v0.0.8

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>

README.md

@@ -9,10 +9,10 @@
 > A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.  
 > Think Burp Suite or Caido, but entirely in your terminal.
 
-[![Go Version](https://img.shields.io/github/go-mod/go-version/anotherhadi/spilltea)](go.mod)
-[![Release](https://img.shields.io/github/v/release/anotherhadi/spilltea)](https://github.com/anotherhadi/spilltea/releases)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Go Report Card](https://goreportcard.com/badge/github.com/anotherhadi/spilltea)](https://goreportcard.com/report/github.com/anotherhadi/spilltea)
+![GitHub Stars](https://www.shieldcn.dev/github/stars/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+![Release](https://www.shieldcn.dev/github/release/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+![CI](https://www.shieldcn.dev/github/ci/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+[![Ko-fi](https://www.shieldcn.dev/badge/Ko--fi-sponsor-FF5E5B.svg?logo=kofi&variant=secondary&theme=violet)](https://ko-fi.com/anotherhadi)
 
 <!-- START doctoc generated TOC please keep comment here to allow auto update -->
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
@@ -23,6 +23,7 @@
 - [Installation](#installation)
 - [Project Management](#project-management)
 - [Configuration](#configuration)
+  - [Per-project configuration](#per-project-configuration)
 - [CLI Flags](#cli-flags)
 - [Plugin System](#plugin-system)
 - [Vim / Neovim Integration](#vim--neovim-integration)
@@ -107,9 +108,9 @@ Spilltea organizes work into **projects**. Each project maps to a SQLite databas
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
@@ -118,20 +119,38 @@ Check the default configuration with all the options [here](./internal/config/de
 
 Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
 
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
 <!-- endexec -->
 

cmd/spilltea/main.go

@@ -15,7 +15,7 @@ import (
 	"github.com/anotherhadi/spilltea/internal/style"
 	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
 	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
-	flag "github.com/spf13/pflag"
+	"github.com/spf13/cobra"
 )
 
 // Version is overwritten at build time by goreleaser/ldflag with the current version tag, or "dev" if not set.
@@ -32,122 +32,150 @@ func init() {
 
 func main() {
 	var (
-		flagConfig            = flag.StringP("config", "c", "", "path to config file")
-		flagPluginsDir        = flag.String("plugins-dir", "", "path to plugins dir (overrides config)")
-		flagHost              = flag.String("host", "", "proxy host (overrides config)")
-		flagPort              = flag.IntP("port", "p", 0, "proxy port (overrides config)")
-		flagUpstreamProxy     = flag.String("upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
-		flagVersion           = flag.BoolP("version", "v", false, "print version")
-		flagProject           = flag.StringP("project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
-		flagAddDefaultPlugins = flag.Bool("add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
-		flagAddDefaultConfig  = flag.Bool("add-default-config", false, "copy the default config file to the config path and exit")
+		flagConfig            string
+		flagPluginsDir        string
+		flagHost              string
+		flagPort              int
+		flagUpstreamProxy     string
+		flagProject           string
+		flagSslInsecure       bool
+		flagAddDefaultPlugins bool
+		flagAddDefaultConfig  bool
 	)
-	flag.CommandLine.SetOutput(os.Stdout)
-	flag.Usage = func() {
-		fmt.Println("Usage: spilltea [flags]")
-		fmt.Println("")
-		flag.PrintDefaults()
-	}
-	flag.Parse()
 
-	if *flagVersion {
-		fmt.Println(version)
-		os.Exit(0)
+	rootCmd := &cobra.Command{
+		Use:           "spilltea",
+		Short:         "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.",
+		Version:       version,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if flagAddDefaultPlugins {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
+				}
+				if err := config.Load(cfgPath); err != nil {
+					return fmt.Errorf("config: %w", err)
+				}
+				dir := config.ExpandPath(config.Global.App.PluginsDir)
+				if flagPluginsDir != "" {
+					dir = flagPluginsDir
+				}
+				n, err := spilltea.InstallDefaultPlugins(dir)
+				if err != nil {
+					return fmt.Errorf("add-default-plugins: %w", err)
+				}
+				fmt.Printf("added %d plugin(s) to %s\n", n, dir)
+				return nil
+			}
+
+			if flagAddDefaultConfig {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
+				}
+				if err := config.WriteDefaultConfig(cfgPath); err != nil {
+					return fmt.Errorf("add-default-config: %w", err)
+				}
+				fmt.Printf("default config written to %s\n", cfgPath)
+				return nil
+			}
+
+			if flagProject != "" && !homeUI.IsValidProjectName(flagProject) {
+				return fmt.Errorf("project: invalid name %q (only lowercase letters, digits, - and _ are allowed)", flagProject)
+			}
+
+			home, _ := os.UserHomeDir()
+			cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+			if flagConfig != "" {
+				cfgPath = flagConfig
+			}
+
+			if err := config.Load(cfgPath); err != nil {
+				return fmt.Errorf("config: %w", err)
+			}
+			config.Global.Version = version
+
+			sslInsecureChanged := cmd.Flags().Changed("ssl-insecure")
+			applyCLI := func(c *config.Config) {
+				if flagPluginsDir != "" {
+					c.App.PluginsDir = flagPluginsDir
+				}
+				if flagHost != "" {
+					c.App.Host = flagHost
+				}
+				if flagPort != 0 {
+					c.App.Port = flagPort
+				}
+				if flagUpstreamProxy != "" {
+					c.App.UpstreamProxy = flagUpstreamProxy
+				}
+				if sslInsecureChanged {
+					c.App.SslInsecure = flagSslInsecure
+				}
+			}
+			applyCLI(config.Global)
+			config.SetCLIOverrides(applyCLI)
+
+			style.Init()
+			icons.Init(config.Global)
+			keys.Init(config.Global)
+
+			projectDir := config.ExpandPath(config.Global.App.ProjectDir)
+
+			if flagProject != "" {
+				project, err := homeUI.OpenProject(projectDir, flagProject)
+				if err != nil {
+					return fmt.Errorf("project: %w", err)
+				}
+				if err := config.MergeProjectConfig(filepath.Dir(project.Path)); err != nil {
+					return fmt.Errorf("project config: %w", err)
+				}
+				icons.Init(config.Global)
+				keys.Init(config.Global)
+				broker := intercept.NewBroker()
+				m := appUI.New(broker, project.Name, project.Path)
+				final, err := tea.NewProgram(m).Run()
+				if err != nil {
+					return fmt.Errorf("tui: %w", err)
+				}
+				if app, ok := final.(appUI.Model); ok {
+					if ferr := app.FatalErr(); ferr != nil {
+						return ferr
+					}
+				}
+				return nil
+			}
+
+			root := rootModel{home: homeUI.New(projectDir)}
+			final, err := tea.NewProgram(root).Run()
+			if err != nil {
+				return fmt.Errorf("tui: %w", err)
+			}
+			if r, ok := final.(rootModel); ok {
+				if ferr := r.FatalErr(); ferr != nil {
+					return ferr
+				}
+			}
+			return nil
+		},
 	}
 
-	if *flagAddDefaultPlugins {
-		home, _ := os.UserHomeDir()
-		cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
-		}
-		if err := config.Load(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "config: %v\n", err)
-			os.Exit(1)
-		}
-		dir := config.ExpandPath(config.Global.App.PluginsDir)
-		if *flagPluginsDir != "" {
-			dir = *flagPluginsDir
-		}
-		n, err := spilltea.InstallDefaultPlugins(dir)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-plugins: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Printf("added %d plugin(s) to %s\n", n, dir)
-		os.Exit(0)
-	}
+	rootCmd.Flags().StringVarP(&flagConfig, "config", "c", "", "path to config file")
+	rootCmd.Flags().StringVar(&flagPluginsDir, "plugins-dir", "", "path to plugins dir (overrides config)")
+	rootCmd.Flags().StringVar(&flagHost, "host", "", "proxy host (overrides config)")
+	rootCmd.Flags().IntVarP(&flagPort, "port", "p", 0, "proxy port (overrides config)")
+	rootCmd.Flags().StringVar(&flagUpstreamProxy, "upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
+	rootCmd.Flags().BoolVar(&flagSslInsecure, "ssl-insecure", false, "skip TLS certificate verification (overrides config)")
+	rootCmd.Flags().StringVarP(&flagProject, "project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
+	rootCmd.Flags().BoolVar(&flagAddDefaultPlugins, "add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
+	rootCmd.Flags().BoolVar(&flagAddDefaultConfig, "add-default-config", false, "copy the default config file to the config path and exit")
 
-	if *flagAddDefaultConfig {
-		home, _ := os.UserHomeDir()
-		cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
-		}
-		if err := config.WriteDefaultConfig(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-config: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Printf("default config written to %s\n", cfgPath)
-		os.Exit(0)
-	}
-
-	if *flagProject != "" && !homeUI.IsValidProjectName(*flagProject) {
-		fmt.Fprintf(os.Stderr, "project: invalid name %q (only lowercase letters, digits, - and _ are allowed)\n", *flagProject)
-		os.Exit(1)
-	}
-
-	home, _ := os.UserHomeDir()
-	cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-	if *flagConfig != "" {
-		cfgPath = *flagConfig
-	}
-
-	if err := config.Load(cfgPath); err != nil {
-		fmt.Fprintf(os.Stderr, "config: %v\n", err)
-		os.Exit(1)
-	}
-	config.Global.Version = version
-
-	if *flagPluginsDir != "" {
-		config.Global.App.PluginsDir = *flagPluginsDir
-	}
-	if *flagHost != "" {
-		config.Global.App.Host = *flagHost
-	}
-	if *flagPort != 0 {
-		config.Global.App.Port = *flagPort
-	}
-	if *flagUpstreamProxy != "" {
-		config.Global.App.UpstreamProxy = *flagUpstreamProxy
-	}
-
-	style.Init()
-	icons.Init(config.Global)
-	keys.Init(config.Global)
-
-	projectDir := config.ExpandPath(config.Global.App.ProjectDir)
-
-	// If --project flag is set, skip the home screen entirely.
-	if *flagProject != "" {
-		project, err := homeUI.OpenProject(projectDir, *flagProject)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "project: %v\n", err)
-			os.Exit(1)
-		}
-		broker := intercept.NewBroker()
-		m := appUI.New(broker, project.Name, project.Path)
-		if _, err := tea.NewProgram(m).Run(); err != nil {
-			fmt.Fprintf(os.Stderr, "tui: %v\n", err)
-			os.Exit(1)
-		}
-		return
-	}
-
-	// Run home + app in a single program to avoid a blank flash on transition.
-	root := rootModel{home: homeUI.New(projectDir)}
-	if _, err := tea.NewProgram(root).Run(); err != nil {
-		fmt.Fprintf(os.Stderr, "tui: %v\n", err)
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }

cmd/spilltea/root.go

@@ -1,8 +1,14 @@
 package main
 
 import (
+	"log"
+	"path/filepath"
+
 	tea "charm.land/bubbletea/v2"
+	"github.com/anotherhadi/spilltea/internal/config"
+	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/intercept"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
 	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
 )
@@ -34,6 +40,11 @@ func (m rootModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	if m.state == rootStateHome {
 		if sel, ok := msg.(homeUI.ProjectSelectedMsg); ok {
+			if err := config.MergeProjectConfig(filepath.Dir(sel.Project.Path)); err != nil {
+				log.Printf("project config: %v", err)
+			}
+			icons.Init(config.Global)
+			keys.Init(config.Global)
 			broker := intercept.NewBroker()
 			app := appUI.New(broker, sel.Project.Name, sel.Project.Path)
 			m.app = app
@@ -58,3 +69,12 @@ func (m rootModel) View() tea.View {
 	}
 	return m.home.View()
 }
+
+func (m rootModel) FatalErr() error {
+	if m.state == rootStateApp {
+		if app, ok := m.app.(appUI.Model); ok {
+			return app.FatalErr()
+		}
+	}
+	return nil
+}

docs/basics.md

@@ -4,9 +4,9 @@ Spilltea organizes work into **projects**. Each project maps to a SQLite databas
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
@@ -15,20 +15,38 @@ Check the default configuration with all the options [here](./internal/config/de
 
 Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
 
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 <!-- exec: echo '```' && go run ./cmd/spilltea -h && echo '```' -->
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
 <!-- endexec -->

docs/main.md

@@ -11,5 +11,7 @@
 # Spilltea Documentation
 
 - **Version**: `{{.Cfg.Version}}`
+- **Proxy**: `{{.Cfg.App.Host}}:{{.Cfg.App.Port}}`
+- **SSL Insecure**: `{{.Cfg.App.SslInsecure}}`
 - **Repository**: `https://github.com/anotherhadi/spilltea`
 - **Sponsor this project**: `https://ko-fi.com/anotherhadi`

docs/plugins.md

@@ -155,7 +155,7 @@ If the user **dismisses** a finding it is permanently hidden and will never reap
 
 ## Configuration
 
-Plugin configuration is stored in a `plugins.yaml` file alongside the project database.
+Plugin configuration is stored in a `plugins.yaml` file alongside the project database and can be edited through the "Proxy" TUI page.
 Each plugin is keyed by its filename (without the `.lua` extension) and has an `enable` toggle and an optional `config` block (arbitrary YAML).
 
 ```yaml

docs/proxy.md

@@ -1,6 +1,12 @@
 ## Configuring your browser's proxy settings
 
-We recommend installing **FoxyProxy** to manage your browser's proxies.
+**If you use Nix**, you can launch a pre-configured browser (LibreWolf) with the proxy and certificate already set up:
+
+```sh
+nix run github:anotherhadi/spilltea#browser{{if or (ne .Cfg.App.Host "127.0.0.1") (ne .Cfg.App.Port 8080) (ne .Cfg.App.CertDir "~/.local/share/spilltea")}} --{{end}}{{if ne .Cfg.App.Host "127.0.0.1"}} --host {{.Cfg.App.Host}}{{end}}{{if ne .Cfg.App.Port 8080}} --port {{.Cfg.App.Port}}{{end}}{{if ne .Cfg.App.CertDir "~/.local/share/spilltea"}} --cert-dir {{.Cfg.App.CertDir}}{{end}}
+```
+
+Otherwise, we recommend installing **FoxyProxy** to manage your browser's proxies.
 You can install it from the [Google Chrome extension store](https://chromewebstore.google.com/) or from the [Firefox extension store](https://addons.mozilla.org/en-US/firefox/extensions)
 
 1. Open FoxyProxy's options, then click on `Add New Proxy` button.

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/yuin/gopher-lua v1.1.2
-	golang.org/x/net v0.54.0
+	golang.org/x/net v0.55.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.50.1
 )
@@ -41,6 +41,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-runewidth v0.0.23 // indirect
@@ -55,6 +56,7 @@ require (
 	github.com/satori/go.uuid v1.2.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.8.2 // indirect
@@ -62,7 +64,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -44,6 +44,7 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
@@ -72,6 +73,8 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
 github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -104,6 +107,7 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
@@ -116,6 +120,9 @@ github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
@@ -140,12 +147,12 @@ golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

internal/config/config.go

@@ -28,6 +28,7 @@ type Config struct {
 		ProxyAuth      string `mapstructure:"proxy_auth"`
 		MaxBodySizeMB  int    `mapstructure:"max_body_size_mb"`
 		ExternalEditor string `mapstructure:"external_editor"`
+		SslInsecure    bool   `mapstructure:"ssl_insecure"`
 	} `mapstructure:"app"`
 
 	TUI struct {
@@ -64,6 +65,43 @@ type GlobalPlugin struct {
 
 var Global *Config
 
+var projectCLIOverrides func(*Config)
+
+// SetCLIOverrides stores a function that re-applies CLI flag overrides.
+// It is called automatically after MergeProjectConfig so that CLI flags
+// always win over both global and per-project config.
+func SetCLIOverrides(fn func(*Config)) {
+	projectCLIOverrides = fn
+}
+
+// MergeProjectConfig merges <projectDir>/config.yaml on top of the current
+// Global config, then re-applies any registered CLI overrides.
+// If no config.yaml exists in the project directory, this is a no-op.
+func MergeProjectConfig(projectDir string) error {
+	projectConfigPath := filepath.Join(projectDir, "config.yaml")
+	if _, err := os.Stat(projectConfigPath); errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	pv := viper.New()
+	pv.SetConfigFile(projectConfigPath)
+	if err := pv.ReadInConfig(); err != nil {
+		return fmt.Errorf("project config: %w", err)
+	}
+	if err := viper.MergeConfigMap(pv.AllSettings()); err != nil {
+		return fmt.Errorf("merge project config: %w", err)
+	}
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	if projectCLIOverrides != nil {
+		projectCLIOverrides(Global)
+	}
+	return nil
+}
+
 func Load(path string) error {
 	var defaults map[string]any
 	if err := yaml.Unmarshal(defaultConfig, &defaults); err != nil {
@@ -82,11 +120,16 @@ func Load(path string) error {
 	}
 
 	Global = &Config{}
-	return viper.Unmarshal(Global)
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	return nil
 }
 
 func WriteDefaultConfig(path string) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
 		return fmt.Errorf("create config dir: %w", err)
 	}
 	if err := os.WriteFile(path, defaultConfig, 0o600); err != nil {
@@ -106,6 +149,17 @@ func ExpandPath(p string) string {
 	return p
 }
 
+// expandEnvValue replaces a value starting with "$" with the corresponding
+// environment variable, enabling secrets to be kept out of config files.
+func expandEnvValue(s string) string {
+	if len(s) > 1 && s[0] == '$' {
+		if val := os.Getenv(s[1:]); val != "" {
+			return val
+		}
+	}
+	return s
+}
+
 func flatten(prefix string, m map[string]any) map[string]any {
 	out := make(map[string]any)
 	for k, v := range m {

internal/config/default_config.yaml

@@ -4,15 +4,16 @@ app:
   cert_dir: ~/.local/share/spilltea
   project_dir: ~/.local/share/spilltea
   plugins_dir: ~/.config/spilltea/plugins
-  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or http://user:pass@host:8888
-  proxy_auth: "" # require basic auth to use the proxy, format: user:pass (empty = disabled). Also run: chmod 600 ~/.config/spilltea/config.yaml
+  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or $ENV_VAR
+  proxy_auth: "" # require basic auth to use the spilltea proxy, format: user:pass or $ENV_VAR (empty = disabled).
   max_body_size_mb: 50 # max response body size read into memory for large streamed responses (MB)
   external_editor: "" # override $EDITOR for external editing (e.g. nvim, code --wait)
+  ssl_insecure: false # bypass TLS certificate verification (enable for self-signed cert targets)
 
 intercept:
   default_intercept_enabled: true
   default_capture_response: false
-  queue_size: 64 # max pending intercepted requests/responses before the proxy blocks
+  queue_size: 128 # max pending intercepted requests/responses before the proxy blocks
   auto_forward_regex:
     - '\.(js|css|png|gif|ico|woff2?|ttf|svg)(\?.*)?$'
 
@@ -31,12 +32,13 @@ tui:
 keybindings:
   global:
     quit: "q,ctrl+c"
+    escape: "esc,ctrl+c"
     help: "?"
     open_logs: "ctrl+g"
     toggle_sidebar: "ctrl+b"
     cycle_focus: "tab"
     send_to_replay: "ctrl+r"
-    send_to_diff: "ctrl+d"
+    send_to_diff: "ctrl+x"
     copy_as: "ctrl+y"
     copy: "y"
     up: "up,k"
@@ -45,10 +47,10 @@ keybindings:
     right: "right,l"
     goto_top: "g"
     goto_bottom: "G,end"
-    scroll_up: "pgup"
-    scroll_down: "pgdown"
-    prev_page: "["
-    next_page: "]"
+    scroll_up: "pgup,ctrl+u"
+    scroll_down: "pgdown,ctrl+d"
+    prev_page: "[,ctrl+i"
+    next_page: "],ctrl+o"
 
   intercept:
     toggle_intercept: "i"
@@ -59,7 +61,7 @@ keybindings:
     drop_all: "D"
     edit: "e,enter"
     edit_external: "E"
-    undo_edits: "ctrl+z"
+    undo_edits: "u,ctrl+z"
 
   history:
     delete_entry: "x"
@@ -77,15 +79,19 @@ keybindings:
     send: "s, enter"
     edit: "e"
     edit_external: "E"
-    undo_edits: "ctrl+z"
+    undo_edits: "u,ctrl+z"
     delete_entry: "x"
     delete_all: "X"
+    filter: "/"
+    flag: "m"
 
   diff:
     clear: "x"
 
   findings:
     dismiss: "x"
+    dismiss_all: "X"
+    flag: "m"
 
   plugins:
     toggle: "space"

internal/config/keybindings.go

@@ -2,6 +2,7 @@ package config
 
 type GlobalKeys struct {
 	Quit          string `mapstructure:"quit"`
+	Escape        string `mapstructure:"escape"`
 	OpenLogs      string `mapstructure:"open_logs"`
 	ToggleSidebar string `mapstructure:"toggle_sidebar"`
 	Help          string `mapstructure:"help"`
@@ -55,6 +56,8 @@ type ReplayKeys struct {
 	UndoEdits string `mapstructure:"undo_edits"`
 	Delete    string `mapstructure:"delete_entry"`
 	DeleteAll string `mapstructure:"delete_all"`
+	Filter    string `mapstructure:"filter"`
+	Flag      string `mapstructure:"flag"`
 }
 
 type DiffKeys struct {
@@ -62,7 +65,9 @@ type DiffKeys struct {
 }
 
 type FindingsKeys struct {
-	Dismiss string `mapstructure:"dismiss"`
+	Dismiss    string `mapstructure:"dismiss"`
+	DismissAll string `mapstructure:"dismiss_all"`
+	Flag       string `mapstructure:"flag"`
 }
 
 type PluginsKeys struct {

internal/db/db.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"database/sql"
+	"log"
 	"sync"
 
 	_ "modernc.org/sqlite"
@@ -25,17 +26,25 @@ func Open(path string) (*DB, error) {
 	conn.SetMaxOpenConns(1)
 	d := &DB{conn: conn, path: path}
 	if err := d.migrate(); err != nil {
-		conn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
 		return nil, err
 	}
 	roConn, err := sql.Open("sqlite", path)
 	if err != nil {
-		conn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
 		return nil, err
