each recorded event no longer pays a fresh file open and close, the watermark is read without waiting for pending writes, and the session list is scanned in parallel, so opening or refreshing a session stays fast even with a long history. This was most visible on Windows, where the per-event file cost is highest.

.changeset/web-account-section.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show the sign-in state, the provider, and the model as separate fields in the web settings account section, and label the button for what it opens.

.changeset/web-capability-menu-a11y.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Fix web capability and retry controls: the capability panel takes keyboard focus when it opens, Retry stays reachable with Tab, rapid capability toggles reach the daemon in order, and retrying a prompt keeps its attachments.

.changeset/web-capability-menu.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Add a capability menu to the composer. It picks which tools and MCP servers the current session may use, lists the session's skills, and turns plugins on or off. Each group states how far its change reaches, because the three differ: tool and MCP changes apply to this session at once, skills are read-only here, and plugin changes are global to the daemon. Selected tools and servers appear as chips beside the composer controls.

.changeset/web-codex-login.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Add OpenAI Codex sign-in to the web and desktop app. The provider dialog now offers "Sign in with ChatGPT" next to the API-key form: the server runs the OAuth exchange, writes the credentials, and reports only which model it selected. When port 1455 is taken, the dialog asks for the redirect URL instead.

.changeset/web-composer-shell.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Widen the chat reading column to 928px and restyle the composer card: a 24px radius, a translucent blurred surface, a border that strengthens on hover and focus, and an input that grows to 384px before it scrolls. The toolbar controls are 30px circles with a divider after the attachment button.

.changeset/web-connectors-menu-cleanup.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Clean up the web composer capability control: the selected tools no longer render as chips in the toolbar, the button reads "Connectors", and the menu panel stays inside the window when its content loads.

.changeset/web-empty-suggestions.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Add starter suggestions to the empty conversation screen in the web UI. Each suggestion fills the composer for editing and does not send the message.

.changeset/web-mcp-server-crud.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Add, edit, and remove your own MCP servers from the connectors page in the web UI; a new or edited server starts with your next session.

.changeset/web-message-actions.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': minor
+---
+
+Add a Retry action to the last assistant reply and a copy button to user messages in the web UI. Retry asks for confirmation, then sends the original prompt again.

.changeset/web-model-badges.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show model capabilities as badges in the model picker instead of a comma-separated string, and bring its rows and search field onto the app's row metrics, sized from `--ui-font-size` so the font-size setting still scales them. A model that reasons adaptively is now distinguishable from one that exposes an explicit thinking capability, and an unrecognised capability still renders rather than being dropped.

.changeset/web-provider-routes.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Point the web provider calls at routes that exist. Adding a provider now writes through `POST /config`, refreshing reads `GET /providers/{id}`, and a new `DELETE /providers/{provider_id}` route removes a provider together with the model aliases that referenced it.

.changeset/web-settings-tokens.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Make the web settings surface use the app design tokens: token corner radii, a theme-aware switch shadow, and control sizes that grow with the UI font size.

.changeset/web-sidebar-rows.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Quieten the sidebar session rows. Hover becomes a translucent wash instead of a solid fill, the selected row becomes a faint tint instead of a solid accent, and the radius and sizing match the shared menu row, so the row scales with the UI font-size setting. The same change is applied to the per-theme overrides, so all three themes agree.

.changeset/web-snapshot-recovery.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Recover the web and desktop app when a session snapshot request fails. It is now retried with a growing delay instead of leaving the todo list and the sub-agent list frozen until a reload, and a failed task refresh reports itself rather than failing in silence.

.changeset/web-tools-settings-page.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Move the web tool picker out of the composer menu into a Tools page in settings, where the full list fits. Every tool stays on until you turn one off, and the selection still applies to the current session only.

.changeset/web-ui-primitives.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Add four shared UI primitives to the web app: `Popover`, `MenuRow`, `SwitchToggle` and `Chip`. `Popover` holds the anchored-menu positioning that each menu used to write for itself, including the flip above the trigger and the viewport clamp. `MenuRow` carries the standard list row, sized from `--ui-font-size` so the font-size setting still scales it. All four style themselves only from theme tokens, and a guard test fails on any colour literal.

.changeset/windows-browser-url.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Open the browser on Windows through `rundll32` instead of `cmd /c start`. `cmd` cut every URL at the first `&`, so OAuth logins reached the provider with only the first query parameter and failed with an invalid authorize request.

apps/desktop/src/main.ts

@@ -249,6 +249,24 @@ ipcMain.handle('pythinker:update:install', (event) => {
   assertTrustedSender(event)
   return quitAndInstallNow()
 })
+// Windows has no native caption buttons any more, so the renderer drives the
+// window. `close()` is used rather than `destroy()` so the tray lifecycle still
+// intercepts it and only hides the window.
+ipcMain.handle('pythinker:window:minimize', (event) => {
+  assertTrustedSender(event)
+  mainWindow?.minimize()
+})
+ipcMain.handle('pythinker:window:toggle-maximize', (event) => {
+  assertTrustedSender(event)
+  const window = mainWindow
+  if (window === undefined) return
+  if (window.isMaximized()) window.unmaximize()
+  else window.maximize()
+})
+ipcMain.handle('pythinker:window:close', (event) => {
+  assertTrustedSender(event)
+  mainWindow?.close()
+})
 ipcMain.handle('pythinker:theme:set-source', (event, source: unknown) => {
   assertTrustedSender(event)
   if (source === 'dark' || source === 'light' || source === 'system') {

