…#1599)

* fix(dashboard): scope session list to current workspace + fix new-chat flow

Two related sidebar bugs:

1. The session list was unfiltered — users with thousands of subagent
   transcripts (`subagent-sub-*.jsonl`) and cross-workspace sessions
   in `~/.reasonix/sessions/` saw 10 000+ entries. The CLI's session
   picker already uses `listSessionsForWorkspace(currentRootDir)`;
   the dashboard's GET /api/sessions handler now does the same when
   `ctx.getCurrentCwd()` is wired. Also surface `meta.summary` in the
   listing so the bridge stops falling back to bare session names.

2. Clicking "new chat" pushed an error card into the transcript via
   `$session_empty` ("loaded with no messages") and never updated
   state.currentSession, which left #1586's URL mirror pointing at
   the old session. The new endpoint echoes the freshly-minted
   session name, and the bridge fires a real `$session_loaded` with
   empty messages so the reducer resets cleanly and the URL flips.

Sessions-ops test grows by two cases covering each behaviour.

* feat(dashboard): cross-session stability, persistent URL, polish pass

Squash-merges a chain of fixes prompted by post-#1418 user feedback on
the live web dashboard. The unifying themes: nothing should change
when you don't expect it to (token, port, URL, SSE stream), and
everything should give visible feedback when you do change it.

Server
- POST /api/sessions/new now echoes the new session name so the bridge
  can update state.currentSession without diffing the list.
- parseTranscript surfaces reasoning_content, tool_calls, and tool
  results (by tool_call_id) so historical replays show what the model
  actually did, not just the raw text turns.
- serveAsset injects ?token=... into CSS url() font references in
  addition to the existing JS-import rewrite — the previous gap 401'd
  every Geist / KaTeX font fetch.
- New /api/browse?path= lists immediate subdirectories (Windows drive
  letters included on first call) so the web runtime can ship a real
  directory picker.
- startDashboardServer exposes updateContext(ctx) — the handle now
  outlives a chat.tsx-driven App remount, and the new App rewires its
  loop/refs in place instead of forcing a port rebind that the OS
  hadn't released yet (EADDRINUSE -> ephemeral fallback -> new URL).
- Dashboard token + actual bound port are persisted to config.json on
  first run via ensureDashboardToken / saveDashboardPort, with an
  EADDRINUSE fallback to ephemeral. /dashboard reset-token rotates
  the token and restarts the server.

CLI
- listSessions workspace filter now reaches the dashboard's GET
  /api/sessions, cutting sidebar entries from "every subagent
  transcript on disk" (10 000+ for active users) down to the current
  workspace's chats.
- getDashboardUrl appends &session=<name> so the printed URL points
  at the attached session and survives copy/paste.

Dashboard UI
- Persistent module-level dashboardHandle + eventSubscribers Set so
  React App remounts (session swap) don't tear the server down and
  don't drop SSE subscribers on the floor — fixed the "send a message
  after switching, web stays silent" desync.
- session_load bridge handler emits $session_loaded with the new
  name and full segments (text + reasoning + tool calls stitched to
  results), instead of pushing an error card via $session_empty.
- Thread renders use index-based React keys for AssistantMsg —
  replayed transcripts arrive with turn=0 for every assistant row,
  so the turn-keyed list was collapsing every assistant message into
  one stale slot on every session switch.
- Sidebar gets a per-row loading spinner; thread shows a centered
  overlay during the swap so big sessions don't look dead.
- CSS containment on .session-item, .msg, and .thread; dropped a
  needless backdrop-filter on the loading overlay. Together these cut
  the Paint/Layout/pointerover budget noticeably on long transcripts.
- New WorkdirInputModal backed by /api/browse — the web build
  previously stub'd openDialog to "" so clicking Browse did nothing.
- Removed the "+ new tab" affordance from the tab bar (web has no
  multi-tab story).
- URL session mirror from #1586 reverted to read-on-mount only so
  clicking a session doesn't churn the address bar.

i18n
- statusbar.themeStyle{Graphite,Sandstone,Porcelain,Midnight}
- settings.themeStyle* + Desc, settings.page* Label + Desc for all 8
  pages, sidebarPanel.loading, workdir.{cancel,go,goTip,loading,
  emptyDir,openHere,pathPlaceholder}, handlers.dashboard.tokenReset*
  (en and zh-CN where relevant).