 	}
 	if _, err := roConn.Exec("PRAGMA query_only=ON"); err != nil {
-		conn.Close()
-		roConn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
+		if cerr := roConn.Close(); cerr != nil {
+			log.Printf("db: close roConn: %v", cerr)
+		}
 		return nil, err
 	}
 	d.roConn = roConn
@@ -70,7 +79,8 @@ CREATE TABLE IF NOT EXISTS replay_entries (
 			request_raw  TEXT NOT NULL,
 			response_raw TEXT NOT NULL,
 			status_code  INTEGER NOT NULL,
-			error_msg    TEXT NOT NULL
+			error_msg    TEXT NOT NULL,
+			flagged      INTEGER NOT NULL DEFAULT 0
 		);
 CREATE TABLE IF NOT EXISTS findings (
 			id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -80,6 +90,7 @@ CREATE TABLE IF NOT EXISTS findings (
 			description TEXT NOT NULL DEFAULT '',
 			severity    TEXT NOT NULL DEFAULT 'info',
 			dismissed   INTEGER NOT NULL DEFAULT 0,
+			flagged     INTEGER NOT NULL DEFAULT 0,
 			created_at  DATETIME NOT NULL,
 			UNIQUE(plugin_name, dedup_key)
 		);
@@ -114,6 +125,8 @@ func CountEntriesAt(path string) int {
 	}
 	defer conn.Close()
 	var n int
-	conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n)
+	if err := conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n); err != nil {
+		log.Printf("db: count entries: %v", err)
+	}
 	return n
 }

internal/db/entries.go

@@ -81,7 +81,11 @@ func scanEntries(rows *sql.Rows) ([]Entry, error) {
 		if err := rows.Scan(&e.ID, &ts, &e.Method, &e.Host, &e.Path, &e.StatusCode, &e.RequestRaw, &e.ResponseRaw, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse timestamp %q: %v", ts, tsErr)
+		}
 		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
@@ -121,7 +125,7 @@ func (d *DB) SearchEntries(term string) ([]Entry, error) {
 // Uses the persistent read-only connection (PRAGMA query_only=ON) so that any
 // DML or DDL in the user-supplied expression is rejected by SQLite before it executes.
 func (d *DB) QueryEntries(where string) ([]Entry, error) {
-	q := "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged FROM entries WHERE " + strings.TrimSpace(where)
+	q := "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged FROM entries WHERE " + strings.TrimSpace(where) // #nosec G202 -- intentional: user-supplied WHERE clause on a PRAGMA query_only=ON connection
 	rows, err := d.roConn.Query(q)
 	if err != nil {
 		return nil, err

internal/db/findings.go

@@ -11,6 +11,7 @@ type Finding struct {
 	Title       string
 	Description string
 	Severity    string
+	Flagged     bool
 	CreatedAt   time.Time
 }
 
@@ -34,7 +35,7 @@ func (d *DB) UpsertFinding(f Finding) (bool, error) {
 
 func (d *DB) LoadFindings() ([]Finding, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, plugin_name, dedup_key, title, description, severity, created_at
+		`SELECT id, plugin_name, dedup_key, title, description, severity, flagged, created_at
 		 FROM findings WHERE dismissed = 0 ORDER BY id ASC`,
 	)
 	if err != nil {
@@ -45,9 +46,11 @@ func (d *DB) LoadFindings() ([]Finding, error) {
 	for rows.Next() {
 		var f Finding
 		var ts string
-		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &ts); err != nil {
+		var flagged int
+		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &flagged, &ts); err != nil {
 			return nil, err
 		}
+		f.Flagged = flagged != 0
 		for _, layout := range findingTimeFormats {
 			if t, err := time.Parse(layout, ts); err == nil {
 				f.CreatedAt = t.Local()
@@ -63,3 +66,23 @@ func (d *DB) DismissFinding(id int64) error {
 	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE id = ?`, id)
 	return err
 }
+
+func (d *DB) ToggleFindingFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE findings SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
+// DismissAllFindings dismisses unflagged findings first. If none are unflagged
+// (only flagged ones remain), it dismisses everything.
+func (d *DB) DismissAllFindings() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM findings WHERE dismissed = 0 AND flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1`)
+	return err
+}

internal/db/replay.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"log"
 	"time"
 )
 
@@ -16,16 +17,17 @@ type ReplayEntry struct {
 	ResponseRaw string
 	StatusCode  int
 	ErrorMsg    string
+	Flagged     bool
 }
 
 func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 	res, err := d.conn.Exec(
-		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		e.Timestamp.UTC().Format(time.RFC3339),
 		e.Scheme, e.Host, e.Path, e.Method,
 		e.OriginalRaw, e.RequestRaw, e.ResponseRaw,
-		e.StatusCode, e.ErrorMsg,
+		e.StatusCode, e.ErrorMsg, e.Flagged,
 	)
 	if err != nil {
 		return 0, err
@@ -35,15 +37,15 @@ func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 
 func (d *DB) UpdateReplayEntry(e ReplayEntry) error {
 	_, err := d.conn.Exec(
-		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=? WHERE id=?`,
-		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.ID,
+		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=?, flagged=? WHERE id=?`,
+		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.Flagged, e.ID,
 	)
 	return err
 }
 
 func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg
+		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged
 		 FROM replay_entries ORDER BY id ASC`,
 	)
 	if err != nil {
@@ -55,16 +57,27 @@ func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	for rows.Next() {
 		var e ReplayEntry
 		var ts string
+		var flagged int
 		if err := rows.Scan(&e.ID, &ts, &e.Scheme, &e.Host, &e.Path, &e.Method,
-			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg); err != nil {
+			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse replay timestamp %q: %v", ts, tsErr)
+		}
+		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
 	return entries, rows.Err()
 }
 
+func (d *DB) ToggleReplayFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE replay_entries SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
 func (d *DB) DeleteReplayEntry(id int64) error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE id = ?`, id)
 	return err
@@ -74,3 +87,18 @@ func (d *DB) DeleteAllReplayEntries() error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
 	return err
 }
+
+// DeleteAllReplayEntriesExceptFlagged deletes all unflagged replay entries. If
+// none are unflagged (only flagged ones remain), it deletes everything.
+func (d *DB) DeleteAllReplayEntriesExceptFlagged() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM replay_entries WHERE flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
+	return err
+}

internal/icons/icons.go

@@ -48,6 +48,8 @@ func Init(cfg *config.Config) {
 			Flag:      "󰈻 ",
 		}
 	} else {
-		I = &Icons{}
+		I = &Icons{
+			Flag: "*",
+		}
 	}
 }

internal/intercept/format.go

@@ -14,6 +14,9 @@ func FormatRawRequest(f *proxy.Flow) string {
 	r := f.Request
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "%s %s %s\n", r.Method, r.URL.RequestURI(), r.Proto)
+	if r.URL.Host != "" {
+		fmt.Fprintf(&sb, "Host: %s\n", r.URL.Host)
+	}
 	for _, line := range util.SortedHeaderLines(r.Header) {
 		sb.WriteString(line)
 	}

internal/keys/findings.go

@@ -6,15 +6,19 @@ import (
 )
 
 type FindingsKeyMap struct {
-	Dismiss key.Binding
+	Dismiss    key.Binding
+	DismissAll key.Binding
+	Flag       key.Binding
 }
 
 func newFindingsKeyMap(cfg config.FindingsKeys) FindingsKeyMap {
 	return FindingsKeyMap{
-		Dismiss: binding(cfg.Dismiss, "dismiss"),
+		Dismiss:    binding(cfg.Dismiss, "dismiss"),
+		DismissAll: binding(cfg.DismissAll, "dismiss all"),
+		Flag:       binding(cfg.Flag, "flag"),
 	}
 }
 
 func (f FindingsKeyMap) Bindings() []key.Binding {
-	return []key.Binding{f.Dismiss}
+	return []key.Binding{f.Flag, f.Dismiss, f.DismissAll}
 }

internal/keys/global.go

@@ -41,7 +41,7 @@ func newGlobalKeyMap(cfg config.GlobalKeys) GlobalKeyMap {
 		CycleFocus:    binding(cfg.CycleFocus, "cycle focus"),
 		CopyAs:        binding(cfg.CopyAs, "copy as..."),
 		Copy:          binding(cfg.Copy, "copy..."),
-		Escape:        key.NewBinding(key.WithKeys("esc"), key.WithHelp("esc", "cancel")),
+		Escape:        binding(cfg.Escape, "cancel"),
 		SendToReplay:  binding(cfg.SendToReplay, "send to replay"),
 		ScrollUp:      binding(cfg.ScrollUp, "scroll up"),
 		ScrollDown:    binding(cfg.ScrollDown, "scroll down"),

internal/keys/replay.go

@@ -12,6 +12,8 @@ type ReplayKeyMap struct {
 	UndoEdits key.Binding
 	Delete    key.Binding
 	DeleteAll key.Binding
+	Filter    key.Binding
+	Flag      key.Binding
 }
 
 func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
@@ -22,9 +24,11 @@ func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
 		UndoEdits: binding(cfg.UndoEdits, "undo edits"),
 		Delete:    binding(cfg.Delete, "delete"),
 		DeleteAll: binding(cfg.DeleteAll, "delete all"),
+		Filter:    binding(cfg.Filter, "filter"),
+		Flag:      binding(cfg.Flag, "flag"),
 	}
 }
 
 func (r ReplayKeyMap) Bindings() []key.Binding {
-	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Delete, r.DeleteAll}
+	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Flag, r.Delete, r.DeleteAll, r.Filter}
 }

internal/plugins/lua.go

@@ -46,7 +46,7 @@ func newLuaState(mgr *Manager, p *Plugin) *lua.LState {
 func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 	L.SetGlobal("log", L.NewFunction(func(L *lua.LState) int {
 		msg := L.CheckString(1)
-		log.Printf("[plugin:%s] %s", p.Name, msg)
+		log.Printf("plugin %s: %s", p.Name, msg)
 		return 0
 	}))
 
