micro-models-agent 2.4.0 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to Micro Models Agent (MMA) will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.5.0] - 2026-09-24
+
+### Added
+
+- **web file viewer** (`src/modules/webui/file-api.ts`): `GET /api/file?path=<p>` serves a workspace text file for the chat file cards' Open link — resolved against the workspace (lexical + `realpath` guards, so symlinks/junctions cannot escape), protected paths (`.git/`, `.env*`, keys) refused, 512 KB cap, binary refused. UTF-16 LE/BE BOM and UTF-8 BOM are decoded; errors are human-readable `text/plain` (the endpoint opens as a browser tab).
+- **web cookie auth** (`src/modules/webui/util.ts`, `server.ts`): authenticated requests set an `HttpOnly; SameSite=Strict` `mma_web_auth` cookie and `checkAuth` accepts it, so a plain `<a target="_blank">` navigation authenticates without the token in the URL.
+- **web session persistence** (`assets/app.js`): the active session is mirrored into `?session=` (`history.replaceState`, token preserved) and restored on reload after the first state refresh.
+
+### Fixed
+
+- **web reasoning text** (`src/modules/webui/forward.ts`, `history-api.ts`): ANSI escape sequences (`ESC[2m…`) are stripped from streamed/replayed text, meta and tool output — reasoning no longer renders as literal `\u001b[2m…` garbage on the model's own words.
+- **web file card** (`assets/app.js`, `styles.css`): the card stacks vertically (path on its own line) and its `open` control is a real `<a target="_blank">` link that opens the file in a new tab.
+
+### Changed
+
+- **dedicated reasoning channel** (`src/core/agent.ts`, `src/modules/webui/forward.ts`, `src/cli/repl.ts`, `src/cli/main.ts`): model reasoning now travels on its own `onReasoning` callback and SSE `reasoning` event (no longer pre-dimmed and no longer mixed into the generic `meta` channel); the terminal renders it via `renderer.reasoning`.
+- **web reasoning collapsed by default** (`assets/app.js`): `thinking` blocks (live and replayed) start collapsed; generic `meta` (status, context stats, compaction, tool summaries, warnings) renders as always-visible `.metaln` lines instead of being folded into the reasoning block.
+
 ## [2.4.0] - 2026-09-24
 
 ### Added

package/dist/assets/app.js

@@ -53,6 +53,9 @@
   };
 
   const FILE_TOOLS = ["read_file", "write_file", "edit_file", "list_dir", "delete_file", "move_file", "file_info"];
+  // Tools whose `path` argument points at a readable file the viewer can open.
+  // `list_dir` is a directory, `delete_file`/`move_file` leave the file gone.
+  const OPENABLE_TOOLS = ["read_file", "write_file", "edit_file", "file_info"];
   const IMAGE_TOOLS = ["attach_image", "browser"];
   const LINK_TOOLS = ["web_fetch", "download_file"];
 
@@ -83,7 +86,7 @@
 
   let curText = null;
   let curTextNodes = [];
-  let curMeta = null;
+  let curThink = null;
   let lastPlanSig = null;
   let lastUsageSig = null;
   let lastEnvSig = null;
@@ -365,6 +368,7 @@
 
   function showEmptyFeed() {
     msgs.replaceChildren(emptyView());
+    syncUrl();
   }
 
   function clearFeed(feed) {
@@ -530,8 +534,8 @@
     clearBusy(feed);
     if (!feed) return;
     clearEmpty(feed);
-    if (curMeta) {
-      finishMeta();
+    if (curThink) {
+      finishThink();
     }
     if (curText == null) {
       flushRun();
@@ -542,39 +546,60 @@
     renderTextSegment(feed, curText);
   }
 
-  function finishMeta() {
-    if (curMeta && curMeta.startedAt) {
-      const dur = curMeta.head.querySelector(".dur");
-      if (dur) dur.textContent = "· " + ((Date.now() - curMeta.startedAt) / 1000).toFixed(1) + "s";
+  function finishThink() {
+    if (curThink && curThink.startedAt) {
+      const dur = curThink.head.querySelector(".dur");
+      if (dur) dur.textContent = "· " + ((Date.now() - curThink.startedAt) / 1000).toFixed(1) + "s";
     }
-    curMeta = null;
+    curThink = null;
   }
 
