@xingjisoft/neutrino 0.4.1 → 0.5.1

package/dist/ui.js

@@ -295,35 +295,51 @@ export function drawTabButton(buf, x, y, w, label, selected, align = "center") {
 }
 /** Label of the CLI entry point that opens the browser console's Pro workspace. */
 export const PRO_MODE_LABEL = "启用Pro模式";
+/** Label of the CLI entry point that opens the browser console itself. */
+export const WEB_MODE_LABEL = "打开Web端";
 /**
- * Geometry of the Pro-mode button: a small box in the top-left corner, directly
- * below the status bar (row 0). Rendering and hit testing share it so a click
- * always lands on the box that is drawn.
+ * Geometry of a box in the top-left corner, directly below the status bar
+ * (row 0), starting at column `x`. Rendering and hit testing share it so a
+ * click always lands on the box that is drawn.
  *
  * Returns null when the terminal is too small to fit the box with a little
- * breathing room around it. The height floor also keeps the start screen's
- * centered block (which is pushed below the box) clear of the approval toggle
- * on very short terminals, where the original layout is preserved instead.
+ * breathing room to its right. The height floor also keeps the start screen's
+ * centered block (which is pushed below the boxes) clear of the approval
+ * toggle on very short terminals, where the original layout is preserved.
  */
-export function proModeButton(width, height) {
-    // One blank column at the very edge, then the border: "flush to the edge
-    // with a single space", as the start screen expects.
-    const x = 1;
+function headerButton(width, height, x, label) {
     const y = 1;
     const h = 3;
     // Two cells of padding, one inside each border.
-    const w = displayWidth(PRO_MODE_LABEL) + 4;
-    if (width < w + 4 || height < 22)
+    const w = displayWidth(label) + 4;
+    if (width < x + w + 3 || height < 22)
+        return null;
+    return { x, y, w, h, label };
+}
+/**
+ * The Pro-mode button: flush to the left edge with a single blank column, as
+ * the start screen expects.
+ */
+export function proModeButton(width, height) {
+    return headerButton(width, height, 1, PRO_MODE_LABEL);
+}
+/**
+ * The Web-mode button: glued to the right border of the Pro-mode button so the
+ * two read as one row of entry points. It starts where the Pro box ends, which
+ * also means it is hidden together with it on terminals too small for the row.
+ */
+export function webModeButton(width, height) {
+    const pro = proModeButton(width, height);
+    if (!pro)
         return null;
-    return { x, y, w, h, label: PRO_MODE_LABEL };
+    return headerButton(width, height, pro.x + pro.w, WEB_MODE_LABEL);
 }
 /**
- * Draw the Pro-mode button. It is painted as opaque chrome so content behind it
+ * Draw one top-left button. It is painted as opaque chrome so content behind it
  * can never bleed through; the label row turns into the highlight background
  * while the pointer is over it.
  */
-export function drawProModeButton(buf, hovered = false) {
-    const button = proModeButton(buf.width, buf.height);
+export function drawHeaderButton(buf, button, hovered = false) {
     if (!button)
         return;
     const { x, y, w, h, label } = button;