@@ -85,7 +85,7 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 			CreatedAt:   time.Now(),
 		})
 		if err != nil {
-			log.Printf("[plugin:%s] create_finding error: %v", p.Name, err)
+			log.Printf("plugin %s: create_finding error: %v", p.Name, err)
 			return 0
 		}
 		_ = inserted
@@ -281,7 +281,7 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
 
-		c := exec.CommandContext(ctx, "sh", "-c", cmd)
+		c := exec.CommandContext(ctx, "sh", "-c", cmd) // #nosec G204 -- intentional: shell_pipe is a Lua plugin API for user-written scripts
 		c.Stdin = strings.NewReader(input)
 
 		var stdout, stderr bytes.Buffer
@@ -337,7 +337,7 @@ func luaTableString(t *lua.LTable, key string) string {
 	return ""
 }
 
-func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
+func pushRequest(L *lua.LState, p *Plugin, f *goproxy.Flow) *lua.LTable {
 	t := L.NewTable()
 	r := f.Request
 	L.SetField(t, "method", lua.LString(r.Method))
@@ -377,7 +377,7 @@ func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
 	L.SetField(t, "set_url", L.NewFunction(func(L *lua.LState) int {
 		parsed, err := url.Parse(L.CheckString(2))
 		if err != nil {
-			log.Printf("[plugin] set_url: %v", err)
+			log.Printf("plugin %s: set_url: %v", p.Name, err)
 			return 0
 		}
 		r.URL = parsed

internal/plugins/manager.go

@@ -395,25 +395,25 @@ func (m *Manager) runAsyncForPlugins(hookName string, argsFor func(*Plugin) []lu
 
 func (m *Manager) RunSyncOnRequest(f *goproxy.Flow) intercept.Decision {
 	return m.runSyncDecisionForPlugins("on_request", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f)}
 	})
 }
 
 func (m *Manager) RunAsyncOnRequest(f *goproxy.Flow) {
 	m.runAsyncForPlugins("on_request", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f)}
 	})
 }
 
 func (m *Manager) RunSyncOnResponse(f *goproxy.Flow) intercept.Decision {
 	return m.runSyncDecisionForPlugins("on_response", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f), pushResponse(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
 	})
 }
 
 func (m *Manager) RunAsyncOnResponse(f *goproxy.Flow) {
 	m.runAsyncForPlugins("on_response", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f), pushResponse(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
 	})
 }
 

internal/plugins/pluginsfile.go

@@ -1,6 +1,7 @@
 package plugins
 
 import (
+	"log"
 	"os"
 	"path/filepath"
 
@@ -27,7 +28,7 @@ func OpenPluginsFile(dbPath string) (*PluginsFile, error) {
 		path: path,
 		data: pluginsFileData{Plugins: make(map[string]pluginFileEntry)},
 	}
-	raw, err := os.ReadFile(path)
+	raw, err := os.ReadFile(path) // #nosec G304 -- path is filepath.Join(dbDir, "plugins.yaml"), hardcoded filename
 	if os.IsNotExist(err) {
 		return pf, nil
 	}
@@ -76,7 +77,9 @@ func (pf *PluginsFile) register(id string, defaultEnabled bool, configText strin
 			}
 		}
 		pf.data.Plugins[id] = entry
-		_ = pf.save()
+		if err := pf.save(); err != nil {
+			log.Printf("plugin %s: register save: %v", id, err)
+		}
 	}
 }
 

internal/proxy/proxy.go

@@ -120,6 +120,7 @@ func Start(broker *intercept.Broker, mgr *plugins.Manager) error {
 		StreamLargeBodies: int64(cfg.MaxBodySizeMB) * 1024 * 1024,
 		CaRootPath:        caPath,
 		Upstream:          cfg.UpstreamProxy,
+		SslInsecure:       cfg.SslInsecure,
 	}
 
 	p, err := goproxy.NewProxy(opts)

internal/ui/app/model.go

@@ -1,7 +1,6 @@
 package app
 
 import (
-	"fmt"
 	"log"
 	"os"
 	"path/filepath"
@@ -37,11 +36,9 @@ func tickCmd() tea.Cmd {
 	})
 }
 
-var sidebarEntries = pageRegistry
-
 var pageShortcuts = func() map[string]page {
-	m := make(map[string]page, len(sidebarEntries))
-	for i, e := range sidebarEntries {
+	m := make(map[string]page, len(pageRegistry))
+	for i, e := range pageRegistry {
 		m[strconv.Itoa(i+1)] = e.id
 	}
 	return m
@@ -55,6 +52,8 @@ type Model struct {
 	database      *db.DB
 	logFile       *os.File
 	pluginManager *plugins.Manager
+	fatalErr      error
+	logFileErr    error
 
 	width         int
 	height        int
@@ -96,8 +95,8 @@ func New(broker *intercept.Broker, name, path string) Model {
 
 	d, err := db.Open(path)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "db: %v\n", err)
-		os.Exit(1)
+		m.fatalErr = err
+		return m
 	}
 	m.database = d
 	broker.SetDB(d)
@@ -130,14 +129,18 @@ func New(broker *intercept.Broker, name, path string) Model {
 		m.logFile = lf
 		log.SetOutput(lf)
 		logrus.SetOutput(lf)
+	} else {
+		m.logFileErr = err
 	}
 
 	return m
 }
 
+func (m Model) FatalErr() error { return m.fatalErr }
+
 func (m Model) Init() tea.Cmd {
 	mgr := m.pluginManager
-	return tea.Batch(
+	cmds := []tea.Cmd{
 		intercept.WaitForRequest(m.broker),
 		intercept.WaitForResponse(m.broker),
 		tickCmd(),
@@ -146,5 +149,16 @@ func (m Model) Init() tea.Cmd {
 		plugins.WaitForQuit(mgr),
 		findingsUI.RefreshCmd(m.database),
 		func() tea.Msg { mgr.RunOnStart(); return nil },
-	)
+	}
+	if m.logFileErr != nil {
+		err := m.logFileErr
+		cmds = append(cmds, func() tea.Msg {
+			return notificationsUI.NotificationMsg{
+				Title: "Warning",
+				Body:  "Could not open log file: " + err.Error(),
+				Kind:  notificationsUI.KindWarning,
+			}
+		})
+	}
+	return tea.Batch(cmds...)
 }

internal/ui/app/sidebar.go

@@ -62,7 +62,7 @@ func (m *Model) renderSidebar() string {
 	var items strings.Builder
 	badgeUnread := lipgloss.NewStyle().Foreground(ilovetui.S.Warning).Bold(true)
 
-	for i, entry := range sidebarEntries {
+	for i, entry := range pageRegistry {
 		selected := entry.id == m.page
 		badgeStyle, textStyle := badgeNormal, textNormal
 		if selected {

internal/ui/app/update.go

@@ -2,7 +2,6 @@ package app
 
 import (
 	"log"
-	"os"
 	"os/exec"
 	"path/filepath"
 
@@ -21,6 +20,7 @@ import (
 	historyUI "github.com/anotherhadi/spilltea/internal/ui/history"
 	interceptUI "github.com/anotherhadi/spilltea/internal/ui/intercept"
 	replayUI "github.com/anotherhadi/spilltea/internal/ui/replay"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -107,16 +107,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case proxyPkg.ErrMsg:
 		if msg.Err != nil {
 			log.Printf("proxy error: %v", msg.Err)
-			return m, tea.Batch(
-				func() tea.Msg {
-					return notificationsUI.NotificationMsg{
-						Title: "Proxy Error",
-						Body:  msg.Err.Error(),
-						Kind:  notificationsUI.KindError,
-					}
-				},
-				tea.Quit,
-			)
+			m.fatalErr = msg.Err
+			return m, tea.Quit
 		}
 		return m, nil
 
@@ -170,23 +162,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, cmd
 
 	case tea.KeyPressMsg:
-		// ctrl+c always quits, even when a textarea is focused.
-		if msg.String() == "ctrl+c" {
-			m.pluginManager.RunOnQuit()
-			return m, tea.Quit
-		}
 		if key.Matches(msg, keys.Keys.Global.Quit) && !m.activeIsEditing() {
 			m.pluginManager.RunOnQuit()
 			return m, tea.Quit
 		}
 
 		if key.Matches(msg, keys.Keys.Global.OpenLogs) {
-			editor := os.Getenv("EDITOR")
-			if editor == "" {
-				editor = "vi"
-			}
 			logPath := filepath.Join(filepath.Dir(m.projectPath), "logs.log")
-			return m, tea.ExecProcess(exec.Command(editor, logPath), nil)
+			return m, tea.ExecProcess(exec.Command(util.ResolveEditor(), logPath), nil) // #nosec G204 G702 -- editor from trusted config/$EDITOR, logPath is a fixed path
 		}
 
 		if !m.activeIsEditing() {

internal/ui/app/view.go

@@ -6,25 +6,28 @@ import (
 	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
+func (m Model) newView(content string) tea.View {
+	v := tea.NewView(content)
+	v.AltScreen = true
+	v.WindowTitle = "Spilltea: " + m.projectName
+	return v
+}
+
 func (m Model) View() tea.View {
 	if m.width == 0 {
-		v := tea.NewView("")
-		v.AltScreen = true
-		return v
+		return m.newView("")
 	}
 
 	normal := m.renderNormal()
 
 	if m.copyAs.IsOpen() {
-		v := tea.NewView(m.copyAs.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copyAs.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
 
 	if m.copy.IsOpen() {
-		v := tea.NewView(m.copy.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copy.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
@@ -34,8 +37,7 @@ func (m Model) View() tea.View {
 		rendered = m.notifications.View(normal)
 	}
 
-	v := tea.NewView(rendered)
-	v.AltScreen = true
+	v := m.newView(rendered)
 	v.MouseMode = tea.MouseModeCellMotion
 	return v
 }

internal/ui/components/copyas/formats.go

@@ -16,7 +16,7 @@ type parsedRequest struct {
 	path    string
 	host    string
 	scheme  string
-	headers []header // garder header{key, value} pour compat locale
+	headers []header
 	body    string
 }
 

internal/ui/diff/model.go

@@ -300,7 +300,7 @@ func (m *Model) refreshViewports() {
 		placeholder := lipgloss.Place(
 			m.leftViewport.Width(), m.leftViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("<(^_^)>", "send two entries here to compare")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.leftViewport.Width(), "<(^_^)>", "send two entries here to compare")),
 		)
 		m.leftViewport.SetContent(placeholder)
 		m.rightViewport.SetContent("")
@@ -312,7 +312,7 @@ func (m *Model) refreshViewports() {
 		placeholder := lipgloss.Place(
 			m.rightViewport.Width(), m.rightViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(・3・)", "waiting for second entry…")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.rightViewport.Width(), "(・3・)", "waiting for second entry…")),
 		)
 		m.rightViewport.SetContent(placeholder)
 		return

internal/ui/docs/model.go

@@ -25,10 +25,10 @@ func readDoc(name string) string {
 
 var contentMarkdown = strings.Join([]string{
 	readDoc("main.md"),
