feat(control): command API for external agents, covering every feature

Agents no longer probe and click the UI. They call commands
(GET /commands, POST /commands/<name>) and the UI shows what each
command changed: the tab or panel comes to the front and flashes, the
status bar names the step, the activity log keeps it (docs/adr/0007).

230 commands across app, menu, workspace, ssh, tabs, files, editor,
search, preview, browser, mini apps, csv, hex, embed, settings, lua,
macro, terminal, tasks, pm2, git, ai, goal and schedule. A decision a
user would make in a dialog is an argument; without it the command
answers 409 with `needs`. Skill v4 carries recipes for each domain and
a command reference generated from the registry.

Bugs found by driving every domain live and fixed:
- A dialog the app opened during a command (the reload prompt that a
  CSV preview save raises in the file's text editor) held the answer
  until the user closed it. ControlApi::execute now cancels a modal or
  popup opened while the handler is on the stack and reports it as
  `dismissedDialogs`.
- app.quit counted only modified buffers, so an editor whose file was
  deleted still raised the save prompt after "discard"; the file watch
  also learns of a deletion late. It now refreshes file state, uses the
  window's own rule, and pre-answers the window's prompt for that close
  only.
- preview.open fell back to any non-editor tab (a terminal); git.diff
  with nothing tracked changed failed instead of answering an empty
  diff; agent edits bypassed the macro recorder; settings.list was
  empty (moc ignores `public slots:` inside a macro); terminal.read
  counted blank rows; git commands answered with stale status.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: nullmastermind

README.md

@@ -14,7 +14,7 @@ In a chat, a finished turn folds into a single "Worked for 2m14s" row; click it
 
 There is also a Goal Agent: pick an ACP judge (Claude Code, Codex, Opencode) or a Custom API endpoint that speaks Anthropic's Messages API. You set success criteria and it drives the working agent until those criteria hold, or attach a goal to an existing conversation. Criteria presets can be saved globally, or into the current project's `.agents/.goals` folder so they travel with the repo; files already in that folder show up in the load list. A judge that needs a human action, or that hits the iteration cap with the criterion still unmet, stops and hands the criterion back instead of marking the goal done. With Prefix /goal checked, the first criterion is sent immediately when the agent supports `/goal`. If a reply is still running and the agent does not support `/goal`, that goal waits in the send queue so the current reply is not stopped. Later criteria wait until the previous is achieved. Send with Goal defaults to the agent's own `/goal` command instead: each criterion goes out on its own, with no separate judge. A `/goal` typed in the composer is sent while a turn is still running only when the agent supports that command; otherwise it waits in the queue. A goal is not judged, and auto compact does not run, while the agent still has background tasks running or a wake-up turn pending. When a goal is achieved, the session can compact automatically. Prompts sent while an agent is still working are queued and delivered when it finishes. AI chats group by project, with a session strip to switch conversations in the same dock. Open chats come back after a restart and resume their agent session on the first prompt. A local Claude Code chat can be moved to another agent from the agent button in the dock's title bar, keeping its transcript. The composer can ask the agent to work in a new git worktree. When you commit, AI can write the commit message from your staged diff. That generator (and other LLM calls) can talk to an OpenAI-compatible endpoint or Anthropic's Messages API. Leave the commit box empty (when not amending) and Commit lets you pick an ACP agent to do the commit. Protocol details and how to wire up a custom ACP agent are in [doc/AcpAgents.md](doc/AcpAgents.md).
 
-An outside AI agent can also drive NotepadAI itself. AI ▸ Connect External Agent turns on a local HTTP API (off by default, token-protected) and gives you a prompt to hand to the agent; it fetches a skill from the app describing how to use it. The agent works only through the controls you see: menus, buttons, fields, tabs, editors, terminals and chats, each step highlighted on screen and listed in an activity log, with a Stop button in the status bar. Workspaces, terminals and tasks, AI sessions, goals, git, settings and pane sizes are all reachable this way.
+An outside AI agent can also drive NotepadAI itself. AI ▸ Connect External Agent turns on a local HTTP API (off by default, token-protected) and gives you a prompt to hand to the agent; it fetches a skill from the app describing how to use it. The agent gives NotepadAI commands (open a file, edit it, run a command in a terminal, send a prompt to an AI session and answer its questions, commit and push, change a setting) and the UI shows each one as it happens: what it changed comes to the front and flashes, the status bar names the step, and an activity log lists every step, with a Stop button in the status bar. Workspaces, files and editors, search, terminals and tasks, pm2 processes, git, AI sessions, goals, scheduled tasks, the browser and settings all have commands; the app lists them with their arguments, so the skill's reference is always current.
 