package/dist/update.js

@@ -0,0 +1,213 @@
+import { spawn } from "node:child_process";
+import process from "node:process";
+import { loadVersion } from "./config.js";
+/** The published package whose registry version decides whether an update exists. */
+export const UPDATE_PACKAGE = "@xingjisoft/neutrino";
+/** What a user can run by hand when the automatic update fails. */
+export const MANUAL_UPDATE_COMMAND = `npm install -g ${UPDATE_PACKAGE}`;
+const LOOKUP_TIMEOUT_MS = 20_000;
+const INSTALL_TIMEOUT_MS = 300_000;
+let published = "";
+let pending = null;
+let installing = null;
+/**
+ * The last known answer, for the terminal screen and the Web console payload.
+ * Reading this never touches the network: the lookup runs once per process (see
+ * checkForUpdate) and costs nothing afterwards.
+ */
+export function updateStatus() {
+    const currentVersion = loadVersion();
+    return {
+        currentVersion,
+        latestVersion: published,
+        hasUpdate: isNewerVersion(published, currentVersion),
+    };
+}
+/**
+ * Ask npm which version is published and remember it. This never rejects: an
+ * offline machine, a missing npm or a registry hiccup only means "no update to
+ * announce", which is what the next start is for. Concurrent callers share the
+ * one lookup, and a successful answer is kept for the rest of the process so
+ * the terminal and the Web console cannot disagree.
+ */
+export function checkForUpdate() {
+    if (published)
+        return Promise.resolve(updateStatus());
+    pending ??= lookupLatestVersion()
+        .then((version) => {
+        published = version;
+        return updateStatus();
+    })
+        .catch((error) => ({
+        ...updateStatus(),
+        error: error instanceof Error ? error.message : String(error),
+    }))
+        .finally(() => { pending = null; });
+    return pending;
+}
+/**
+ * Install the latest published release with npm.
+ *
+ * The terminal and both Web workspaces can ask for this, so requests share one
+ * install instead of running npm twice over the same files. It never rejects:
+ * whoever asked gets a result and, on failure, the command to run by hand.
+ *
+ * The version this process runs is not replaced — the running code stays on
+ * disk until the user restarts — so callers must tell the user to restart.
+ */
+export function installUpdate() {
+    installing ??= runNpm(["install", "-g", UPDATE_PACKAGE], INSTALL_TIMEOUT_MS)
+        .then((run) => npmResult(run, `install -g ${UPDATE_PACKAGE}`))
+        .catch((error) => ({
+        ok: false,
+        version: updateStatus().latestVersion,
+        error: error instanceof Error ? error.message : String(error),
+    }))
+        .finally(() => { installing = null; });
+    return installing;
+}
+/** `npm view <package> version`, with a deadline so a hung npm cannot hold a start-up. */
+async function lookupLatestVersion() {
+    const run = await runNpm(["view", UPDATE_PACKAGE, "version"], LOOKUP_TIMEOUT_MS);
+    const version = firstVersionLine(run.stdout);
+    if (version)
+        return version;
+    throw new Error(npmFailure(run, `view ${UPDATE_PACKAGE} version`));
+}
+/** Turn one finished npm run into the answer callers see. */
+function npmResult(run, what) {
+    const version = updateStatus().latestVersion;
+    return run.code === 0
+        ? { ok: true, version }
+        : { ok: false, version, error: npmFailure(run, what) };
+}
+/** The last line npm printed is the one that says what went wrong. */
+function npmFailure(run, what) {
+    const reason = run.stderr.trim().split("\n").pop()?.trim();
+    return `npm ${what} failed${run.code === null ? " (timed out)" : run.code === 0 ? "" : ` with code ${run.code}`}`
+        + (reason ? `: ${reason}` : "");
+}
+/**
+ * Run npm and collect a bounded amount of output. Rejects only when npm cannot
+ * be started at all or does not finish in time; a failing npm resolves with its
+ * exit code so the caller decides what it means.
+ */
+function runNpm(args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            // On Windows npm is a .cmd shim, which Node only starts through a shell;
+            // the command is built from fixed literals, so nothing needs quoting.
