Streaming endpoints no longer end silently when the upstream dies, and
idle streams stay alive through proxies.

- services/sse_proxy.py: proxy_sse() now emits an `event: error` SSE
  message carrying the canonical envelope when the upstream generator
  raises mid-stream (the `_done` sentinel is reserved for clean
  completion), and yields `: keepalive` comment lines every ~15s while
  the upstream is idle. Non-dict JSON payloads are wrapped as
  {"raw": ...} instead of crashing the stream.
- services/routes.py: the CLK/AutoGUI stream endpoints pass the
  request id through so mid-stream error envelopes are correlatable.
- app.py /api/chat: the run_loop error events now carry the envelope
  ({"message": ..., "error": {code, message, hint, request_id}} — the
  legacy "message" field is kept for older clients and the e2e SSE
  helpers), failures are logged server-side, and the event stream emits
  `: keepalive` comments whenever the queue is idle for 15s (model
  thinking, long tool runs, approval dialogs).
- static/app.js: the chat `error` SSE handler reads the structured
  envelope (message + hint + request-id ref) for the transcript entry
  and additionally surfaces the failure via the existing flash() toast.
  Keepalive comment lines are already ignored by consumeSSE (no data:).
- tests/test_services.py: TestProxySSE (clean stream, mid-stream and
  immediate upstream failure envelopes, keepalive comments) and
  TestChatSSEErrors (internal error envelope, HTTPException
  status→code mapping, chat keepalive comments).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

- Add pyproject.toml configuring ruff (E, F, W, I; E501 exempted since the
  existing style favours long lines) and mypy (lenient globally with
  ignore_missing_imports; services/ fully typed via per-module overrides).
- Fix all ruff findings mechanically: import sorting (I001), one-line
  multiple imports (E401), mid-file import moved to top (test_services.py),
  ambiguous variable name l -> lite (E741), and two intentional late
  imports marked noqa: E402 with justification.
- Fully annotate services/: return types on all route handlers and the
  stream_task async generators, typed dicts in health.py/clients.py, and
  typed _PROVIDER_META plus a variable rename in oauth.py to fix an
  Optional reuse. No behavior change.
- CI lint job: replace the pyflakes-only step with ruff check + mypy
  services/ (pinned versions, requirements installed so mypy sees real
  fastapi/httpx types).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

- Add self-contained eslint flat config (eslint.config.js, no plugin deps so
  `npx eslint` works with zero node_modules) targeting genuine errors only;
  .prettierrc documents the existing style (2-space, double quotes, semis)
  and is intentionally not gated to avoid a mass reformat.
- Fix the only lint findings: prefer-const on pendingWorkspaceFiles, plus
  two missing browser globals declared in config (Element, ImageCapture).
- Extract 5 pure helpers from app.js into new static/lib.js: escape,
  humanLabelForTool, friendlyError, fillTemplate, and parseSSEBlock (SSE
  block parsing pulled out of consumeSSE). lib.js loads before
  browser-store.js/app.js via a classic script tag (zero-build preserved)
  and has a module.exports guard so node can require it.
- Add tests/js/lib.test.js: 16 unit tests runnable with
  `node --test "tests/js/*.test.js"` (plain node test runner).
- CI: new js-quality job (Node 22) running eslint + node --test; lint job
  file checks now cover static/lib.js.
- tests/test_frontend.py updated for the extraction (helpers asserted in
  lib.js, load-order test, no-duplication test): suite now 379 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

- app.py: fold the Phase-1 logging setup into _configure_logging() — level
  now comes from BWUI_LOG_LEVEL (default INFO), rotating file + stderr
  handlers, request-id filter attached to every root handler so rid= is
  stamped consistently (background tasks log rid=-).
- Background paths: the lifespan MCP-reconcile print() is now a logged
  exception; the boot-time upload sweep and per-server MCP shutdown
  failures are logged warnings instead of silent passes; scheduler tick
  failures now log with a traceback (log.exception). No control flow
  changed.
- Concurrency audit (scheduler.py + services/state.py): the scheduler tick
  held a pre-run snapshot of scheduled_tasks.json across the awaited
  run_callback (minutes for LLM runs) and wrote it back afterwards,
  silently reverting any /api/scheduled-tasks add/edit/delete made during
  the run and resurrecting deleted tasks. The tick now re-reads the file
  after each run and merges the outcome into the live task by id, under a
  new _TASKS_LOCK; the decide-what-is-due + next_run_at backfill phase is
  locked too. The sync CRUD helpers stay lock-free — they are await-free
  and thus event-loop-atomic — with that invariant documented at the lock
  and in services/state.py (whose helpers are safe for the same reason).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

app.py (4,700 lines) is now a 391-line composition root: FastAPI init,
request-id middleware, exception handlers, lifespan, static mounts, and
router registration. Everything else moved out:

Domain logic → services/ (all strict-mypy clean):
  catalog.py         static registries (endpoint profiles, MCP/CLI, onboarding)
  storage.py         path constants + JSON persistence + conversation store
  request_ctx.py     request-id contextvar / log filter / accessor
  session.py         approvals, file responses, session trust, local-caller gate
  mcp.py             MCP stdio client + manager singleton
  skills.py          skill files + config lints
  llm.py             chat_complete, endpoint discovery, models, message shaping
  prompt_builder.py  tool protocol + system-prompt assembly + tool-call parsing
  tools.py           shell, checkpoints, media/web tools, subagents, execute_tool
  transient.py       TTL-swept per-chat uploads
  scheduled.py       scheduled-task runner + notification queue

Route handlers → routers/ (one APIRouter per domain, included by app.py):
  admin, skills_prompts, session_trust, workspaces, onboarding, project,
  mcp_cli, uploads, scheduled, oauth_routes, conversations, chat
  (chat.py also carries the BWUI_TEST_MODE-only test endpoints).