apps/desktop/src/preload.ts

@@ -6,6 +6,9 @@ contextBridge.exposeInMainWorld('pythinkerDesktop', {
   setAutoUpdate: (enabled: boolean) => ipcRenderer.invoke('pythinker:update:set-auto', enabled),
   checkForUpdates: () => ipcRenderer.invoke('pythinker:update:check'),
   quitAndInstall: () => ipcRenderer.invoke('pythinker:update:install'),
+  minimizeWindow: () => ipcRenderer.invoke('pythinker:window:minimize'),
+  toggleMaximizeWindow: () => ipcRenderer.invoke('pythinker:window:toggle-maximize'),
+  closeWindow: () => ipcRenderer.invoke('pythinker:window:close'),
   setThemeSource: (source: 'dark' | 'light' | 'system') =>
     ipcRenderer.invoke('pythinker:theme:set-source', source),
   onUpdateState: (cb: (state: unknown) => void) => {

apps/desktop/src/window-options.ts

@@ -14,9 +14,11 @@ export function windowAppearanceOptions(platform: NodeJS.Platform): BrowserWindo
   }
   if (platform === 'win32') {
     return {
+      // No `titleBarOverlay`: the renderer draws macOS-style round controls in
+      // the top-right instead. `thickFrame` keeps the native resize border,
+      // shadow and drag-to-snap that `frame: false` would remove.
       autoHideMenuBar: true,
       titleBarStyle: 'hidden',
-      titleBarOverlay: { color: '#00000000', symbolColor: '#7f858f', height: 44 },
       backgroundColor: '#161616',
       hasShadow: true,
       roundedCorners: true,

apps/desktop/tests/window-appearance.spec.ts

@@ -16,18 +16,22 @@ describe('desktop window appearance configuration', () => {
     expect(opts['vibrancy']).toBe('sidebar')
   })
 
-  it('keeps the Windows window configuration unchanged', () => {
+  it('leaves the Windows caption buttons to the renderer', () => {
     const opts = windowAppearanceOptions('win32')
 
     expect(opts).toMatchObject({
       autoHideMenuBar: true,
       titleBarStyle: 'hidden',
-      titleBarOverlay: { color: '#00000000', symbolColor: '#7f858f', height: 44 },
       backgroundColor: '#161616',
       hasShadow: true,
       roundedCorners: true,
       thickFrame: true,
     })
+    // The overlay would draw native caption buttons on top of the round ones
+    // the renderer paints, so it has to stay off.
+    expect('titleBarOverlay' in opts).toBe(false)
+    // `thickFrame` without `frame: false` keeps the native resize border.
+    expect('frame' in opts).toBe(false)
   })
 
   it('keeps the Linux window configuration unchanged', () => {

apps/pythinker-code/src/utils/open-url.ts

@@ -1,11 +1,30 @@
 import { execFile } from 'node:child_process';
 
+export interface OpenUrlCommand {
+  readonly command: string;
+  readonly args: readonly string[];
+}
+
+/**
+ * Windows uses `rundll32` rather than `cmd /c start` because `cmd` re-parses
+ * its arguments and cuts a URL at the first `&`, which strips every OAuth
+ * query parameter after `client_id`.
+ */
+export function openUrlCommandFor(
+  url: string,
+  platform: NodeJS.Platform = process.platform,
+): OpenUrlCommand {
+  switch (platform) {
+    case 'darwin':
+      return { command: 'open', args: [url] };
+    case 'win32':
+      return { command: 'rundll32', args: ['url.dll,FileProtocolHandler', url] };
+    default:
+      return { command: 'xdg-open', args: [url] };
+  }
+}
+
 export function openUrl(url: string): void {
-  const command: [string, string[]] =
-    process.platform === 'darwin'
-      ? ['open', [url]]
-      : process.platform === 'win32'
-        ? ['cmd', ['/c', 'start', '', url]]
-        : ['xdg-open', [url]];
-  execFile(command[0], command[1], () => {});
+  const { command, args } = openUrlCommandFor(url);
+  execFile(command, [...args], () => {});
 }

apps/pythinker-code/test/utils/open-url.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { openUrlCommandFor } from '#/utils/open-url';
+
+const oauthUrl =
+  'https://auth.openai.com/oauth/authorize?client_id=app_test&redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback&state=state';
+
+describe('openUrlCommandFor', () => {
+  it('passes the complete OAuth URL to the Windows URL handler', () => {
+    expect(openUrlCommandFor(oauthUrl, 'win32')).toEqual({
+      command: 'rundll32',
+      args: ['url.dll,FileProtocolHandler', oauthUrl],
+    });
+  });
+
+  it('uses the native opener on macOS', () => {
+    expect(openUrlCommandFor(oauthUrl, 'darwin')).toEqual({
+      command: 'open',
+      args: [oauthUrl],
+    });
+  });
+
+  it('uses xdg-open on Linux', () => {
+    expect(openUrlCommandFor(oauthUrl, 'linux')).toEqual({
+      command: 'xdg-open',
+      args: [oauthUrl],
+    });
+  });
+});