-	readDoc("legal-disclaimer.md"),
-	readDoc("basics.md"),
 	readDoc("proxy.md"),
 	readDoc("certificate.md"),
+	readDoc("legal-disclaimer.md"),
+	readDoc("basics.md"),
 	readDoc("history.md"),
 }, "\n")
 

internal/ui/docs/update.go

@@ -18,12 +18,9 @@ func (e Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case tea.KeyPressMsg:
 		if e.searching {
 			switch {
-			case key.Matches(msg, d.SearchReset):
+			case key.Matches(msg, g.Escape):
 				e.searching = false
 				e.searchInput.Blur()
-				e.searchInput.SetValue("")
-				e.matches = nil
-				e.matchIndex = 0
 				e.SetSize(e.width, e.height)
 			case msg.String() == "enter":
 				e.searching = false

internal/ui/findings/model.go

@@ -186,7 +186,7 @@ type findingsKeyMap struct{ width int }
 func (findingsKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	f := keys.Keys.Findings
-	return []key.Binding{g.Up, g.Down, f.Dismiss, g.Copy, g.Help}
+	return []key.Binding{g.Up, g.Down, f.Flag, f.Dismiss, f.DismissAll, g.Copy, g.Help}
 }
 
 func (m findingsKeyMap) FullHelp() [][]key.Binding {

internal/ui/findings/update.go

@@ -72,6 +72,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.refreshListViewport()
 				m.refreshBody()
 			}
+		case key.Matches(msg, f.Flag):
+			if len(m.findings) > 0 && m.database != nil {
+				if err := m.database.ToggleFindingFlag(m.findings[m.cursor].ID); err != nil {
+					log.Printf("findings: toggle flag: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, f.Dismiss):
 			if len(m.findings) > 0 && m.database != nil {
 				if err := m.database.DismissFinding(m.findings[m.cursor].ID); err != nil {
@@ -80,6 +88,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				return m, RefreshCmd(m.database)
 			}
+		case key.Matches(msg, f.DismissAll):
+			if m.database != nil {
+				if err := m.database.DismissAllFindings(); err != nil {
+					log.Printf("findings: dismiss all: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, g.ScrollUp):
 			util.ScrollViewport(&m.bodyViewport, -1)
 		case key.Matches(msg, g.ScrollDown):

internal/ui/findings/view.go

@@ -52,7 +52,7 @@ func (m *Model) renderList() string {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(҂◡_◡) ᕤ", "no findings")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(҂◡_◡) ᕤ", "no findings")),
 		)
 	}
 
@@ -66,9 +66,10 @@ func (m *Model) renderList() string {
 		sevStyle := style.SeverityStyle(f.Severity)
 		sevLabel := sevStyle.Width(8).Render(f.Severity)
 		ts := f.CreatedAt.Format("15:04:05")
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 8 + 1 + 8 + 1 + 10 + 1
+		const fixedW = 2 + 2 + 8 + 1 + 8 + 1 + 10 + 1
 		titleW := w - fixedW
 		if titleW < 0 {
 			titleW = 0
@@ -79,8 +80,13 @@ func (m *Model) renderList() string {
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(ilovetui.S.Selection)
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
 				sevStyle.Background(ilovetui.S.Selection).Width(8).Render(f.Severity),
 				bg.Width(1).Render(""),
 				bg.Foreground(ilovetui.S.Subtle).Width(8).Render(util.Truncate(f.PluginName, 8)),
@@ -90,8 +96,13 @@ func (m *Model) renderList() string {
 				bg.Bold(true).Width(titleW).Render(f.Title),
 			)
 		} else {
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
+				flagSt.Width(2).Render(flagStr),
 				sevLabel,
 				" ",
 				pluginStr,

internal/ui/history/update.go

@@ -2,6 +2,7 @@ package history
 
 import (
 	"fmt"
+	"log"
 	"net/http"
 
 	"charm.land/bubbles/v2/key"
@@ -25,7 +26,10 @@ func LoadEntriesCmd(database *db.DB) tea.Cmd {
 		if database == nil {
 			return EntriesLoadedMsg{}
 		}
-		entries, _ := database.ListEntries()
+		entries, err := database.ListEntries()
+		if err != nil {
+			log.Printf("history: load entries: %v", err)
+		}
 		return EntriesLoadedMsg{Entries: entries}
 	}
 }
@@ -72,14 +76,28 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 
 	case SearchResultMsg:
+		var selectedID int64
+		if m.cursor >= 0 && m.cursor < len(m.entries) {
+			selectedID = m.entries[m.cursor].ID
+		}
 		m.entries = msg.Entries
 		m.cursor = 0
+		if selectedID != 0 {
+			for i, e := range m.entries {
+				if e.ID == selectedID {
+					m.cursor = i
+					break
+				}
+			}
+		}
 		m.searchErr = ""
 		m.pager.SetTotalPages(len(m.entries))
 		m.refreshListViewport()
 		m.refreshBody()
-		m.bodyViewport.SetYOffset(0)
-		m.bodyViewport.SetXOffset(0)
+		if selectedID == 0 {
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+		}
 		if m.searchKind == searchKindSQL {
 			m.acceptSearch()
 		}
@@ -101,7 +119,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		g := keys.Keys.Global
 
 		if m.searchKind != searchKindOff && !m.searchAccepted {
-			// Actively typing: only search navigation + accept/cancel.
 			switch {
 			case key.Matches(msg, g.Escape):
 				return m, m.clearSearch()
@@ -112,24 +129,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				m.acceptSearch()
 
-			case key.Matches(msg, g.Up):
-				if m.cursor > 0 {
-					m.cursor--
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
-			case key.Matches(msg, g.Down):
-				if m.cursor < len(m.entries)-1 {
-					m.cursor++
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
 			default:
 				var cmd tea.Cmd
 				m.searchInput, cmd = m.searchInput.Update(msg)
@@ -234,7 +233,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 		case key.Matches(msg, h.Flag):
 			if len(m.entries) > 0 && m.database != nil {
-				m.database.ToggleFlag(m.entries[m.cursor].ID)
+				if err := m.database.ToggleFlag(m.entries[m.cursor].ID); err != nil {
+					log.Printf("history: toggle flag: %v", err)
+				}
 				return m, m.RefreshCmd()
 			}
 
@@ -242,7 +243,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if len(m.entries) > 0 {
 				id := m.entries[m.cursor].ID
 				if m.database != nil {
-					m.database.DeleteEntry(id)
+					if err := m.database.DeleteEntry(id); err != nil {
+						log.Printf("history: delete entry: %v", err)
+					}
 				}
 				return m, LoadEntriesCmd(m.database)
 			}
@@ -261,10 +264,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 						if hasUnflagged && e.Flagged {
 							continue
 						}
-						m.database.DeleteEntry(e.ID)
+						if err := m.database.DeleteEntry(e.ID); err != nil {
+							log.Printf("history: delete entry: %v", err)
+						}
 					}
 				} else {
-					m.database.DeleteAllExceptFlagged()
+					if err := m.database.DeleteAllExceptFlagged(); err != nil {
+						log.Printf("history: delete all unflagged: %v", err)
+					}
 				}
 			}
 			return m, m.clearSearch()
@@ -346,7 +353,7 @@ func (m *Model) refreshBody() {
 	}
 	if raw == "" {
 		w, h := m.bodyViewport.Width(), m.bodyViewport.Height()
-		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(˘･_･˘)", "no response stored"))))
+		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(w, "(˘･_･˘)", "no response stored"))))
 		return
 	}
 	m.bodyViewport.SetContent(style.HighlightHTTP(raw))

internal/ui/history/view.go

@@ -82,9 +82,9 @@ func (m *Model) renderList() string {
 		)
 	}
 	if len(m.entries) == 0 {
-		msg := util.CenterLines("(⌐■_■)", "no history yet")
+		msg := util.EmptyState(m.listViewport.Width(), "(⌐■_■)", "no history yet")
 		if m.searchKind != searchKindOff {
-			msg = util.CenterLines("ʕノ•ᴥ•ʔノ ︵ ┻━┻", "no results")
+			msg = util.EmptyState(m.listViewport.Width(), "ʕノ•ᴥ•ʔノ ︵ ┻━┻", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
@@ -120,9 +120,6 @@ func (m *Model) renderList() string {
 			flagStr := "  "
 			if e.Flagged {
 				flagStr = icons.I.Flag + " "
-				if icons.I.Flag == "" {
-					flagStr = "★ "
-				}
 			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
@@ -139,9 +136,6 @@ func (m *Model) renderList() string {
 			flagStr := "  "
 			if e.Flagged {
 				flagStr = icons.I.Flag + " "
-				if icons.I.Flag == "" {
-					flagStr = "★ "
-				}
 			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",

internal/ui/home/model.go

@@ -318,13 +318,14 @@ func (m Model) renderHelpLine() string {
 	}
 
 	var parts []string
+	escKey := keys.Keys.Global.Escape.Help().Key
 	if fs == list.Filtering {
 		parts = append(parts, item("enter", "apply filter"))
-		parts = append(parts, item("esc", "cancel"))
+		parts = append(parts, item(escKey, "cancel"))
 	} else {
 		parts = append(parts, item("↑/↓", "navigate"))
 		if fs == list.FilterApplied {
-			parts = append(parts, item("esc", "clear filter"))
+			parts = append(parts, item(escKey, "clear filter"))
 		} else {
 			parts = append(parts, binding(k.Filter))
 		}

internal/ui/home/update.go

@@ -3,6 +3,7 @@ package home
 import (
 	crypto "crypto/rand"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,7 +73,8 @@ func (m Model) handleSelection() (tea.Model, tea.Cmd) {
 		return m, m.nameInput.Focus()
 	case kindTemp:
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create temp dir: %v", err)
 			return m, nil
 		}
 		initProjectFiles(dir)
@@ -90,7 +92,9 @@ func (m Model) deleteSelected() (tea.Model, tea.Cmd) {
 		return m, nil
 	}
 	dir := filepath.Dir(item.path) // parent dir of data.db
-	os.RemoveAll(dir)
+	if err := os.RemoveAll(dir); err != nil {
+		log.Printf("home: remove project dir: %v", err)
+	}
 	idx := m.list.GlobalIndex()
 	m.list.RemoveItem(idx)
 	if idx > 0 && idx >= len(m.list.Items()) {
@@ -113,7 +117,8 @@ func (m Model) updateNaming(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.mode = modeSelect
 		m.nameInput.Blur()
 		dir := filepath.Join(m.projectDir, name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create project dir %q: %v", name, err)