+            const windows = process.platform === "win32";
+            child = spawn(windows ? process.env.ComSpec || "cmd.exe" : "npm", windows ? ["/d", "/s", "/c", `npm ${args.join(" ")}`] : args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        }
+        catch (error) {
+            reject(new Error(`could not run npm: ${error instanceof Error ? error.message : String(error)}`));
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const finish = (error, run) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolve(run);
+        };
+        const timer = setTimeout(() => {
+            // Stop waiting on a hung npm: its output is discarded either way.
+            child.kill();
+            finish(new Error(`npm ${args.join(" ")} timed out after ${timeoutMs / 1000}s`));
+        }, timeoutMs);
+        timer.unref();
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            if (stdout.length < 8192)
+                stdout += chunk;
+        });
+        child.stderr?.on("data", (chunk) => {
+            if (stderr.length < 8192)
+                stderr += chunk;
+        });
+        // A missing npm is reported asynchronously; without this listener the
+        // 'error' event would crash the whole process.
+        child.on("error", (error) => finish(new Error(`could not run npm: ${error.message}`)));
+        child.on("close", (code) => finish(null, { code, stdout, stderr }));
+    });
+}
+/** npm prints the version alone, but warnings on stdout must not be mistaken for one. */
+function firstVersionLine(text) {
+    for (const line of text.split(/\r?\n/)) {
+        const value = line.trim();
+        if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$/.test(value))
+            return value;
+    }
+    return "";
+}
+function parseVersion(value) {
+    const text = value.trim().replace(/^v/i, "").split("+")[0];
+    if (!text)
+        return null;
+    const dash = text.indexOf("-");
+    const core = (dash === -1 ? text : text.slice(0, dash)).split(".");
+    if (!core.length || core.some((part) => !/^\d+$/.test(part)))
+        return null;
+    const prerelease = dash === -1 ? null : text.slice(dash + 1).split(".");
+    if (prerelease && prerelease.some((part) => part === ""))
+        return null;
+    return { core: core.map(Number), prerelease };
+}
+/**
+ * Semantic-version order: returns 1 when `left` is newer, -1 when older and 0
+ * when they are the same release. A version that cannot be parsed compares as
+ * equal, so a malformed registry answer can never claim an update is due.
+ */
+export function compareVersions(left, right) {
+    const a = parseVersion(left);
+    const b = parseVersion(right);
+    if (!a || !b)
+        return 0;
+    const length = Math.max(a.core.length, b.core.length);
+    for (let i = 0; i < length; i++) {
+        const difference = (a.core[i] ?? 0) - (b.core[i] ?? 0);
+        if (difference !== 0)
+            return difference > 0 ? 1 : -1;
+    }
+    // Numeric identifiers compare numerically and rank below alphanumeric ones.
+    const compareIdentifiers = (one, other) => {
+        const numeric = /^\d+$/.test(one);
+        const otherNumeric = /^\d+$/.test(other);
+        if (numeric && otherNumeric)
+            return Math.sign(Number(one) - Number(other));
+        if (numeric !== otherNumeric)
+            return numeric ? -1 : 1;
+        return one < other ? -1 : one > other ? 1 : 0;
+    };
+    if (!a.prerelease && !b.prerelease)
+        return 0;
+    if (!a.prerelease)
+        return 1;
+    if (!b.prerelease)
+        return -1;
+    for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i++) {
+        const one = a.prerelease[i];
+        const other = b.prerelease[i];
+        if (one === undefined)
+            return -1;
+        if (other === undefined)
+            return 1;
+        const difference = compareIdentifiers(one, other);
+        if (difference !== 0)
+            return difference;
+    }
+    return 0;
+}
+/** Whether `candidate` is a strictly newer release than `current`. */
+export function isNewerVersion(candidate, current) {
+    return compareVersions(candidate, current) > 0;
+}