-  function onMeta(chunk, sid) {
+  // Build the collapsible reasoning block. The global `.think-h` click handler
+  // depends on this exact structure: wrap > [head, body], body carries `hidden`.
+  function buildThinkBlock(withDur) {
+    const wrap = el("div", "think");
+    const head = el("button", "think-h");
+    head.type = "button";
+    head.setAttribute("aria-expanded", "false");
+    head.appendChild(el("span", "g", "✦"));
+    head.appendChild(el("span", "lab", t("web.action.thinking")));
+    if (withDur) head.appendChild(el("span", "dur", ""));
+    const tog = el("span", "tog");
+    setIcon(tog, "chevron-right", t("web.action.show"));
+    head.appendChild(tog);
+    const body = el("div", "think-body hidden");
+    wrap.appendChild(head);
+    wrap.appendChild(body);
+    return { wrap, head, body };
+  }
+
+  function onReasoning(chunk, sid) {
     const feed = feedForEvent(sid);
     clearBusy(feed);
     if (!feed) return;
     clearEmpty(feed);
     curText = null;
-    if (!curMeta) {
+    if (!curThink) {
       flushRun();
-      const wrap = el("div", "think");
-      const head = el("button", "think-h");
-      head.type = "button";
-      head.setAttribute("aria-expanded", "true");
-      head.appendChild(el("span", "g", "✦"));
-      head.appendChild(el("span", "lab", t("web.action.thinking")));
-      head.appendChild(el("span", "dur", ""));
-      const tog = el("span", "tog");
-      setIcon(tog, "chevron-down", t("web.action.hide"));
-      head.appendChild(tog);
-      const body = el("div", "think-body");
-      wrap.appendChild(head);
-      wrap.appendChild(body);
+      const { wrap, head, body } = buildThinkBlock(true);
       appendTo(feed, wrap);
-      curMeta = { wrap, head, body, startedAt: Date.now() };
+      curThink = { wrap, head, body, startedAt: Date.now() };
     }
-    curMeta.body.textContent += chunk;
+    curThink.body.textContent += chunk;
+    if (feed === activeFeed()) scroll();
+  }
+
+  // Generic agent status (context stats, compaction, MoE status, warnings):
+  // always visible, one dim line per chunk, never collapsed.
+  function onMeta(chunk, sid) {
+    const feed = feedForEvent(sid);
+    clearBusy(feed);
+    const text = (chunk || "").trim();
+    if (!feed || !text) return;
+    clearEmpty(feed);
+    curText = null;
+    const warn = text.indexOf("⚠") !== -1 || text.indexOf("✗") !== -1;
+    appendTo(feed, el("div", warn ? "metaln warn" : "metaln", text));
     if (feed === activeFeed()) scroll();
   }
 
@@ -593,7 +618,7 @@
     if (!feed) return;
     clearEmpty(feed);
     curText = null;
-    finishMeta();
+    finishThink();
     pendingArgs.set(data.toolCallId, data.args || {});
     const line = el("div", "act " + categoryOf(data.name));
     line.appendChild(el("span", "g", "◇"));
@@ -652,10 +677,22 @@
       const path = args.path || args.file || args.dir;
       if (!path) return;
       const card = el("div", "filecard");
-      card.appendChild(el("span", "g", "◇"));
-      card.appendChild(el("span", "name", path));
-      card.appendChild(el("span", "", labelOf(name)));
-      card.appendChild(el("span", "meta", t("web.card.view")));
+      const top = el("div", "fc-top");
+      top.appendChild(el("span", "g", "◇"));
+      const nameEl = el("span", "name", path);
+      nameEl.title = path;
+      top.appendChild(nameEl);
+      card.appendChild(top);
+      const bottom = el("div", "fc-bottom");
+      bottom.appendChild(el("span", "lab", labelOf(name)));
+      if (OPENABLE_TOOLS.indexOf(name) !== -1) {
+        const openLink = el("a", "fc-open", t("web.card.open"));
+        openLink.href = "/api/file?path=" + encodeURIComponent(path);
+        openLink.target = "_blank";
+        openLink.rel = "noopener noreferrer";
+        bottom.appendChild(openLink);
+      }
+      card.appendChild(bottom);
       appendTo(feed, card);
       return;
     }
@@ -711,7 +748,7 @@
     state.busy = false;
     const feed = feedForEvent(data.sessionId);
     clearBusy(feed);
-    finishMeta();
+    finishThink();
     curText = null;
     flushRun();
     const owner = tabs.find((x) => x.id === data.sessionId);
@@ -782,19 +819,8 @@
   }
 