 			return m, nil
 		}
 		initProjectFiles(dir)
@@ -147,14 +152,14 @@ func IsValidProjectName(s string) bool {
 func OpenProject(projectDir, name string) (*Project, error) {
 	if name == "tmp" || name == "temp" || name == "temporary" {
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
 			return nil, err
 		}
 		initProjectFiles(dir)
 		return &Project{Name: "temporary", Path: filepath.Join(dir, "data.db")}, nil
 	}
 	dir := filepath.Join(projectDir, name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, err
 	}
 	initProjectFiles(dir)
@@ -171,9 +176,11 @@ func initProjectFiles(dir string) {
 	for _, name := range []string{"data.db", "logs.log"} {
 		p := filepath.Join(dir, name)
 		if _, err := os.Stat(p); os.IsNotExist(err) {
-			f, err := os.Create(p)
+			f, err := os.Create(p) // #nosec G304 -- p is filepath.Join(dir, hardcoded_name), no traversal possible
 			if err == nil {
-				f.Close()
+				if cerr := f.Close(); cerr != nil {
+					log.Printf("home: close project file: %v", cerr)
+				}
 			}
 		}
 	}

internal/ui/home/view.go

@@ -6,6 +6,7 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/ui/components/teapot"
 )
 
@@ -45,6 +46,7 @@ func (m Model) View() tea.View {
 	v := tea.NewView(content)
 	v.AltScreen = true
 	v.MouseMode = tea.MouseModeCellMotion
+	v.WindowTitle = "Spilltea"
 	return v
 }
 
@@ -69,7 +71,8 @@ func (m Model) renderNamingPanel() string {
 		Width(panelW).
 		Render(label + "\n" + inputLine)
 
-	hint := ilovetui.S.Faint.Render("[enter] confirm  [esc] cancel")
+	escKey := keys.Keys.Global.Escape.Help().Key
+	hint := ilovetui.S.Faint.Render("[enter] confirm  [" + escKey + "] cancel")
 
 	var sb strings.Builder
 	sb.WriteString(center(iw, panel))

internal/ui/intercept/helpers.go

@@ -28,8 +28,14 @@ func parseRawRequest(content string, req *intercept.PendingRequest) {
 	if parsed.Proto != "" {
 		r.Proto = parsed.Proto
 	}
+	if parsed.Host != "" {
+		r.URL.Host = parsed.Host
+	}
 	r.Header = make(http.Header)
 	for _, h := range parsed.Headers {
+		if strings.EqualFold(h.Key, "host") {
+			continue
+		}
 		r.Header.Set(h.Key, h.Value)
 	}
 	if parsed.Body != "" {

internal/ui/intercept/keymap.go

@@ -2,24 +2,17 @@ package intercept
 
 import (
 	"charm.land/bubbles/v2/key"
-	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
 )
 
 type interceptKeyMap struct{ width int }
 
-func iconBinding(b key.Binding, icon string) key.Binding {
-	h := b.Help()
-	return key.NewBinding(key.WithKeys(b.Keys()...), key.WithHelp(h.Key, icon+h.Desc))
-}
-
 func (interceptKeyMap) ShortHelp() []key.Binding {
 	ic := keys.Keys.Intercept
-	i := icons.I
 	return []key.Binding{
-		iconBinding(ic.Forward, i.Forward),
-		iconBinding(ic.Drop, i.Drop),
-		iconBinding(ic.Edit, i.Edit),
+		ic.Forward,
+		ic.Drop,
+		ic.Edit,
 		keys.Keys.Global.Help,
 	}
 }

internal/ui/intercept/update.go

@@ -287,8 +287,6 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 }
 
 func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model, tea.Cmd) {
-	onResponses := m.captureResponse && m.focusedPanel == panelResponses
-
 	switch {
 	case key.Matches(msg, keys.Keys.Global.Escape):
 		m.saveCurrentEdit()
@@ -296,19 +294,6 @@ func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model,
 		m.textarea.Blur()
 		m.refreshBodyViewport()
 
-	case key.Matches(msg, keys.Keys.Intercept.UndoEdits):
-		if onResponses {
-			if len(m.responseQueue) > 0 {
-				delete(m.pendingResponseEdits, m.responseQueue[m.responseCursor])
-				m.textarea.SetValue(intercept.FormatRawResponse(m.responseQueue[m.responseCursor].Flow))
-			}
-		} else {
-			if len(m.queue) > 0 {
-				delete(m.pendingEdits, m.queue[m.cursor])
-				m.textarea.SetValue(intercept.FormatRawRequest(m.queue[m.cursor].Flow))
-			}
-		}
-
 	default:
 		var cmd tea.Cmd
 		m.textarea, cmd = m.textarea.Update(msg)

internal/ui/intercept/view.go

@@ -100,7 +100,7 @@ func (m *Model) renderStatusBar() string {
 
 func (m *Model) renderList() string {
 	if len(m.queue) == 0 {
-		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(｡◕‿‿◕｡)", "waiting for a request")))
+		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(｡◕‿‿◕｡)", "waiting for a request")))
 	}
 
 	start, end := util.PageBounds(m.pager, len(m.queue))
@@ -149,7 +149,7 @@ func (m *Model) renderList() string {
 
 func (m *Model) renderResponseList() string {
 	if len(m.responseQueue) == 0 {
-		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(҂◡_◡)", "no response yet")))
+		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(҂◡_◡)", "no response yet")))
 	}
 
 	start, end := util.PageBounds(m.responsePager, len(m.responseQueue))

internal/ui/plugins/view.go

@@ -15,7 +15,7 @@ import (
 
 func (m Model) View() tea.View {
 	if m.width == 0 || m.manager == nil {
-		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(._.)~*.'", "no plugins loaded"))))
+		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.width, "(._.)~*.'", "no plugins loaded"))))
 	}
 
 	listH, detailH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.4)
@@ -127,9 +127,9 @@ func (m *Model) renderStatusBar() string {
 
 func (m *Model) renderList() string {
 	if len(m.filtered) == 0 {
-		msg := util.CenterLines("(ง •̀_•́)ง", "no plugins", "", "spilltea --add-default-plugins")
+		msg := util.EmptyState(m.listViewport.Width(), "(ง •̀_•́)ง", "no plugins", "", "spilltea --add-default-plugins")
 		if m.filter != "" {
-			msg = util.CenterLines("= _ =", "no results")
+			msg = util.EmptyState(m.listViewport.Width(), "= _ =", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),

internal/ui/replay/model.go

@@ -2,11 +2,13 @@ package replay
 
 import (
 	"fmt"
+	"strings"
 
 	"charm.land/bubbles/v2/help"
 	"charm.land/bubbles/v2/key"
 	"charm.land/bubbles/v2/paginator"
 	"charm.land/bubbles/v2/textarea"
+	"charm.land/bubbles/v2/textinput"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
@@ -31,6 +33,7 @@ type Entry struct {
 	ResponseRaw string // filled after send
 	StatusCode  int    // 0 = not sent yet
 	Sending     bool
+	Flagged     bool
 	Err         error
 }
 
@@ -43,12 +46,18 @@ const (
 )
 
 type Model struct {
-	entries      []Entry
+	allEntries   []Entry
+	entries      []Entry // filtered view; equals allEntries when no filter
+	entryIndices []int   // maps entries[i] -> allEntries[i]; nil when no filter
 	cursor       int
 	editing      bool
 	focusedPanel panel
 	database     *db.DB
 
+	filterInput    textinput.Model
+	filterActive   bool
+	filterAccepted bool
+
 	listViewport     viewport.Model
 	requestViewport  viewport.Model
 	responseViewport viewport.Model
@@ -63,11 +72,14 @@ type Model struct {
 func New() Model {
 	ta := ilovetui.NewTextarea(false)
 	ta.Blur()
+	ti := textinput.New()
+	ti.Prompt = ""
 	return Model{
 		listViewport:     ilovetui.NewViewport(),
 		requestViewport:  ilovetui.NewViewport(),
 		responseViewport: ilovetui.NewViewport(),
 		textarea:         ta,
+		filterInput:      ti,
 		pager:            ilovetui.NewPaginator(),
 		help:             ilovetui.NewHelp(),
 	}
@@ -75,7 +87,7 @@ func New() Model {
 
 func (m Model) Init() tea.Cmd { return nil }
 
-func (m Model) IsEditing() bool { return m.editing }
+func (m Model) IsEditing() bool { return m.editing || (m.filterActive && !m.filterAccepted) }
 
 func (m Model) IsResponseFocused() bool {
 	return m.focusedPanel == panelResponse
@@ -111,8 +123,9 @@ func (m *Model) SetDB(d *db.DB) {
 		return
 	}
 	for _, dbe := range entries {
-		m.entries = append(m.entries, entryFromDB(dbe))
+		m.allEntries = append(m.allEntries, entryFromDB(dbe))
 	}
+	m.entries = m.allEntries
 	m.pager.SetTotalPages(len(m.entries))
 	if len(m.entries) > 0 {
 		m.cursor = len(m.entries) - 1
@@ -136,6 +149,7 @@ func entryFromDB(dbe db.ReplayEntry) Entry {
 		RequestRaw:  dbe.RequestRaw,
 		ResponseRaw: dbe.ResponseRaw,
 		StatusCode:  dbe.StatusCode,
+		Flagged:     dbe.Flagged,
 		Err:         err,
 	}
 }
@@ -148,6 +162,7 @@ func (m *Model) SetSize(w, h int) {
 
 func (m *Model) recalcSizes() {
 	m.help.SetWidth(m.width - 2)
+	m.filterInput.SetWidth(m.width - 4)
 
 	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
@@ -194,12 +209,77 @@ func (m *Model) bodyHalfWidths() (left, right int) {
 	return
 }
 
+func (m *Model) currentAllIdx() int {
+	if m.entryIndices != nil && m.cursor < len(m.entryIndices) {
+		return m.entryIndices[m.cursor]
+	}
+	if m.cursor < len(m.allEntries) {
+		return m.cursor
+	}
+	return -1
+}
+
+func matchesFilter(e Entry, term string) bool {
+	return strings.Contains(strings.ToLower(e.Host), term) ||
+		strings.Contains(strings.ToLower(e.Path), term) ||
+		strings.Contains(strings.ToLower(strings.TrimSpace(e.Method)), term)
+}
+
+func (m *Model) applyFilter(preferAllIdx int) {
+	term := strings.ToLower(m.filterInput.Value())
+	if !m.filterActive || term == "" {
+		m.entries = m.allEntries
+		m.entryIndices = nil
+		if preferAllIdx >= 0 && preferAllIdx < len(m.allEntries) {
+			m.cursor = preferAllIdx
+		}
+	} else {
+		m.entries = nil
+		m.entryIndices = nil
+		newCursor := 0
+		found := false
+		for i, e := range m.allEntries {
+			if matchesFilter(e, term) {
+				if i == preferAllIdx && !found {
+					newCursor = len(m.entries)
+					found = true
+				}
+				m.entries = append(m.entries, e)
+				m.entryIndices = append(m.entryIndices, i)
+			}
+		}
+		if found {
+			m.cursor = newCursor
+		} else {
+			m.cursor = 0
+		}
+	}
+	if len(m.entries) == 0 {
+		m.cursor = 0
+	} else if m.cursor >= len(m.entries) {