Compatibility invariants (test suite passes unchanged, 379 passed):
- `from app import X` keeps working via identity re-exports.
- Names the tests rebind (conftest's path constants, WORKSPACE_DIR
  assignment, patch("app.chat_complete"), patch("app._sse_keepalive_interval"))
  are served by data-descriptor properties on a ModuleType subclass that
  forward get/set/delete to the owning services module; handlers read those
  values via module-attribute access at call time, so patches stay effective.
  The delete path parks a sentinel so mock.patch's delattr-then-restore exit
  sequence restores the original into the owning module.
- Routers import only from services/, never from app — no import cycles.

mypy gate extended: routers/ now checked with the same strict settings as
services/ (pyproject override + ci.yml runs `mypy services/ routers/`).
verification.py got a one-line explicit None-guard so the strict gate can
follow its import from routers/chat.py.

Gates: pytest 379 passed · ruff clean · mypy services/ routers/ clean ·
eslint clean · node --test 16 pass · uvicorn boot + curl smoke all 200.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

static/app.js (3,849 lines) is now 15 native ES modules under static/js/,
loaded via <script type="module" src="/static/js/main.js"> — still no build
step. Code is verbatim from the old file; the only changes are `export`
keywords on top-level declarations and generated `import` lines (derived
mechanically from eslint no-undef until the graph converged).

  state.js               shared `state` object + $/$$ helpers (imports nothing)
  api.js                 fetch wrappers + local-download helpers
  render.js              markdown/KaTeX + message rendering + read-aloud
  settings.js            display settings, Settings tab, models, prompts, skills
  workspaces.js          workspace CRUD/export/import
  tools_tab.js           MCP servers + CLI shortcuts
  conversations.js       list/search/pin/tag/fork
  composer.js            attachments, image annotation, voice input
  panels.js              task-plan + file-tree panes
  dialogs.js             approval / file-request / generic focus-trapped dialog
  chat.js                send pipeline + /api/chat SSE loop
  onboarding.js          first-run wizard
  bundles_memories.js    IndexedDB bundles + user memories
  scheduled.js           scheduled-tasks tab
  main.js                keyboard shortcuts, tab wiring, init() (entry point)

Window-global inventory (checked before the split): index.html has ZERO
inline onclick/onchange handlers and app.js assigned no window globals, so
nothing needed export-and-attach. The globals the modules consume — lib.js
helpers (escape, humanLabelForTool, friendlyError, fillTemplate,
parseSSEBlock), browser-store.js's `bws`, and the CDN libs (marked,
DOMPurify, katex, renderMathInElement) — stay classic scripts loaded before
the module entry, exactly as before. lib.js is untouched, so
`node --test tests/js/` still passes (16/16).

static/app.js remains as a 12-line forwarding shim (`import("/static/js/
main.js")`) so browsers with a stale cached index.html still boot and
tests/test_api.py::TestStatic (which fetches /static/app.js and may not be
edited) keeps passing.

eslint: new sourceType:"module" block for static/js/** with no-import-assign.
tests/test_frontend.py updated minimally: APP_JS is now the concatenation of
static/js/*.js; the two link-order assertions target /static/js/main.js. All
other assertions (function presence, load order, no-duplication, no inline
handlers, no console.log) are unchanged and still pass.
ci.yml: smoke now curls every static/js/*.js (+ lib.js/browser-store.js),
UTF-8 and required-files checks point at the module tree.

Verified: eslint clean · node --test 16 pass · pytest 379 passed · every
module 200 via uvicorn with text/javascript MIME · module graph parses under
`node --check` and all 14 non-entry modules evaluate in Node without error
(no import-cycle TDZ at eval time).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9

static/style.css (2,142 lines) is now five stylesheets under static/css/,
loaded via ordered <link> tags in index.html (cascade order preserved —
verified byte-equivalent to the original when concatenated):

  base.css        256   design tokens, a11y themes, skip link, focus, type, forms
  layout.css      400   sidebar, 3-pane layout + right rail, plan/file panes
  chat.css        568   chat header, messages, composer
  components.css  505   dialogs, spinner, scrollbars, rich content, Tools tab
  overlays.css    413   onboarding, modal overlays, toasts, responsive, cards

(The suggested "panels.css" bucket folded into layout.css because the pane
rules are contiguous with the 3-pane layout section; "overlays.css" covers
the tail sections instead.)

static/style.css stays as a 5-line @import aggregator in the same order, so
the old URL keeps serving real CSS for stale cached index.html copies and
for tests/test_api.py::TestStatic::test_style_css_served, which may not be
edited.

tests/test_frontend.py updated minimally: STYLE_CSS is the concatenation of
the split files in cascade order, and test_style_css_linked now asserts the
five links appear in order. Every rule assertion is unchanged and passes.
ci.yml: smoke curls every static/css/*.css (+ the aggregator); UTF-8 and
required-files checks cover the split tree.

Verified: pytest 379 passed · ruff/mypy/eslint clean · node --test 16 pass ·
uvicorn boot with all six CSS URLs 200 (text/css) and index.html linking the
five files in order.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jUkqbwroQmYRAdFDsp5r9