package/dist/web/clientState.js

@@ -0,0 +1,82 @@
+/**
+ * State the browser console keeps about itself.
+ *
+ * The sidebar's blue dot asks for attention once: it marks a conversation that
+ * finished after the reader last opened it. Remembering that answer is neither a
+ * conversation setting (config.json is read by the terminal UI on every tool
+ * call) nor part of a transcript, so the console owns a file of its own:
+ *
+ *   ~/.neutrino/web.json
+ *   { "seen": { "standard": ["id:2025-01-02T03-04-05-678Z", "live:L3"], "pro": [] } }
+ *
+ * Both workspaces keep their own record, because each has its own sidebar. The
+ * file is a convenience: a missing, unreadable or hand-mangled one costs a dot,
+ * never a request.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { NEUTRINO_DIR, ensureDirs } from "../config.js";
+export const WEB_STATE_FILE = path.join(NEUTRINO_DIR, "web.json");
+/**
+ * Identities are `id:<session id>` for a conversation with history and
+ * `live:<key>` for one that has nothing saved yet (see `sessionIdentity` in
+ * web/app.js). Anything else is refused, so a crafted request body cannot grow
+ * the file without bound.
+ */
+const IDENTITY_RE = /^(?:id|live):[A-Za-z0-9._-]{1,200}$/;
+/** How many finished conversations one workspace remembers, newest last. */
+export const SEEN_LIMIT = 300;
+/** Whether a value from a request is an identity this file can hold. */
+export function isSeenIdentity(value) {
+    return typeof value === "string" && IDENTITY_RE.test(value);
+}
+/** The whole file, never throwing: an unreadable record simply holds nothing. */
+function readState() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(WEB_STATE_FILE, "utf-8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** The `seen` map of the file, or an empty one when it is missing or malformed. */
+function seenState(state) {
+    const seen = state.seen;
+    return seen && typeof seen === "object" && !Array.isArray(seen)
+        ? seen
+        : {};
+}
+/** Identities of one workspace, oldest first, with unusable entries dropped. */
+function workspaceSeen(state, mode) {
+    const list = seenState(state)[mode];
+    if (!Array.isArray(list))
+        return [];
+    return list.filter(isSeenIdentity).slice(-SEEN_LIMIT);
+}
+/** The conversations this workspace has already shown the reader, oldest first. */
+export function loadSeen(mode = "standard") {
+    return workspaceSeen(readState(), mode);
+}
+/**
+ * Record (`seen: true`) or forget (`seen: false`) the given conversations and
+ * write the file back. Returns the workspace's new record.
+ *
+ * Identities that are not valid are ignored rather than rejected: the route
+ * already validated them, so this is only a guard on what reaches the disk.
+ */
+export function updateSeen(mode, identities, seen) {
+    const wanted = new Set(identities.filter(isSeenIdentity));
+    if (wanted.size === 0)
+        return loadSeen(mode);
+    const state = readState();
+    // A recorded conversation moves to the end, so trimming keeps the newest.
+    const kept = workspaceSeen(state, mode).filter((identity) => !wanted.has(identity));
+    // Trim after the merge: recording a new conversation can push the oldest out.
+    const next = (seen ? [...kept, ...wanted] : kept).slice(-SEEN_LIMIT);
+    ensureDirs();
+    fs.writeFileSync(WEB_STATE_FILE, JSON.stringify({ ...state, seen: { ...seenState(state), [mode]: next } }, null, 2), "utf-8");
+    return next;
+}