 ### Git
 

src/AcpAgentPicker.h

@@ -22,7 +22,6 @@
 #include "AcpAgentDefinition.h"
 #include "AcpAgentIcons.h"
 #include "AcpAgentRegistry.h"
-#include "control/ControlIds.h"
 
 #include <QAction>
 #include <QFont>
@@ -61,7 +60,6 @@ inline void fillAcpAgentPickerMenu(QMenu *menu,
         return;
     for (const AcpAgentDefinition &agent : agents) {
         QAction *action = menu->addAction(acpAgentIcon(agent, menu->palette()), agent.name);
-        control::ids::setKey(action, QStringLiteral("agent:") + agent.id);
         if (agent.id == defaultId) {
             QFont f = action->font();
             f.setBold(true);

src/ApplicationSettings.h

@@ -55,11 +55,14 @@ class ApplicationSetting
 };
 
 
+// The getter is invokable and the setter a slot so the Control API can list,
+// read and change every setting through the meta-object (settings.list /
+// settings.set, docs/adr/0007). Q_SLOT, not "public slots:": moc ignores an
+// access section inside a macro, so the setters were missing from it.
 #define DEFINE_SETTING(name, lname, type)\
 public:\
-    type lname() const;\
-public slots:\
-    void set##name(type lname);\
+    Q_INVOKABLE type lname() const;\
+    Q_SLOT void set##name(type lname);\
 Q_SIGNAL\
     void lname##Changed(type lname);\
 

src/CMakeLists.txt

@@ -595,42 +595,43 @@ qt_add_executable(NotepadAI
 	pm2/Pm2ProcessesDialog.h
 	pm2/Pm2ProcessesDialog.cpp
 	pm2/pm2.qrc
-	control/ControlActionIndex.h
-	control/ControlActionIndex.cpp
 	control/ControlActivityLog.h
 	control/ControlActivityLog.cpp
 	control/ControlApi.h
 	control/ControlApi.cpp
-	control/ControlAppAdapters.h
-	control/ControlAppAdapters.cpp
 	control/ControlApiDialog.h
-	control/ControlScreenshot.h
-	control/ControlScreenshot.cpp
 	control/ControlApiDialog.cpp
 	control/ControlAudit.h
 	control/ControlAudit.cpp
 	control/ControlAuth.h
 	control/ControlAuth.cpp
-	control/ControlEffects.h
-	control/ControlEffects.cpp
+	control/ControlCommands.h
+	control/ControlCommands.cpp
 	control/ControlEvents.h
 	control/ControlEvents.cpp
 	control/ControlFeedback.h
 	control/ControlFeedback.cpp
 	control/ControlHttp.h
 	control/ControlHttp.cpp
-	control/ControlIds.h
-	control/ControlIds.cpp
+	control/ControlScreenshot.h
+	control/ControlScreenshot.cpp
 	control/ControlServer.h
 	control/ControlServer.cpp
 	control/ControlStatusIndicator.h
 	control/ControlStatusIndicator.cpp
-	control/ControlAdapter.h
-	control/ControlStandardAdapters.cpp
-	control/ControlPicker.h
-	control/ControlPicker.cpp
-	control/ControlUiTree.h
-	control/ControlUiTree.cpp
+	control/commands/Registrar.h
+	control/commands/Registrar.cpp
+	control/commands/AppCommands.cpp
+	control/commands/SettingsCommands.cpp
+	control/commands/WorkspaceCommands.cpp
+	control/commands/EditorCommands.cpp
+	control/commands/PreviewCommands.cpp
+	control/commands/TerminalCommands.cpp
+	control/commands/Pm2Commands.cpp
+	control/commands/GitCommands.cpp
+	control/commands/AiCommands.cpp
+	control/commands/TransferCommands.cpp
+	control/commands/CsvCommands.cpp
 	control/control.qrc
 	MiniAppDefinition.h
 	MiniAppMenuLayout.h

src/CrocShareFlow.cpp

@@ -43,9 +43,11 @@ CrocShareFlow::CrocShareFlow(QWidget *dialogParent)
             m_loadDlg->setLabelText(text);
     });
     connect(m_croc, &CrocTool::codePhraseReady, this, [this](const QString &phrase) {
+        emit phraseReady(phrase);
         showPhrase(phrase);
     });
     connect(m_croc, &CrocTool::sendFinished, this, [this]() {
+        emit finished();
         if (m_phraseDlg)
             m_phraseDlg->close();
         cleanupTemp();
@@ -78,14 +80,17 @@ CrocShareFlow::CrocShareFlow(QWidget *dialogParent)
         // Temp dir lives until this flow is destroyed; destroy after extract starts.
         // Extract reads the zip on a worker; keep tmp until zip transfer completes.
         connect(m_zip, &FolderZipTransfer::transferCompleted, this, [this](int) {
+            emit finished();
             cleanupTemp();
             deleteLater();
         });
-        connect(m_zip, &FolderZipTransfer::transferError, this, [this](const QString &) {
+        connect(m_zip, &FolderZipTransfer::transferError, this, [this](const QString &msg) {
+            emit failed(msg);
             cleanupTemp();
             deleteLater();
         });
         connect(m_zip, &FolderZipTransfer::transferCancelled, this, [this]() {
+            emit failed(tr("The extraction was cancelled."));
             cleanupTemp();
             deleteLater();
         });
@@ -104,6 +109,17 @@ void CrocShareFlow::closeLoading()
 