   function renderThinkBlock(feed, text) {
-    const wrap = el("div", "think");
-    const head = el("button", "think-h");
-    head.type = "button";
-    head.setAttribute("aria-expanded", "true");
-    head.appendChild(el("span", "g", "✦"));
-    head.appendChild(el("span", "lab", t("web.action.thinking")));
-    const tog = el("span", "tog");
-    setIcon(tog, "chevron-down", t("web.action.hide"));
-    head.appendChild(tog);
-    const body = el("div", "think-body");
+    const { wrap, body } = buildThinkBlock(false);
     body.textContent = text || "";
-    wrap.appendChild(head);
-    wrap.appendChild(body);
     feed.appendChild(wrap);
   }
 
@@ -867,7 +893,7 @@
   }
 
   function feedHasContent(feed) {
-    return !!feed.querySelector(".u, .ans, .code, .act, .think, .errline, .sysline");
+    return !!feed.querySelector(".u, .ans, .code, .act, .think, .metaln, .errline, .sysline");
   }
 
   async function loadHistory(tab) {
@@ -940,6 +966,16 @@
     { passive: false }
   );
 
+  // Mirror the active session into `?session=` so a page refresh restores it.
+  // Only the active tab is persisted; the token param is preserved as-is.
+  function syncUrl() {
+    const url = new URL(location.href);
+    const tab = tabs.find((x) => x.id === activeTabId);
+    if (tab && tab.kind === "session") url.searchParams.set("session", tab.id);
+    else url.searchParams.delete("session");
+    history.replaceState(null, "", url);
+  }
+
   function openTab(id, name, kind, server) {
     let tab = tabs.find((x) => x.id === id);
     if (!tab) {
@@ -967,9 +1003,14 @@
       tab.historyLoaded = true;
     }
     if (server && tab.kind === "session") {
+      // A tab auto-opened as "live" (server=false) sets historyLoaded=true; when
+      // it is opened from the server afterward we must actually fetch the
+      // transcript, or a reload of the active session shows an empty feed.
+      if (!feedHasContent(tab.feed)) tab.historyLoaded = false;
       api("/api/sessions/activate", { method: "POST", body: { id } }).then(() => loadSessions());
       loadHistory(tab);
     }
+    syncUrl();
   }
 
   function closeTab(id) {
@@ -990,6 +1031,7 @@
     }
     renderTabstrip();
     renderSessionsDropdown();
+    syncUrl();
   }
 
   async function newChatTab() {
@@ -1390,7 +1432,7 @@
     }
     clearEmpty(feed);
     curText = null;
-    finishMeta();
+    finishThink();
     if (text.startsWith("/")) {
       appendTo(feed, el("div", "u", text));
       clearInput();
@@ -2106,6 +2148,10 @@
       const d = parse(e);
       if (d) onMeta(d.chunk || "", d.sessionId);
     });
+    es.addEventListener("reasoning", (e) => {
+      const d = parse(e);
+      if (d) onReasoning(d.chunk || "", d.sessionId);
+    });
     es.addEventListener("phase", (e) => {
       const d = parse(e);
       if (d) onPhase(d.phase, d.sessionId);
@@ -3027,6 +3073,8 @@
   }
 
   async function boot() {
+    // Read the requested session before `showEmptyFeed()` → `syncUrl()` can strip it.
+    const initialSession = new URLSearchParams(location.search).get("session");
     await loadI18n();
     await loadCommands();
     applyTheme(currentTheme());
@@ -3042,6 +3090,12 @@
     await loadSkills();
     await loadPlugins();
     await refresh();
+    // Restore the session from the URL AFTER the first refresh: `renderState`
+    // may auto-open the server's active session, and the requested one must win.
+    if (initialSession) {
+      const meta = state.sessions.find((s) => s.id === initialSession);
+      if (meta) openTab(initialSession, meta.name || String(initialSession), "session", true);
+    }
     connectSSE();
     setInterval(refresh, 2000);
     setInterval(loadSessions, 15000);