package/dist/web/server.js

@@ -19,15 +19,17 @@ import { timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { deleteSession, listSessions, loadConfig, normalizeApprovalMode, resolveModelSelection, saveConfig, sessionDir, } from "../config.js";
 import { getWebSettings, updateWebSettings } from "./settings.js";
+import { isSeenIdentity, loadSeen, updateSeen, SEEN_LIMIT } from "./clientState.js";
 import { WebAuth } from "./auth.js";
 import { normalizeCwd, sameCwd } from "../cwd.js";
 import { hub } from "./hub.js";
 import { writeCrashLog } from "../terminal/restore.js";
 import { createWebSession, proInitialSelection, resumeSession, WebSession } from "./session.js";
-import { defaultProPreset, requireProPreset } from "../pro/config.js";
+import { defaultProPreset, ensureProModels, requireProPreset } from "../pro/config.js";
 import { listAgentSessions, loadAgentMessages, loadAgentSession, safeAgentSessionId } from "../agents.js";
 import { migrateAgentSession, SessionMigrationError } from "../migration.js";
 import { runningBackground } from "../background.js";
+import { MANUAL_UPDATE_COMMAND, installUpdate, updateStatus } from "../update.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dist/web -> package root (mirrors the same trick used in config.ts).
 const PKG_ROOT = path.resolve(__dirname, "..", "..");
@@ -405,10 +407,15 @@ function buildOverview(mode = "standard") {
         seen.add(session.id);
     }
     // Live conversations that have not been saved yet (or whose newest save has
-    // not landed) still deserve a spot at the top of their directory group.
+    // not landed) still deserve a spot at the top of their directory group. A
+    // conversation nobody has said anything in yet is not history: it stays out
+    // of the list (but in `live`, so the browser keeps its stream) until it has
+    // content.
     for (const live of lives) {
         if (live.sessionId && seen.has(live.sessionId))
             continue;
+        if (live.empty)
+            continue;
         const key = normalizeCwd(live.cwd) || "(unknown)";
         let group = groups.get(key);
         if (!group) {
@@ -600,6 +607,10 @@ function streamLive(key, req, res) {
 async function handleApi(req, res, url, auth, mode, pathname, binding) {
     if (!pathname.startsWith("/api/"))
         return false;
+    // The Pro presets are not bundled either: the first Pro request makes sure they
+    // are on disk. When the download fails the route below reports the missing file.
+    if (mode === "pro")
+        await ensureProModels().catch(() => undefined);
     if (req.method === "OPTIONS") {
         // Same-origin only: no CORS headers, so cross-site preflights are rejected.
         // Answered before the login check because it reveals nothing.
@@ -737,6 +748,33 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         }
         return true;
     }
+    // The update prompt's confirm button: npm runs on this machine, so the route
+    // sits behind the login cookie and the same-origin check like every other
+    // mutation, and only a release the registry announced can be installed.
+    if (pathname === "/api/update") {
+        if (req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        if (!isSameOrigin(req)) {
+            sendJson(res, 403, { error: "cross-origin request rejected" });
+            return true;
+        }
+        if (!updateStatus().hasUpdate) {
+            sendJson(res, 409, { error: "No newer version is published." });
+            return true;
+        }
+        // Never rejects: a failure comes back as a result, carrying the command the
+        // browser shows so the user can finish the update by hand.
+        const result = await installUpdate();
+        sendJson(res, result.ok ? 200 : 500, {
+            ok: result.ok,
+            version: result.version,
+            error: result.error ?? "",
+            command: MANUAL_UPDATE_COMMAND,
+        });
+        return true;
+    }
     if (req.method === "GET" && pathname === "/api/health") {
         sendJson(res, 200, { ok: true, live: hub.list(mode).length });
         return true;
@@ -745,6 +783,53 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         sendJson(res, 200, buildOverview(mode));
         return true;
     }
+    // The sidebar's blue dot is the browser's own memory of what it has read. It
+    // belongs to the console rather than to a conversation, so it is stored in
+    // ~/.neutrino/web.json (see clientState.ts) and never in the config or the
+    // transcript. Each workspace keeps its own record.
+    if (pathname === "/api/seen") {
+        if (req.method === "GET") {
+            sendJson(res, 200, { seen: loadSeen(mode) });
+            return true;
+        }
+        if (req.method === "POST") {
+            if (!isSameOrigin(req)) {
+                sendJson(res, 403, { error: "cross-origin request rejected" });
+                return true;
+            }
+            try {
+                const body = await readJsonBody(req, 64 * 1024);
+                if (!body || typeof body !== "object" || Array.isArray(body)) {
+                    throw new ApiError(400, "invalid request", "invalid request");
+                }
+                const input = body;
+                if (Object.keys(body).some((key) => key !== "identities" && key !== "seen")) {
+                    throw new ApiError(400, "unknown field", "unknown field");
+                }
+                const identities = input.identities;
+                if (!Array.isArray(identities) || identities.length === 0 || identities.length > SEEN_LIMIT) {
+                    throw new ApiError(400, `identities must be a list of 1 to ${SEEN_LIMIT}`, "invalid identities");
+                }
+                if (!identities.every(isSeenIdentity)) {
+                    throw new ApiError(400, "invalid conversation id", "invalid conversation id");
+                }
+                if (typeof input.seen !== "boolean") {
+                    throw new ApiError(400, "seen must be a boolean", "seen must be a boolean");
+                }
+                sendJson(res, 200, { ok: true, seen: updateSeen(mode, identities, input.seen) });
+            }
+            catch (err) {
+                // A rejected body is the caller's fault; a file that cannot be written
+                // is ours, and must not read as a malformed request.
+                sendJson(res, err instanceof ApiError ? err.status : 500, {
+                    error: err instanceof Error ? err.message : "invalid request",
+                });
+            }
+            return true;
+        }
+        sendJson(res, 405, { error: "method not allowed" });
+        return true;
+    }
     if (req.method === "GET" && pathname === "/api/sessions") {
         sendJson(res, 200, { sessions: listSessions(mode) });
         return true;