+		m.cursor = len(m.entries) - 1
+	}
+	m.pager.SetTotalPages(len(m.entries))
+	m.refreshListViewport()
+	m.refreshBody()
+}
+
+func (m *Model) clearFilter() {
+	prevAllIdx := m.currentAllIdx()
+	m.filterActive = false
+	m.filterAccepted = false
+	m.filterInput.SetValue("")
+	m.filterInput.Blur()
+	m.recalcSizes()
+	m.applyFilter(prevAllIdx)
+}
+
 type replayKeyMap struct{ width int }
 
 func (replayKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
-	return []key.Binding{g.Up, g.Down, g.CycleFocus, r.Send, r.Edit, g.Help}
+	return []key.Binding{g.Up, g.Down, g.CycleFocus, r.Send, r.Edit, r.Flag, r.Filter, g.Help}
 }
 
 func (m replayKeyMap) FullHelp() [][]key.Binding {

internal/ui/replay/update.go

@@ -5,9 +5,14 @@ import (
 	"compress/gzip"
 	"compress/zlib"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -62,15 +67,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				entry.DBID = id
 			}
 		}
-		m.entries = append(m.entries, entry)
-		m.cursor = len(m.entries) - 1
-		m.pager.SetTotalPages(len(m.entries))
-		m.refreshListViewport()
-		m.refreshBody()
+		m.allEntries = append(m.allEntries, entry)
+		m.applyFilter(len(m.allEntries) - 1)
 
 	case sentMsg:
-		if msg.index >= 0 && msg.index < len(m.entries) {
-			e := &m.entries[msg.index]
+		allIdx := msg.index
+		if allIdx >= 0 && allIdx < len(m.allEntries) {
+			e := m.allEntries[allIdx]
 			e.Sending = false
 			e.StatusCode = msg.statusCode
 			e.ResponseRaw = msg.responseRaw
@@ -79,11 +82,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				e.ResponseRaw = "Error: " + msg.err.Error()
 			}
 			if m.database != nil && e.DBID != 0 {
-				m.database.UpdateReplayEntry(entryToDB(*e))
+				if err := m.database.UpdateReplayEntry(entryToDB(e)); err != nil {
+					log.Printf("replay: update entry: %v", err)
+				}
 			}
+			m.allEntries[allIdx] = e
 		}
-		m.refreshListViewport()
-		m.refreshBody()
+		prevAllIdx := m.currentAllIdx()
+		m.applyFilter(prevAllIdx)
 
 	case util.EditorFinishedMsg:
 		if msg.Err == nil && msg.Content != "" && len(m.entries) > 0 {
@@ -96,24 +102,20 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			switch msg.Button {
 			case tea.MouseWheelUp:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollLeft(6)
-					m.responseViewport.ScrollLeft(6)
+					m.scrollBothViewports(true)
 				} else {
 					m.scrollFocusedViewportVertical(-1)
 				}
 			case tea.MouseWheelDown:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollRight(6)
-					m.responseViewport.ScrollRight(6)
+					m.scrollBothViewports(false)
 				} else {
 					m.scrollFocusedViewportVertical(1)
 				}
 			case tea.MouseWheelLeft:
-				m.requestViewport.ScrollLeft(6)
-				m.responseViewport.ScrollLeft(6)
+				m.scrollBothViewports(true)
 			case tea.MouseWheelRight:
-				m.requestViewport.ScrollRight(6)
-				m.responseViewport.ScrollRight(6)
+				m.scrollBothViewports(false)
 			}
 		}
 
@@ -130,6 +132,32 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
+
+	if m.filterActive && !m.filterAccepted {
+		switch {
+		case key.Matches(msg, g.Escape):
+			m.clearFilter()
+		case msg.String() == "enter":
+			m.filterAccepted = true
+			m.filterInput.Blur()
+			m.recalcSizes()
+		default:
+			var cmd tea.Cmd
+			m.filterInput, cmd = m.filterInput.Update(msg)
+			prevAllIdx := m.currentAllIdx()
+			m.applyFilter(prevAllIdx)
+			return m, cmd
+		}
+		return m, nil
+	}
+
+	if m.filterActive && m.filterAccepted {
+		if key.Matches(msg, g.Escape) {
+			m.clearFilter()
+			return m, nil
+		}
+	}
+
 	switch {
 	case key.Matches(msg, g.Up):
 		if m.focusedPanel == panelList {
@@ -165,12 +193,13 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 
 	case key.Matches(msg, r.Send):
 		if len(m.entries) > 0 && !m.entries[m.cursor].Sending {
-			m.entries[m.cursor].Sending = true
-			m.entries[m.cursor].ResponseRaw = ""
-			m.entries[m.cursor].Err = nil
-			m.refreshListViewport()
-			m.refreshBody()
-			return m, sendCmd(m.entries[m.cursor], m.cursor)
+			allIdx := m.currentAllIdx()
+			m.allEntries[allIdx].Sending = true
+			m.allEntries[allIdx].ResponseRaw = ""
+			m.allEntries[allIdx].Err = nil
+			entry := m.allEntries[allIdx]
+			m.applyFilter(allIdx)
+			return m, sendCmd(entry, allIdx)
 		}
 
 	case key.Matches(msg, r.Edit):
@@ -212,30 +241,67 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.requestViewport.ScrollRight(6)
 		m.responseViewport.ScrollRight(6)
 
+	case key.Matches(msg, r.Flag):
+		if len(m.entries) > 0 {
+			allIdx := m.currentAllIdx()
+			if m.database != nil && m.allEntries[allIdx].DBID != 0 {
+				if err := m.database.ToggleReplayFlag(m.allEntries[allIdx].DBID); err != nil {
+					log.Printf("replay: toggle flag: %v", err)
+				}
+			}
+			m.allEntries[allIdx].Flagged = !m.allEntries[allIdx].Flagged
+			m.applyFilter(allIdx)
+		}
+
 	case key.Matches(msg, r.Delete):
 		if len(m.entries) > 0 {
-			e := m.entries[m.cursor]
+			allIdx := m.currentAllIdx()
+			e := m.allEntries[allIdx]
 			if m.database != nil && e.DBID != 0 {
-				m.database.DeleteReplayEntry(e.DBID)
+				if err := m.database.DeleteReplayEntry(e.DBID); err != nil {
+					log.Printf("replay: delete entry: %v", err)
+				}
 			}
-			m.entries = append(m.entries[:m.cursor], m.entries[m.cursor+1:]...)
-			if m.cursor >= len(m.entries) && m.cursor > 0 {
-				m.cursor--
+			m.allEntries = append(m.allEntries[:allIdx], m.allEntries[allIdx+1:]...)
+			preferAllIdx := allIdx
+			if preferAllIdx >= len(m.allEntries) {
+				preferAllIdx = len(m.allEntries) - 1
 			}
-			m.pager.SetTotalPages(len(m.entries))
-			m.refreshListViewport()
-			m.refreshBody()
+			m.applyFilter(preferAllIdx)
 		}
 
 	case key.Matches(msg, r.DeleteAll):
 		if m.database != nil {
-			m.database.DeleteAllReplayEntries()
+			if err := m.database.DeleteAllReplayEntriesExceptFlagged(); err != nil {
+				log.Printf("replay: delete all entries: %v", err)
+			}
+		}
+		// Mirror the DB logic in memory: delete unflagged first; if none, delete all.
+		hasUnflagged := false
+		for _, e := range m.allEntries {
+			if !e.Flagged {
+				hasUnflagged = true
+				break
+			}
+		}
+		if hasUnflagged {
+			filtered := m.allEntries[:0]
+			for _, e := range m.allEntries {
+				if e.Flagged {
+					filtered = append(filtered, e)
+				}
+			}
+			m.allEntries = filtered
+		} else {
+			m.allEntries = nil
 		}
-		m.entries = nil
 		m.cursor = 0
-		m.pager.SetTotalPages(0)
-		m.refreshListViewport()
-		m.refreshBody()
+		m.filterActive = false
+		m.filterAccepted = false
+		m.filterInput.SetValue("")
+		m.filterInput.Blur()
+		m.recalcSizes()
+		m.applyFilter(-1)
 
 	case key.Matches(msg, keys.Keys.Global.GotoTop):
 		m.cursor = 0
@@ -276,6 +342,15 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 			}
 		}
 
+	case key.Matches(msg, r.Filter):
+		if m.focusedPanel == panelList {
+			m.filterActive = true
+			m.filterAccepted = false
+			m.filterInput.Placeholder = "filter requests..."
+			m.filterInput.Focus()
+			m.recalcSizes()
+		}
+
 	case key.Matches(msg, g.Help):
 		m.help.ShowAll = !m.help.ShowAll
 		m.recalcSizes()
@@ -320,6 +395,16 @@ func (m *Model) setFocusedViewport(vp viewport.Model) {
 	}
 }
 
+func (m *Model) scrollBothViewports(left bool) {
+	if left {
+		m.requestViewport.ScrollLeft(6)
+		m.responseViewport.ScrollLeft(6)
+	} else {
+		m.requestViewport.ScrollRight(6)
+		m.responseViewport.ScrollRight(6)
+	}
+}
+
 func (m *Model) scrollFocusedViewportVertical(delta int) {
 	vp := m.focusedViewport()
 	vp.SetYOffset(vp.YOffset() + delta)
@@ -351,11 +436,11 @@ func (m *Model) refreshBody() {
 	m.requestViewport.SetXOffset(0)
 
 	if e.Sending {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(ﾉ◕ヮ◕)ﾉ*:･ﾟ", "sending..."))))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(ﾉ◕ヮ◕)ﾉ*:･ﾟ", "sending..."))))
 	} else if e.ResponseRaw != "" {
 		m.responseViewport.SetContent(style.HighlightHTTP(e.ResponseRaw))
 	} else {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("( •_•)>⌐■", "press send to fire"))))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "( •_•)>⌐■", "press send to fire"))))
 	}
 	m.responseViewport.SetYOffset(0)
 	m.responseViewport.SetXOffset(0)
@@ -396,11 +481,27 @@ func doSend(entry Entry) (responseRaw string, statusCode int, err error) {
 	}
 	req.Header = headers
 
+	tlsCfg := &tls.Config{InsecureSkipVerify: config.Global.App.SslInsecure} // #nosec G402 -- controlled by ssl_insecure config
+	if !config.Global.App.SslInsecure {
+		if certPool, err := x509.SystemCertPool(); err == nil {
+			caPath := filepath.Join(config.ExpandPath(config.Global.App.CertDir), "mitmproxy-ca-cert.pem")
+			if pem, err := os.ReadFile(caPath); err == nil {
+				certPool.AppendCertsFromPEM(pem)
+			}
+			tlsCfg.RootCAs = certPool
+		}
+	}
+	transport := &http.Transport{
+		TLSClientConfig: tlsCfg,
+	}
+	if up := config.Global.App.UpstreamProxy; up != "" {
+		if proxyURL, err := url.Parse(up); err == nil {
+			transport.Proxy = http.ProxyURL(proxyURL)
+		}
+	}
 	client := &http.Client{
-		Timeout: 30 * time.Second,
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-		},
+		Timeout:   30 * time.Second,
+		Transport: transport,
 		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
@@ -480,6 +581,7 @@ func entryToDB(e Entry) db.ReplayEntry {
 		ResponseRaw: e.ResponseRaw,
 		StatusCode:  e.StatusCode,
 		ErrorMsg:    errMsg,
+		Flagged:     e.Flagged,
 	}
 }
 

internal/ui/replay/view.go

@@ -8,6 +8,7 @@ import (
 	"charm.land/lipgloss/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