 void CrocShareFlow::showError(const QString &msg)
 {
+    emit failed(msg);
+    if (m_quiet) {
+        closeLoading();
+        if (m_phraseDlg) {
+            m_phraseDlg->disconnect();
+            m_phraseDlg->hide();
+            m_phraseDlg->deleteLater();
+            m_phraseDlg = nullptr;
+        }
+        return;
+    }
     QWidget *anchor = m_parent;
     if (m_loadDlg) {
         m_loadDlg->disconnect();
@@ -174,7 +190,7 @@ void CrocShareFlow::shareFolder(FolderZipTransfer *zip, const QString &workspace
     m_zip = zip;
     m_tmp = new QTemporaryDir();
     if (!m_tmp->isValid()) {
-        QMessageBox::warning(m_parent, tr("croc"), tr("Could not create a temp folder."));
+        showError(tr("Could not create a temp folder."));
         deleteLater();
         return;
     }
@@ -192,11 +208,12 @@ void CrocShareFlow::shareFolder(FolderZipTransfer *zip, const QString &workspace
             m_croc->sendFile(m_zipPath);
         }, Qt::SingleShotConnection);
         connect(zip, &FolderZipTransfer::transferError, this, [this](const QString &msg) {
-            QMessageBox::warning(m_parent, tr("Zip"), msg);
+            showError(msg);
             cleanupTemp();
             deleteLater();
         }, Qt::SingleShotConnection);
         connect(zip, &FolderZipTransfer::transferCancelled, this, [this]() {
+            emit failed(tr("Zipping was cancelled."));
             cleanupTemp();
             deleteLater();
         }, Qt::SingleShotConnection);
@@ -249,24 +266,33 @@ void CrocShareFlow::showPhrase(const QString &phrase)
 void CrocShareFlow::receiveIntoFolder(FolderZipTransfer *zip, const QString &workspaceRoot,
                                       const QString &folderPath, bool ssh)
 {
-    m_zip = zip;
-    m_extractWorkspaceRoot = workspaceRoot;
-    m_extractTarget = folderPath;
-    m_extractSsh = ssh;
     bool ok = false;
     const QString phrase = QInputDialog::getText(m_parent, tr("croc code-phrase"),
                                                  tr("Code-phrase:"), QLineEdit::Normal,
                                                  QString(), &ok).trimmed();
-    if (!ok || !CrocTool::isValidCodePhrase(phrase)) {
-        if (ok)
-            QMessageBox::warning(m_parent, tr("croc"), tr("That does not look like a croc code-phrase."));
+    if (!ok) {
+        deleteLater();
+        return;
+    }
+    receiveIntoFolder(zip, workspaceRoot, folderPath, ssh, phrase);
+}
+
+void CrocShareFlow::receiveIntoFolder(FolderZipTransfer *zip, const QString &workspaceRoot,
+                                      const QString &folderPath, bool ssh, const QString &phrase)
+{
+    m_zip = zip;
+    m_extractWorkspaceRoot = workspaceRoot;
+    m_extractTarget = folderPath;
+    m_extractSsh = ssh;
+    if (!CrocTool::isValidCodePhrase(phrase)) {
+        showError(tr("That does not look like a croc code-phrase."));
         deleteLater();
         return;
     }
     ensureThen([this, phrase]() {
         m_tmp = new QTemporaryDir();
         if (!m_tmp->isValid()) {
-            QMessageBox::warning(m_parent, tr("croc"), tr("Could not create a temp folder."));
+            showError(tr("Could not create a temp folder."));
             deleteLater();
             return;
         }

src/CrocShareFlow.h

@@ -30,6 +30,18 @@ class CrocShareFlow : public QObject
                      const QString &folderPath, const QString &folderName, bool ssh);
     void receiveIntoFolder(FolderZipTransfer *zip, const QString &workspaceRoot,
                            const QString &folderPath, bool ssh);
+    // The same with the code-phrase given (the Control API) instead of asked.
+    void receiveIntoFolder(FolderZipTransfer *zip, const QString &workspaceRoot,
+                           const QString &folderPath, bool ssh, const QString &phrase);
+    // Errors reach the caller through failed() only, without a message box.
+    void setQuiet(bool quiet) { m_quiet = quiet; }
+
+signals:
+    // Sharing: the code-phrase to give the other side (also shown to the user).
+    void phraseReady(const QString &phrase);
+    // Sharing: the other side received it. Receiving: the files are extracted.
+    void finished();
+    void failed(const QString &message);
 
 private:
     void ensureThen(const std::function<void()> &next);
@@ -49,6 +61,7 @@ class CrocShareFlow : public QObject
     QString m_extractTarget;
     QString m_extractWorkspaceRoot;
     bool m_extractSsh = false;
+    bool m_quiet = false;
 };
 
 #endif // CROCSHAREFLOW_H