package/dist/web/service.js

@@ -3,6 +3,8 @@ import process from "node:process";
 import { backgroundLog, clearBackgroundStatus, isProcessAlive, writeBackgroundStatus, } from "../background.js";
 import { loadConfig, saveConfig } from "../config.js";
 import { startBackgroundTray } from "../tray.js";
+import { PRO_MODELS_URL, syncProModels } from "../pro/config.js";
+import { checkForUpdate, UPDATE_PACKAGE } from "../update.js";
 import { hub } from "./hub.js";
 import { startWebServer } from "./server.js";
 import { TerminalBridges } from "./terminalBridge.js";
@@ -88,6 +90,29 @@ export async function runWebService(options) {
         syncTray();
         return status();
     };
+    // Nothing ships with the package any more: reconcile the presets with the
+    // official copy now, so the first browser to open /pro already finds them and
+    // an outdated local set is replaced. A failure is logged and reported there,
+    // so this never holds up the console itself.
+    void syncProModels().then((result) => {
+        if (result.status === "updated")
+            backgroundLog(`pro presets: updated from ${PRO_MODELS_URL}`);
+        else if (result.status === "kept")
+            backgroundLog(`pro presets: kept the local copy (${result.detail})`);
+    }).catch((error) => {
+        backgroundLog(`pro presets: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    // The registry lookup runs alongside the listener so a slow or unreachable
+    // registry never delays the console; the pages read the answer from the
+    // settings payload. Failures are logged, as with the presets above.
+    void checkForUpdate().then((result) => {
+        if (result.hasUpdate) {
+            backgroundLog(`${UPDATE_PACKAGE} ${result.latestVersion} is available (running ${result.currentVersion})`);
+        }
+        else if (result.error) {
+            backgroundLog(`update check: ${result.error}`);
+        }
+    });
     try {
         handle = await startWebServer({
             port: options.port, host: options.host, auth: options.auth,

package/dist/web/session.js

@@ -262,6 +262,7 @@ export class WebSession {
                 } } : {}),
             sessionId: this.sessionId,
             title: this.title(),
+            empty: this.messages.length === 0 && !this.streamingContent,
             provider: this.provider,
             model: this.model.name,
             intensity: this.intensity,