package/dist/assets/styles.css

@@ -239,6 +239,11 @@ body {
 .think-h .tog:hover { color: var(--dim-a); }
 .think-body { color: var(--dim-c); padding-left: 18px; white-space: pre-wrap; font-size: 12.5px; overflow-wrap: anywhere; }
 .think-body.hidden { display: none; }
+.metaln {
+  color: var(--dim-c); padding-left: 26px; white-space: pre-wrap;
+  font-size: 12.5px; overflow-wrap: anywhere;
+}
+.metaln.warn { color: var(--yellow); }
 .act { display: flex; gap: 8px; min-width: 0; }
 .act .lab { white-space: nowrap; }
 .act .args { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; }
@@ -298,14 +303,27 @@ body.light .code { border: 1px solid var(--border); }
 body.light .imgcard .ph { background: var(--ph-light); }
 .imgcard .cap { padding: 6px 10px; color: var(--dim-a); font-size: 12px; }
 .filecard {
-  margin-left: 26px; padding: 7px 12px; border-radius: 4px;
+  margin-left: 26px; padding: 8px 12px; border-radius: 6px;
   background: var(--surface); border: 1px solid var(--border-2); color: var(--muted);
-  display: flex; gap: 10px; align-items: baseline; font-size: 12.5px;
-  max-width: 480px; min-width: 0;
+  display: flex; flex-direction: column; gap: 6px; align-items: stretch;
+  font-size: 12.5px; max-width: 480px; min-width: 0;
 }
+.filecard .fc-top { display: flex; gap: 8px; align-items: baseline; min-width: 0; }
 .filecard .g { color: var(--cyan); flex: 0 0 auto; }
-.filecard .name { color: var(--fg); min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.filecard .meta { color: var(--dim-b); margin-left: auto; flex: 0 0 auto; }
+.filecard .name {
+  color: var(--fg); min-width: 0; overflow-wrap: anywhere; word-break: break-word;
+}
+.filecard .fc-bottom {
+  display: flex; gap: 10px; align-items: center; justify-content: space-between;
+}
+.filecard .lab { color: var(--dim-a); min-width: 0; overflow-wrap: anywhere; }
+.filecard .fc-open {
+  flex: 0 0 auto; font: inherit; font-size: 12px; line-height: 1.4;
+  color: var(--accent); background: transparent; border: 1px solid var(--border-2);
+  border-radius: 4px; padding: 2px 10px; cursor: pointer; text-decoration: none;
+}
+.filecard .fc-open:hover { border-color: var(--accent); text-decoration: none; }
+.filecard .fc-open:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
 .linkline { margin-left: 26px; min-width: 0; overflow-wrap: anywhere; }
 .linkline a { color: var(--accent); text-decoration: none; overflow-wrap: anywhere; word-break: break-word; }
 .linkline a:hover { text-decoration: underline; }

package/dist/i18n/en.json

@@ -1166,7 +1166,7 @@
   "web.tool.output_few": "output · {count} chars",
   "web.tool.output_many": "output · {count} chars",
   "web.tool.collapse": "collapse",
-  "web.card.view": "view ↗",
+  "web.card.open": "open ↗",
   "web.card.screenshot": "screenshot",
   "web.card.attached_image": "attached image",
   "web.card.browser_viewport": "browser · viewport",
@@ -1174,5 +1174,12 @@
   "web.question.send": "send",
   "web.question.answered": "answered",
   "web.question.multi_hint": "select one or more",
-  "web.misc.command_unavailable": "command unavailable"
+  "web.misc.command_unavailable": "command unavailable",
+  "web.file.error.missing_path": "No file path was given.",
+  "web.file.error.outside_workspace": "This file is outside the agent workspace and cannot be opened.",
+  "web.file.error.protected_path": "This file is protected (secrets/VCS) and cannot be opened.",
+  "web.file.error.too_large": "File is too large to open in the browser ({limit} bytes max).",
+  "web.file.error.binary_file": "This looks like a binary file and cannot be shown as text.",
+  "web.file.error.not_found": "File not found (it may be a directory or it was deleted).",
+  "web.file.error.workspace_unavailable": "No workspace is open."
 }

