Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/tools/mod.rs

@@ -49,6 +49,10 @@ pub struct ToolCtx {
     pub agent: String,
     /// Directories this session may access (the owner's roots).
     pub roots: Vec<PathBuf>,
+    /// Shell sandbox of the session owner (None = run unsandboxed).
+    pub sandbox: Option<crate::sandbox::SandboxSpec>,
+    /// Craft clean room active for this session (no page sources, no binaries).
+    pub clean_room: bool,
 }
 
 impl ToolCtx {
@@ -71,6 +75,17 @@ impl ToolCtx {
         bail!("path {} is outside your directories ({})", norm.display(), allowed.join(", "))
     }
 
+    /// Like `resolve`, but also allows the read-only built-in resources (skill templates).
+    pub fn resolve_read(&self, p: &str) -> Result<PathBuf> {
+        let builtin = normalize(&crate::prompts::builtin_resources());
+        let raw = if Path::new(p.trim()).is_absolute() { PathBuf::from(p.trim()) } else { self.cwd.join(p.trim()) };
+        let norm = normalize(&raw);
+        if norm.starts_with(&builtin) {
+            return Ok(norm);
+        }
+        self.resolve(p)
+    }
+
     /// The root directory containing the working directory.
     pub fn root(&self) -> PathBuf {
         let mut roots = self.roots.clone();
@@ -140,7 +155,10 @@ pub fn builtin_tools() -> Vec<Arc<dyn Tool>> {
         Arc::new(fs::Glob),
         Arc::new(fs::Grep),
         Arc::new(bash::Bash),
+        Arc::new(crate::shells::BashOutput),
+        Arc::new(crate::shells::KillShell),
         Arc::new(web::WebFetch),
+        Arc::new(web::WebSearch),
         Arc::new(agent::TodoWrite),
         Arc::new(agent::AskUser),
         Arc::new(agent::Task),
@@ -148,6 +166,8 @@ pub fn builtin_tools() -> Vec<Arc<dyn Tool>> {
         Arc::new(craft::ImageCompare),
         Arc::new(crate::prompts::SkillTool),
         Arc::new(crate::images::GenerateImage),
+        Arc::new(crate::reverse::BinaryInfo),
+        Arc::new(crate::reverse::Decompile),
     ]
 }