package/dist/web/settings.js

@@ -1,6 +1,7 @@
 import { DEFAULT_CONFIG, INTENSITY_LEVELS, WEB_LANGUAGES, contextWindow, intensityForModel, isContextWindow, loadConfig, loadModels, modelContextWindow, modelContextWindowKey, modelIntensities, normalizeApprovalMode, normalizeIntensity, normalizeWebLanguage, resolveModelSelection, saveConfig, saveModels, } from "../config.js";
 import { hashWebPassword, validateWebPassword } from "./auth.js";
 import { defaultProPreset, loadProModels, proMaxRecursionDepth, requireProPreset } from "../pro/config.js";
+import { updateStatus } from "../update.js";
 /**
  * Public settings use a whitelist: API keys and cached credentials stay on disk.
  *
@@ -31,7 +32,15 @@ export function getWebSettings(mode = "standard") {
         ? catalog.providers.find((p) => p.name === provider.name)?.models.find((m) => m.name === model.name) ?? null
         : null;
     const intensity = intensityForModel(configuredModel, config.selected_intensity ?? config.default_intensity, config.default_intensity);
+    // Read-only runtime state for the update notice: which version runs, which
+    // one is published, and whether the two differ. Never persisted.
+    const update = updateStatus();
     return {
+        update: {
+            current_version: update.currentVersion,
+            latest_version: update.latestVersion,
+            has_update: update.hasUpdate,
+        },
         ...(mode === "pro" ? { pro: {
                 presets: loadProModels().tier.map((preset) => ({
                     name: preset.name, chinese_name: preset.chinese_name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xingjisoft/neutrino",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "XINGJI Neutrino - a CLI coding agent in the terminal.",
   "type": "module",
   "license": "Apache-2.0",
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node scripts/test-paste.mjs && node scripts/test-mouse.mjs && node scripts/test-cursor.mjs && node scripts/test-selection.mjs && node scripts/test-drag-scroll.mjs && node scripts/test-selection-performance.mjs && node scripts/test-copy.mjs && node scripts/test-scrollbar.mjs && node scripts/test-render.mjs && node scripts/test-drift.mjs && node scripts/test-sanitize.mjs && node scripts/test-markdown.mjs && node scripts/test-wrap.mjs && node scripts/test-fetch.mjs && node scripts/test-compact.mjs && node scripts/test-history-fold.mjs && node scripts/test-web-history.mjs && node scripts/test-session-migration.mjs && node scripts/test-web-session-migration.mjs && node scripts/test-web-default.mjs && node scripts/test-turn-fold.mjs && node scripts/test-long-turn.mjs && node scripts/test-plan.mjs && node scripts/test-subagent.mjs && node scripts/test-web-settings.mjs && node scripts/test-model-intensity.mjs && node scripts/test-background.mjs && node scripts/test-background-lifetime.mjs && node scripts/test-web-markdown.mjs && node scripts/test-web-i18n.mjs && node scripts/test-web-workspaces.mjs && node scripts/test-tools.mjs && node scripts/test-approval.mjs && node scripts/test-approval-review.mjs && node scripts/test-approval-ui.mjs && node scripts/test-web-approval-details.mjs && node scripts/test-approval-mode.mjs && node scripts/test-approval-context.mjs && node scripts/test-settings-render.mjs && node scripts/test-approval-flow.mjs && node scripts/test-web.mjs && node scripts/test-web-settings-http.mjs && node scripts/test-web-lan.mjs && node scripts/test-web-auth.mjs && node scripts/test-web-auth-ui.mjs && node scripts/test-web-pro.mjs && node scripts/test-pro-preflight.mjs && node scripts/test-pro-runtime.mjs && node scripts/test-pro-team.mjs && node scripts/test-pro-ui.mjs && node scripts/test-interrupt.mjs && node scripts/test-terminal-lifecycle.mjs && node scripts/test-persistence.mjs && node scripts/test-resilience.mjs && node scripts/test-approval-timeout.mjs && node scripts/test-approval-hardening.mjs && node scripts/test-approval-extreme.mjs && node scripts/test-approval-reason.mjs",
+    "test": "npm run build && node scripts/test-paste.mjs && node scripts/test-mouse.mjs && node scripts/test-cursor.mjs && node scripts/test-selection.mjs && node scripts/test-drag-scroll.mjs && node scripts/test-selection-performance.mjs && node scripts/test-copy.mjs && node scripts/test-scrollbar.mjs && node scripts/test-render.mjs && node scripts/test-drift.mjs && node scripts/test-sanitize.mjs && node scripts/test-markdown.mjs && node scripts/test-wrap.mjs && node scripts/test-fetch.mjs && node scripts/test-compact.mjs && node scripts/test-history-fold.mjs && node scripts/test-web-history.mjs && node scripts/test-web-mobile-history.mjs && node scripts/test-session-migration.mjs && node scripts/test-web-session-migration.mjs && node scripts/test-web-default.mjs && node scripts/test-turn-fold.mjs && node scripts/test-long-turn.mjs && node scripts/test-plan.mjs && node scripts/test-subagent.mjs && node scripts/test-web-settings.mjs && node scripts/test-update.mjs && node scripts/test-update-ui.mjs && node scripts/test-update-web.mjs && node scripts/test-model-intensity.mjs && node scripts/test-background.mjs && node scripts/test-background-lifetime.mjs && node scripts/test-web-markdown.mjs && node scripts/test-web-i18n.mjs && node scripts/test-web-workspaces.mjs && node scripts/test-tools.mjs && node scripts/test-approval.mjs && node scripts/test-approval-review.mjs && node scripts/test-approval-ui.mjs && node scripts/test-web-approval-details.mjs && node scripts/test-web-sidebar-status.mjs && node scripts/test-web-seen.mjs && node scripts/test-approval-mode.mjs && node scripts/test-approval-context.mjs && node scripts/test-settings-render.mjs && node scripts/test-approval-flow.mjs && node scripts/test-web.mjs && node scripts/test-web-settings-http.mjs && node scripts/test-web-lan.mjs && node scripts/test-web-auth.mjs && node scripts/test-web-auth-ui.mjs && node scripts/test-web-pro.mjs && node scripts/test-pro-preflight.mjs && node scripts/test-pro-runtime.mjs && node scripts/test-pro-team.mjs && node scripts/test-pro-ui.mjs && node scripts/test-interrupt.mjs && node scripts/test-terminal-lifecycle.mjs && node scripts/test-persistence.mjs && node scripts/test-resilience.mjs && node scripts/test-approval-timeout.mjs && node scripts/test-approval-hardening.mjs && node scripts/test-approval-extreme.mjs && node scripts/test-approval-reason.mjs",
     "prepare": "npm run build",
     "web": "node dist/bin.js web"
   },