package/dist/i18n/ru.json

@@ -1148,7 +1148,7 @@
   "web.tool.output_few": "вывод · {count} символа",
   "web.tool.output_many": "вывод · {count} символов",
   "web.tool.collapse": "свернуть",
-  "web.card.view": "открыть ↗",
+  "web.card.open": "открыть ↗",
   "web.card.screenshot": "снимок экрана",
   "web.card.attached_image": "прикреплённое изображение",
   "web.card.browser_viewport": "браузер · область просмотра",
@@ -1157,6 +1157,13 @@
   "web.question.answered": "отвечено",
   "web.question.multi_hint": "выбери один или несколько",
   "web.misc.command_unavailable": "команда недоступна",
+  "web.file.error.missing_path": "Не указан путь к файлу.",
+  "web.file.error.outside_workspace": "Файл вне рабочей папки агента — открыть нельзя.",
+  "web.file.error.protected_path": "Файл защищён (секреты/VCS) — открыть нельзя.",
+  "web.file.error.too_large": "Файл слишком большой для показа в браузере (максимум {limit} байт).",
+  "web.file.error.binary_file": "Похоже на бинарный файл — текстом показать нельзя.",
+  "web.file.error.not_found": "Файл не найден (возможно, это папка или он удалён).",
+  "web.file.error.workspace_unavailable": "Рабочая папка не открыта.",
   "config.desc.model": "Модель основного агента.",
   "config.desc.provider.active": "Какой из настроенных провайдеров используется.",
   "config.desc.contextWindow": "Общий размер контекста в токенах (системный промпт + история + резерв).",

package/dist/main.js

@@ -3668,7 +3668,7 @@ Updated: {updatedAt}`,
     "web.tool.output_few": "output · {count} chars",
     "web.tool.output_many": "output · {count} chars",
     "web.tool.collapse": "collapse",
-    "web.card.view": "view ↗",
+    "web.card.open": "open ↗",
     "web.card.screenshot": "screenshot",
     "web.card.attached_image": "attached image",
     "web.card.browser_viewport": "browser · viewport",
@@ -3676,7 +3676,14 @@ Updated: {updatedAt}`,
     "web.question.send": "send",
     "web.question.answered": "answered",
     "web.question.multi_hint": "select one or more",
-    "web.misc.command_unavailable": "command unavailable"
+    "web.misc.command_unavailable": "command unavailable",
+    "web.file.error.missing_path": "No file path was given.",
+    "web.file.error.outside_workspace": "This file is outside the agent workspace and cannot be opened.",
+    "web.file.error.protected_path": "This file is protected (secrets/VCS) and cannot be opened.",
+    "web.file.error.too_large": "File is too large to open in the browser ({limit} bytes max).",
+    "web.file.error.binary_file": "This looks like a binary file and cannot be shown as text.",
+    "web.file.error.not_found": "File not found (it may be a directory or it was deleted).",
+    "web.file.error.workspace_unavailable": "No workspace is open."
   };
 });
 
@@ -4899,7 +4906,7 @@ var init_ru = __esm(() => {
     "web.tool.output_few": "вывод · {count} символа",
     "web.tool.output_many": "вывод · {count} символов",
     "web.tool.collapse": "свернуть",
-    "web.card.view": "открыть ↗",