 	"github.com/anotherhadi/spilltea/internal/util"
 )
@@ -73,7 +74,18 @@ func (m *Model) renderResponsePanel(w, h int) string {
 }
 
 func (m *Model) renderStatusBar() string {
-	return lipgloss.NewStyle().Padding(0, 1).Render(m.help.View(replayKeyMap{width: m.width}))
+	pad := lipgloss.NewStyle().Padding(0, 1)
+	if m.filterActive {
+		filterKey := keys.Keys.Replay.Filter.Help().Key
+		escKey := keys.Keys.Global.Escape.Help().Key
+		if m.filterAccepted {
+			accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+			filterLine := pad.Render(accent.Render(filterKey) + " " + ilovetui.S.Bold.Render(m.filterInput.Value()) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
+			return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(replayKeyMap{width: m.width})))
+		}
+		return pad.Render(ilovetui.S.Faint.Render(filterKey) + " " + m.filterInput.View())
+	}
+	return pad.Render(m.help.View(replayKeyMap{width: m.width}))
 }
 
 func (m *Model) renderList() string {
@@ -81,7 +93,7 @@ func (m *Model) renderList() string {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(╥﹏╥)", "send a request from History or Intercept")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(╥﹏╥)", "send a request from History or Intercept")),
 		)
 	}
 
@@ -94,19 +106,25 @@ func (m *Model) renderList() string {
 		selBg := ilovetui.S.Selection
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 7 + 1 + 3 + 1
+		const fixedW = 2 + 2 + 7 + 1 + 3 + 1
 		hostPathW := w - fixedW
 		if hostPathW < 0 {
 			hostPathW = 0
 		}
 
 		statusStr, statusSt := entryStatus(e)
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
 				style.S.Method(e.Method).Background(selBg).Render(e.Method),
 				bg.Width(1).Render(""),
 				statusSt.Background(selBg).Render(statusStr),
@@ -114,8 +132,13 @@ func (m *Model) renderList() string {
 				bg.Bold(true).Width(hostPathW).Render(e.Host+e.Path),
 			)
 		} else {
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
+				flagSt.Width(2).Render(flagStr),
 				style.S.Method(e.Method).Render(e.Method),
 				" ",
 				statusSt.Render(statusStr),

internal/util/editor.go

@@ -15,7 +15,7 @@ type EditorFinishedMsg struct {
 	Err     error
 }
 
-func resolveEditor() string {
+func ResolveEditor() string {
 	editor := config.Global.App.ExternalEditor
 	if editor == "" {
 		editor = os.Getenv("EDITOR")
@@ -29,14 +29,17 @@ func resolveEditor() string {
 func openWithEditor(content string, callback func(string, error) tea.Msg) tea.Cmd {
 	f, err := os.CreateTemp("", "spilltea-*.http")
 	if err != nil {
+		log.Printf("editor: create temp file: %v", err)
 		return nil
 	}
 	tmpPath := f.Name()
 	if _, err := f.WriteString(content); err != nil {
 		log.Printf("editor: writing temp file: %v", err)
 	}
-	f.Close()
-	return tea.ExecProcess(exec.Command(resolveEditor(), tmpPath), func(err error) tea.Msg {
+	if err := f.Close(); err != nil {
+		log.Printf("editor: closing temp file: %v", err)
+	}
+	return tea.ExecProcess(exec.Command(ResolveEditor(), tmpPath), func(err error) tea.Msg { // #nosec G204 -- editor from trusted config/$EDITOR, tmpPath from os.CreateTemp
 		defer os.Remove(tmpPath)
 		return callback(tmpPath, err)
 	})
@@ -47,7 +50,7 @@ func OpenExternalEditor(content string) tea.Cmd {
 		if err != nil {
 			return EditorFinishedMsg{Err: err}
 		}
-		data, readErr := os.ReadFile(tmpPath)
+		data, readErr := os.ReadFile(tmpPath) // #nosec G304 -- tmpPath is from os.CreateTemp, controlled by this process
 		if readErr != nil {
 			return EditorFinishedMsg{Err: readErr}
 		}

internal/util/util.go

@@ -14,6 +14,14 @@ func Truncate(s string, max int) string {
 	return s[:max-1] + "…"
 }
 
+// EmptyState renders centered placeholder lines, word-wrapping to fit maxW.
+func EmptyState(maxW int, lines ...string) string {
+	return lipgloss.NewStyle().
+		Width(maxW).
+		AlignHorizontal(lipgloss.Center).
+		Render(strings.Join(lines, "\n"))
+}
+
 // CenterLines centers each line horizontally relative to the longest one.
 func CenterLines(lines ...string) string {
 	maxWidth := 0

nix/browser.nix

@@ -0,0 +1,61 @@
+{pkgs}: let
+  defaultCertDir = "$HOME/.local/share/spilltea";
+  defaultHost = "127.0.0.1";
+  defaultPort = "8080";
+in
+  pkgs.writeShellApplication {
+    name = "spilltea-browser";
+    runtimeInputs = with pkgs; [nss.tools librewolf netcat-gnu procps];
+    text = ''
+      CERT_DIR="${defaultCertDir}"
+      HOST="${defaultHost}"
+      PORT="${defaultPort}"
+
+      while [[ $# -gt 0 ]]; do
+        case "$1" in
+          --cert-dir) CERT_DIR="$2"; shift 2 ;;
+          --host)     HOST="$2";     shift 2 ;;
+          --port)     PORT="$2";     shift 2 ;;
+          *) echo "Unknown argument: $1"; exit 1 ;;
+        esac
+      done
+
+      CERT_FILE="$CERT_DIR/mitmproxy-ca-cert.pem"
+
+      if [[ ! -f "$CERT_FILE" ]]; then
+        echo "Certificate not found at $CERT_FILE"
+        echo "Launch spilltea first, or use --cert-dir if you changed cert_dir in your config."
+        exit 1
+      fi
+
+      if ! pgrep -x spilltea > /dev/null 2>&1; then
+        echo "spilltea is not running. Launch spilltea first."
+        exit 1
+      fi
+
+      if ! nc -z "$HOST" "$PORT" > /dev/null 2>&1; then
+        echo "Nothing is listening on $HOST:$PORT."
+        echo "Is spilltea configured on that port? Use --host and --port if you changed them in your config."
+        exit 1
+      fi
+
+      PROFILE=$(mktemp -d)
+      trap 'rm -rf "$PROFILE"' EXIT
+
+      certutil -N -d sql:"$PROFILE" --empty-password
+      certutil -d sql:"$PROFILE" -A -n "spilltea" -t "CT,," -i "$CERT_FILE"
+
+      cat > "$PROFILE/user.js" <<EOF
+      user_pref("network.proxy.type", 1);
+      user_pref("network.proxy.http", "$HOST");
+      user_pref("network.proxy.http_port", $PORT);
+      user_pref("network.proxy.ssl", "$HOST");
+      user_pref("network.proxy.ssl_port", $PORT);
+      user_pref("network.proxy.no_proxies_on", "");
+      user_pref("network.stricttransportsecurity.preloadlist", false);
+      user_pref("dom.security.https_only_mode", false);
+      EOF
+
+      librewolf --profile "$PROFILE" --no-remote
+    '';
+  }

nix/gomod2nix.toml

@@ -105,6 +105,10 @@ schema = 3
     version = 'v1.5.0'
     hash = 'sha256-EYVgkSEMo4HaVrsWKqnsYRp8SSS8gNf7t+Elva02Ofc='
 
+  [mod.'github.com/inconshreveable/mousetrap']
+    version = 'v1.1.0'
+    hash = 'sha256-XWlYH0c8IcxAwQTnIi6WYqq44nOKUylSWxWO/vi+8pE='
+
   [mod.'github.com/klauspost/compress']
     version = 'v1.17.8'
     hash = 'sha256-8rgCCfHX29le8m6fyVn6gwFde5TPUHjwQqZqv9JIubs='
@@ -173,6 +177,10 @@ schema = 3
     version = 'v1.10.0'
     hash = 'sha256-dQ6Qqf26IZsa6XsGKP7GDuCj+WmSsBmkBwGTDfue/rk='
 
+  [mod.'github.com/spf13/cobra']
+    version = 'v1.10.2'
+    hash = 'sha256-nbRCTFiDCC2jKK7AHi79n7urYCMP5yDZnWtNVJrDi+k='
+
   [mod.'github.com/spf13/pflag']
     version = 'v1.0.10'
     hash = 'sha256-uDPnWjHpSrzXr17KEYEA1yAbizfcsfo5AyztY2tS6ZU='
@@ -210,16 +218,16 @@ schema = 3
     hash = 'sha256-NkGFiDPoCxbr3LFsI6OCygjjkY0rdmg5ggvVVwpyDQ4='
 
   [mod.'golang.org/x/net']
-    version = 'v0.54.0'
-    hash = 'sha256-/EoIXzTQzK/yP/lxOyx0Z/bhns4FdPTIF4uyt4gIP80='
+    version = 'v0.55.0'
+    hash = 'sha256-Phi2mSmBGOJcvqPPAit3uqF3UP8SKRI9dHj6yTM3s5s='
 
   [mod.'golang.org/x/sync']
     version = 'v0.20.0'
     hash = 'sha256-ybcjhCfK6lroUM0yswUvWooW8MOQZBXyiSqoxG6Uy0Y='
 
   [mod.'golang.org/x/sys']
-    version = 'v0.44.0'
-    hash = 'sha256-JDlj+PKsG6I6kjv5JyOUNreY51u5An0oZ5OZMHZSk+A='
+    version = 'v0.45.0'
+    hash = 'sha256-hkBoNazrDA67ER6sWhb+EKxx9nJ24+nz3zGy+zT5Hvw='
 
   [mod.'golang.org/x/text']
     version = 'v0.37.0'

nix/package.nix

@@ -2,13 +2,22 @@
   pkgs,
   buildGoApplication,
 }: let
+  browser = import ./browser.nix {inherit pkgs;};
   pname = "spilltea";
-  version = "0.0.6";
+  version = "0.0.8";
   ldflags = ["-s" "-w" "-X main.version=${version}"];
   pkg = buildGoApplication {
     inherit pname version ldflags;
     src = ../.;
     modules = ./gomod2nix.toml;
+    nativeBuildInputs = [pkgs.installShellFiles];
+    env.GOTOOLCHAIN = "local";
+    postInstall = ''
+      installShellCompletion --cmd spilltea \
+        --bash <($out/bin/spilltea completion bash) \
+        --zsh <($out/bin/spilltea completion zsh) \
+        --fish <($out/bin/spilltea completion fish)
+    '';
     meta = with pkgs.lib; {
       description = "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.";
       homepage = "https://github.com/anotherhadi/spilltea";
@@ -18,4 +27,5 @@
 in {
   "${pname}" = pkg;
   default = pkg;
+  browser = browser;
 }

nix/shell.nix

@@ -52,6 +52,8 @@ in
     packages = with pkgs;
       [
         go
+        gosec
+        govulncheck
         python3
         doctoc
         stylua

spilltea.go

@@ -17,7 +17,7 @@ var PluginsFS embed.FS
 // InstallDefaultPlugins copies embedded default plugins into dir, skipping
 // files that already exist. Returns the number of files written.
 func InstallDefaultPlugins(dir string) (int, error) {
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return 0, fmt.Errorf("create plugins dir: %w", err)
 	}
 
@@ -39,7 +39,7 @@ func InstallDefaultPlugins(dir string) (int, error) {
 		if err != nil {
 			return written, fmt.Errorf("read embedded %s: %w", e.Name(), err)
 		}
-		if err := os.WriteFile(dst, data, 0o644); err != nil {
+		if err := os.WriteFile(dst, data, 0o600); err != nil {
 			return written, fmt.Errorf("write %s: %w", dst, err)
 		}
 		written++