Tests
- tests/dashboard-token-persistence.test.ts (9 cases) for
  ensureDashboardToken / saveDashboardPort / clearDashboardToken.
- dashboard-sessions-ops gains coverage for the workspace filter
  and the new POST /sessions/new name echo.
- dashboard-smoke verifies CSS font url() token injection in
  addition to the existing JS chunk-import rewrite.

---------

Co-authored-by: reasonix <reasonix@deepseek.com>

…1618)

The dashboard's <select> for switching web search backends shipped in
#1558 against the old Preact panel; the React port (#1418) dropped it
silently and the i18n strings have been dead code since. The desktop
settings panel never had it. Both surfaces now expose the same dropdown
under General → Behavior, alongside reasoning effort / edit mode /
budget — six engines (bing, searxng, metaso, tavily, perplexity, exa)
matching the `/search-engine` slash.

- protocol: `webSearchEngine` on SettingsEvent + SettingsPatch in both
  desktop and dashboard mirrors
- backend: `src/cli/commands/desktop.ts` settings_save persists the
  field via writeConfig; emitSettings reads it back via webSearchEngine()
- dashboard bridge: emitServerSettings forwards the field from
  `GET /api/settings` (server side was already wired by #1558)
- desktop i18n: copies the six already-translated strings that were
  living only in the dashboard bundle

API keys for metaso / tavily / perplexity / exa still go through the
slash command (or config.json) — UI-side key entry can come later if
demand shows up.

Co-authored-by: reasonix <reasonix@deepseek.com>

…moved, persisted usage stats, plan dispatch gate

Headline themes:
- Desktop: bundle the CLI-hosted React dashboard, retire Tauri+Preact duplicate (#1418)
- Config: drop preset abstraction; flash/pro are direct model selections (#1657, #1630)
- Stats: persist cumulative usage to session meta + auto-restore on startup (#1667, #1680, #1643, #1628)
- Plans: editMode="plan" enforced at the ToolRegistry dispatch gate (#1681); step advance fix (#1629)
- Context: fold once at turn start, drop pre-flight + byte-ceiling (#1642, #1646); collapsible compacted card (#1649)
- Subagents: per-skill flash/pro override + Settings UI (#1632)
- Desktop polish: sidebar drag-resize (#1688), responsive collapse (#1585), copy/edit overlay + msg-history nav (#1645), Esc closes modal not turn (#1685), QQ tab isolation (#1672), DiffCard for edits (#1662), theme-aware highlighting (#1655), system events toggle (#1654/#1650), macOS TCC inheritance (#1614), dashboard.enabled (#1612)
- Dashboard polish: persistent session URL (#1586, #1589, #1599), theme-aware highlighting (#1664), IME confirm-enter guard (#1689), code-fence lang fix (#1677), vendor chunk split (#1587), markdown table h-scroll (#1562)
- TUI: Alt+S input stash/recall; static history isolated from input rerenders (#1635); legacy mouse drop (#1637, #1648); multi-edit gated in review (#1647)
- Diff: SplitDiff column border holds under CJK (#1686)
- MCP: workspace roots passed to servers (#1625); codeCommand honors mcpServers (#1603)
- Config plumbing: (baseUrl, apiKey) resolved as a tuple (#1658); stale model id self-heal (#1663)

See CHANGELOG for the full list.

…tests find dist/

Dashboard smoke tests added in #1418 read `dashboard/dist/app.js` and
`app.css` at filesystem level. They pass under `npm run verify` (which
builds first) but fail under `npm publish`, whose `prepublishOnly` ran
in `lint → typecheck → test → build` order — tests fire before the
artifacts they need exist.

Reorder to `lint → typecheck → build → test` so the publish-time gate
matches the verify-time gate. Caught when the v0.50.0 publish-npm.yml
run failed before reaching `npm publish`.