+    "web.card.open": "открыть ↗",
     "web.card.screenshot": "снимок экрана",
     "web.card.attached_image": "прикреплённое изображение",
     "web.card.browser_viewport": "браузер · область просмотра",
@@ -4908,6 +4915,13 @@ var init_ru = __esm(() => {
     "web.question.answered": "отвечено",
     "web.question.multi_hint": "выбери один или несколько",
     "web.misc.command_unavailable": "команда недоступна",
+    "web.file.error.missing_path": "Не указан путь к файлу.",
+    "web.file.error.outside_workspace": "Файл вне рабочей папки агента — открыть нельзя.",
+    "web.file.error.protected_path": "Файл защищён (секреты/VCS) — открыть нельзя.",
+    "web.file.error.too_large": "Файл слишком большой для показа в браузере (максимум {limit} байт).",
+    "web.file.error.binary_file": "Похоже на бинарный файл — текстом показать нельзя.",
+    "web.file.error.not_found": "Файл не найден (возможно, это папка или он удалён).",
+    "web.file.error.workspace_unavailable": "Рабочая папка не открыта.",
     "config.desc.model": "Модель основного агента.",
     "config.desc.provider.active": "Какой из настроенных провайдеров используется.",
     "config.desc.contextWindow": "Общий размер контекста в токенах (системный промпт + история + резерв).",
@@ -17044,7 +17058,7 @@ class Agent {
     }, phase);
     onPhase?.(phase);
   }
-  async run(input, onChunk, onMeta, onTool, onPhase) {
+  async run(input, onChunk, onMeta, onTool, onPhase, onReasoning) {
     this.shutdownRequested = false;
     this.abortController = new AbortController;
     this.setScope();
@@ -17130,14 +17144,14 @@ class Agent {
         toolExecutor,
         logger,
         baseDir: this.deps.baseDir
-      }, input, () => this.executeSingleAgentLoop(input, slog, onChunk, onMeta, countTool, onPhase), {
+      }, input, () => this.executeSingleAgentLoop(input, slog, onChunk, onMeta, countTool, onPhase, onReasoning), {
         onMeta,
         onTool: countTool,
         onPhase,
         signal: this.abortController.signal,
         onEvent: (event) => slog.logMoE(event.type, event.data),
         sessionId: this.deps.sessionManager?.getActiveMeta()?.id
-      }) : await this.executeSingleAgentLoop(input, slog, onChunk, onMeta, countTool, onPhase);
+      }) : await this.executeSingleAgentLoop(input, slog, onChunk, onMeta, countTool, onPhase, onReasoning);
       if (moeEnabled && result.moeHandled) {
         if (result.text) {
           contextManager.addMessage({ role: "assistant", content: result.text });
@@ -17161,7 +17175,7 @@ class Agent {
       throw err;
     }
   }
-  async executeSingleAgentLoop(input, slog, onChunk, onMeta, onTool, onPhase) {
+  async executeSingleAgentLoop(input, slog, onChunk, onMeta, onTool, onPhase, onReasoning) {
     const {
       config,
       llmProvider,
@@ -17284,7 +17298,7 @@ class Agent {
             break;
           if (chunk.type === "text" && chunk.content) {
             if (emittedReasoning && !textContent) {
-              onMeta?.(`
+              onReasoning?.(`
 