package/web/README.md

@@ -116,6 +116,11 @@ in-page switch takes over from there for the running process.
 The console can read every transcript and drive an agent with shell access, so
 keep the Web password on: anyone who can reach the port can use it.
 
+On a narrow screen the console shows one pane at a time: the conversation list,
+and then the open conversation. The back arrow in the header and the browser's
+own Back button both return to the list, and Forward reopens the conversation
+that was open.
+
 Startup prints the addresses to open:
 
 ```
@@ -223,16 +228,15 @@ login/logout routes are shared and stay unprefixed.
 
 ## Models and settings
 
-Open a conversation to see the **Provider**, **Model** and **Thinking**
-selectors. Choose a configured model and press **Apply to conversation**. The
-next turn uses that selection, and it is saved with the transcript. The same
-controls also update a conversation running in the terminal. Pause an active
-turn before applying a change; a running turn returns a clear conflict message.
+Open the model card at the lower right of the composer to choose a **Provider**
+and **Model**, and adjust **Thinking intensity** with the slider. Changes to an
+idle or paused conversation apply immediately to its next turn and are saved
+with the transcript. The same controls update a conversation running in the
+terminal. Pause an active turn before changing its model.
 
-For saved history, **Continue with model** resumes the transcript with the chosen
-selection. Changing the selectors and then using **Continue here** or sending a
-message also uses the draft selection, so a transcript whose old model was
-removed can still be continued.
+For saved history or a new workspace conversation, the card keeps the selection
+as a draft. **Continue here** or sending a message starts the conversation with
+that selection, so a transcript whose old model was removed can still continue.
 
 The **Settings** (gear) button in the sidebar opens the interface language,
 plan-first turns, the default approval mode, defaults for new conversations, the
@@ -277,6 +281,21 @@ regular and Pro workspaces remember their own choice. The terminal UI stays in
 English. New conversation content, of course, remains in the language the model
 writes.
 
+## Sidebar status marks
+
+Every row in the sidebar carries one mark. A **blue dot** means the conversation
+finished and has not been opened since, a **turning ring** means a turn is
+running, and an **amber dot** means a tool call is waiting for your answer. The
+amber mark only appears while the conversation really asks for approval — with
+automatic review the reviewers answer for you, so the row keeps showing the
+running ring.
+
+The blue dot asks once: opening the row answers it, and the next turn that
+finishes asks again. The console remembers those answers in a file of its own,
+`~/.neutrino/web.json` (the regular and Pro workspaces each keep their own
+record), so the terminal UI never carries data it does not read, and a reload, a
+restart of the console or a change of port does not bring every dot back.
+
 ## History vs. live sessions
 
 A saved transcript on disk is a finished record: nothing is running, so the