 `);
             }
@@ -17297,7 +17311,7 @@ class Agent {
             if (config.showReasoning) {
               const metaOut = pluginManager.runOnMeta({ iteration: state.iteration, logger, contextManager }, chunk.content);
               if (metaOut) {
-                onMeta?.(pc.dim(metaOut));
+                onReasoning?.(metaOut);
               }
               emittedReasoning = true;
             }
@@ -17686,7 +17700,6 @@ var init_agent = __esm(() => {
   init_manager();
   init_factory();
   init_i18n();
-  init_colors();
   init_utils();
   init_prompt_builder();
   init_processes();
@@ -45601,7 +45614,7 @@ ${pc.green(t("repl.agent"))}`);
         } else {
           renderer.thinkingEnd();
         }
-      });
+      }, (reasoning) => renderer.reasoning(reasoning));
       renderer.flush();
       if (result.provider && result.model) {
         renderer.footer(result.model, result.provider, result.llmDurationMs ?? result.durationMs ?? 0);
@@ -46431,6 +46444,25 @@ function safeEqual(a, b) {
     return false;
   return timingSafeEqual2(ab, bb);
 }
+var AUTH_COOKIE = "mma_web_auth";
+function cookieValue(header, name) {
+  if (!header)
+    return null;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1)
+      continue;
+    if (part.slice(0, eq).trim() === name) {
+      const raw = part.slice(eq + 1).trim();
+      try {
+        return decodeURIComponent(raw);
+      } catch {
+        return null;
+      }
+    }
+  }
+  return null;
+}
 function checkAuth(req, reqUrl, s) {
   if (!s.token)
     return true;
@@ -46438,7 +46470,15 @@ function checkAuth(req, reqUrl, s) {
   if (typeof header === "string" && safeEqual(header, s.token))
     return true;
   const query = reqUrl.searchParams.get("token");
-  return query !== null && safeEqual(query, s.token);
+  if (query !== null && safeEqual(query, s.token))
+    return true;
+  const cookie = cookieValue(req.headers.cookie, AUTH_COOKIE);
+  return cookie !== null && safeEqual(cookie, s.token);
+}
+function setAuthCookie(res, s) {
+  if (!s.token)
+    return;
+  res.setHeader("Set-Cookie", `${AUTH_COOKIE}=${encodeURIComponent(s.token)}; Path=/; HttpOnly; SameSite=Strict`);
 }
 function sameOrigin(req, reqUrl) {
   const origin = req.headers.origin;
@@ -46816,18 +46856,22 @@ function clipToolOutput(toolName, output) {
 var DEFAULT_FLUSH_MS = 350;
 function makeForwarder(s, sink = (ev) => broadcast(ev, s), opts = {}) {
   const flushMs = opts.flushMs ?? DEFAULT_FLUSH_MS;
-  let buf = { text: "", meta: "" };
+  let buf = { text: "", meta: "", reasoning: "" };
   let timer = null;
   const flush = () => {
     if (timer)
       clearTimeout(timer);
     timer = null;
+    if (buf.reasoning) {
+      sink({ type: "reasoning", ts: Date.now(), chunk: stripAnsi2(buf.reasoning) });
+      buf.reasoning = "";
+    }
     if (buf.text) {
-      sink({ type: "text", ts: Date.now(), chunk: buf.text });
+      sink({ type: "text", ts: Date.now(), chunk: stripAnsi2(buf.text) });
       buf.text = "";
     }
     if (buf.meta) {
-      sink({ type: "meta", ts: Date.now(), chunk: buf.meta });
+      sink({ type: "meta", ts: Date.now(), chunk: stripAnsi2(buf.meta) });
       buf.meta = "";
     }
   };
@@ -46844,6 +46888,10 @@ function makeForwarder(s, sink = (ev) => broadcast(ev, s), opts = {}) {
       buf.meta += chunk;
       schedule();
     },
+    onReasoning(chunk) {
+      buf.reasoning += chunk;
+      schedule();
+    },
     onPhase(phase) {
       flush();
       sink({ type: "phase", ts: Date.now(), phase });
@@ -46867,7 +46915,7 @@ function makeForwarder(s, sink = (ev) => broadcast(ev, s), opts = {}) {
         name: call.name,
         success: result.success,
         durationMs,
-        output: redactContextSecrets(clipToolOutput(call.name, result.output || ""))
+        output: stripAnsi2(redactContextSecrets(clipToolOutput(call.name, result.output || "")))
       });
     },
     onPlan(plan) {
@@ -47137,7 +47185,7 @@ function handleAnswerPost(req, res, s) {
 // src/modules/webui/history-api.ts
 init_context_log();
 function scrub(text) {
-  return text ? redactContextSecrets(text) : undefined;
+  return text ? stripAnsi2(redactContextSecrets(text)) : undefined;
 }
 function mapLogEntry(e) {
   switch (e.type) {
@@ -47766,6 +47814,106 @@ function handleProvidersApi(req, res, reqUrl, s) {
   return false;
 }
 
+// src/modules/webui/file-api.ts
+init_protected_paths();
+init_i18n();
+import { readFile as readFile2, realpath, stat as stat2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute6, relative as relative10, resolve as resolve26, sep as sep3 } from "node:path";
+var MAX_FILE_VIEW_BYTES = 512 * 1024;
+function sendTextError(res, status2, key, vars) {
+  res.writeHead(status2, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  res.end(t(key, vars));
+}
+function decodeText(buf) {
+  if (buf.length >= 2 && buf[0] === 255 && buf[1] === 254) {
+    return { text: buf.subarray(2).toString("utf16le"), binary: false };
+  }
+  if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) {
+    const body2 = buf.subarray(2);
+    const even = body2.length - body2.length % 2;
+    const swapped = Buffer.from(body2.subarray(0, even));
+    swapped.swap16();
+    return { text: swapped.toString("utf16le"), binary: false };
+  }
+  const body = buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191 ? buf.subarray(3) : buf;
+  if (body.includes(0))
+    return { text: "", binary: true };
+  return { text: body.toString("utf8"), binary: false };
+}
+function escapes(base, target) {
+  const rel = relative10(base, target);
+  return rel === ".." || rel.startsWith(".." + sep3) || isAbsolute6(rel);
+}
+function handleFileApi(req, res, reqUrl, s) {
+  if (reqUrl.pathname !== "/api/file" || req.method !== "GET")
+    return false;
+  const base = s.workspace;
+  if (!base) {
+    sendTextError(res, 503, "web.file.error.workspace_unavailable");
+    return true;
+  }
+  const raw = reqUrl.searchParams.get("path") ?? "";
+  if (!raw) {
+    sendTextError(res, 400, "web.file.error.missing_path");
+    return true;
+  }
+  const abs = isAbsolute6(raw) ? resolve26(raw) : resolve26(base, raw);
+  if (escapes(resolve26(base), abs)) {
+    sendTextError(res, 403, "web.file.error.outside_workspace");
+    return true;
+  }
+  serveFile(res, base, abs);
+  return true;
+}
+async function serveFile(res, base, abs) {
+  let baseReal;
+  let absReal;
+  try {
+    baseReal = await realpath(resolve26(base));
+    absReal = await realpath(abs);
+  } catch {
+    sendTextError(res, 404, "web.file.error.not_found");
+    return;
+  }
+  if (escapes(baseReal, absReal)) {
+    sendTextError(res, 403, "web.file.error.outside_workspace");
+    return;
+  }
+  if (matchProtectedPath(baseReal, absReal)) {
+    sendTextError(res, 403, "web.file.error.protected_path");
+    return;
+  }
+  try {
+    const info = await stat2(absReal);
+    if (!info.isFile()) {
+      sendTextError(res, 404, "web.file.error.not_found");
+      return;
+    }
+    if (info.size > MAX_FILE_VIEW_BYTES) {
+      sendTextError(res, 413, "web.file.error.too_large", {
+        limit: String(MAX_FILE_VIEW_BYTES)
+      });
+      return;
+    }
+    const buf = await readFile2(absReal);
+    const { text, binary } = decodeText(buf);
+    if (binary) {
+      sendTextError(res, 415, "web.file.error.binary_file");
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": "text/plain; charset=utf-8",
+      "Cache-Control": "no-store"
+    });
+    res.end(text);
+  } catch {
+    sendTextError(res, 404, "web.file.error.not_found");
+  }
+}
+
 // src/modules/webui/server.ts
 var MAX_CLIENTS = parseMaxClients(process.env.MMA_WEBUI_MAX_CLIENTS);
 function parseMaxClients(raw) {
@@ -47859,6 +48007,9 @@ function handleApi(req, res, reqUrl, s) {
   if (handleProvidersApi(req, res, reqUrl, s)) {
     return;
   }
+  if (handleFileApi(req, res, reqUrl, s)) {
+    return;
+  }
   if (reqUrl.pathname === "/api/models" && req.method === "GET") {
     handleModelsGet(res, s);
     return;
@@ -47903,6 +48054,7 @@ function handleRequest(req, res, assets, s) {
       sendJson(res, 401, { error: "unauthorized" });
       return;
     }
+    setAuthCookie(res, s);
     handleEvents(req, res, s);
     return;
   }
@@ -47921,6 +48073,7 @@ function handleRequest(req, res, assets, s) {
       sendJson(res, 403, { error: "cross-origin requests are not allowed" });
       return;
     }
+    setAuthCookie(res, s);
     handleApi(req, res, reqUrl, s);
     return;
   }
@@ -47942,7 +48095,7 @@ function startServer(assets, s = getDefaultState()) {
     return Promise.reject(new Error(`refusing to bind ${s.host} without a token (non-loopback)`));
   }
   const desired = Number(process.env.MMA_WEBUI_PORT) || 0;
-  s.starting = new Promise((resolve26, reject) => {
+  s.starting = new Promise((resolve27, reject) => {
     const srv = createServer((req, res) => handleRequest(req, res, assets, s));
     srv.on("error", (err) => {
       s.starting = null;
@@ -47954,7 +48107,7 @@ function startServer(assets, s = getDefaultState()) {
       const port = typeof addr === "object" && addr ? addr.port : desired;
       s.url = `http://${s.host}:${port}`;
       s.starting = null;
-      resolve26(s.url);
+      resolve27(s.url);
     });
   });
   return s.starting;
@@ -48115,7 +48268,7 @@ async function startWebUi(deps) {
           if (plan)
             forwarder.onPlan(plan);
         }
-      }, (phase) => forwarder.onPhase(phase));
+      }, (phase) => forwarder.onPhase(phase), (reasoning) => forwarder.onReasoning(reasoning));
       state.usage = captureUsage(result, deps.config.contextWindow);
       forwarder.onTurnEnd({
         success: result.success,
@@ -48244,13 +48397,13 @@ async function runWeb(opts) {
   getDefaultChannel().writeLine(t("cli.web_started", { url }));
   if (!opts.noOpen)
     tryOpenBrowser(url);
-  await new Promise((resolve26) => {
+  await new Promise((resolve27) => {
     const shutdown = () => {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       web.stop();
       agent.shutdown();
-      resolve26();
+      resolve27();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -48676,7 +48829,7 @@ async function main() {
         } else {
           renderer.thinkingEnd();
         }
-      });
+      }, (reasoning) => renderer.reasoning(reasoning));
     } catch (err) {
       result = {
         success: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {