v0.0.8

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>

README.md

@@ -23,6 +23,7 @@
 - [Installation](#installation)
 - [Project Management](#project-management)
 - [Configuration](#configuration)
+  - [Per-project configuration](#per-project-configuration)
 - [CLI Flags](#cli-flags)
 - [Plugin System](#plugin-system)
 - [Vim / Neovim Integration](#vim--neovim-integration)
@@ -40,7 +41,6 @@ It is intentionally minimal. No Electron, no browser, no bloat. Just a fast, key
 <img alt="demo" src="./.github/assets/demo.gif" width="700" />
 
  <!-- exec: cat ./docs/legal-disclaimer.md -->
-
 ## Legal Disclaimer
 
 **This tool is provided for educational purposes and authorized security testing only.**
@@ -48,7 +48,6 @@ It is intentionally minimal. No Electron, no browser, no bloat. Just a fast, key
 Use Spilltea only on systems and networks you own or have explicit written permission to test. Intercepting network traffic without authorization may violate local laws (such as the Computer Fraud and Abuse Act, GDPR, or equivalent legislation in your jurisdiction).
 
 The author(s) and contributors are not responsible for any misuse, damage, or legal consequences resulting from the use of this software. By using Spilltea, you agree that you are solely responsible for ensuring your usage is lawful and authorized.
-
 <!-- endexec -->
 
 ## Features
@@ -103,16 +102,15 @@ environment.systemPackages = [ inputs.spilltea.packages.${pkgs.system}.default ]
 </details>
 
  <!-- exec: cat ./docs/basics.md -->
-
 ## Project Management
 
 Spilltea organizes work into **projects**. Each project maps to a SQLite database file that stores all intercepted traffic for that session & a log files.
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
@@ -121,22 +119,39 @@ Check the default configuration with all the options [here](./internal/config/de
 
 Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
 
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
-
 <!-- endexec -->
 
 ## Plugin System

cmd/spilltea/main.go

@@ -15,7 +15,7 @@ import (
 	"github.com/anotherhadi/spilltea/internal/style"
 	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
 	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
-	flag "github.com/spf13/pflag"
+	"github.com/spf13/cobra"
 )
 
 // Version is overwritten at build time by goreleaser/ldflag with the current version tag, or "dev" if not set.
@@ -32,136 +32,150 @@ func init() {
 
 func main() {
 	var (
-		flagConfig            = flag.StringP("config", "c", "", "path to config file")
-		flagPluginsDir        = flag.String("plugins-dir", "", "path to plugins dir (overrides config)")
-		flagHost              = flag.String("host", "", "proxy host (overrides config)")
-		flagPort              = flag.IntP("port", "p", 0, "proxy port (overrides config)")
-		flagUpstreamProxy     = flag.String("upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
-		flagVersion           = flag.BoolP("version", "v", false, "print version")
-		flagProject           = flag.StringP("project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
-		flagAddDefaultPlugins = flag.Bool("add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
-		flagAddDefaultConfig  = flag.Bool("add-default-config", false, "copy the default config file to the config path and exit")
+		flagConfig            string
+		flagPluginsDir        string
+		flagHost              string
+		flagPort              int
+		flagUpstreamProxy     string
+		flagProject           string
+		flagSslInsecure       bool
+		flagAddDefaultPlugins bool
+		flagAddDefaultConfig  bool
 	)
-	flag.CommandLine.SetOutput(os.Stdout)
-	flag.Usage = func() {
-		fmt.Println("Usage: spilltea [flags]")
-		fmt.Println("")
-		flag.PrintDefaults()
-	}
-	flag.Parse()
 
-	if *flagVersion {
-		fmt.Println(version)
-		os.Exit(0)
-	}
-
-	if *flagAddDefaultPlugins {
-		home, _ := os.UserHomeDir()
-		cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
-		}
-		if err := config.Load(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "config: %v\n", err)
-			os.Exit(1)
-		}
-		dir := config.ExpandPath(config.Global.App.PluginsDir)
-		if *flagPluginsDir != "" {
-			dir = *flagPluginsDir
-		}
-		n, err := spilltea.InstallDefaultPlugins(dir)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-plugins: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Printf("added %d plugin(s) to %s\n", n, dir)
-		os.Exit(0)
-	}
-
-	if *flagAddDefaultConfig {
-		home, _ := os.UserHomeDir()
-		cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
-		}
-		if err := config.WriteDefaultConfig(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-config: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Printf("default config written to %s\n", cfgPath)
-		os.Exit(0)
-	}
-
-	if *flagProject != "" && !homeUI.IsValidProjectName(*flagProject) {
-		fmt.Fprintf(os.Stderr, "project: invalid name %q (only lowercase letters, digits, - and _ are allowed)\n", *flagProject)
-		os.Exit(1)
-	}
-
-	home, _ := os.UserHomeDir()
-	cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
-	if *flagConfig != "" {
-		cfgPath = *flagConfig
-	}
-
-	if err := config.Load(cfgPath); err != nil {
-		fmt.Fprintf(os.Stderr, "config: %v\n", err)
-		os.Exit(1)
-	}
-	config.Global.Version = version
-
-	if *flagPluginsDir != "" {
-		config.Global.App.PluginsDir = *flagPluginsDir
-	}
-	if *flagHost != "" {
-		config.Global.App.Host = *flagHost
-	}
-	if *flagPort != 0 {
-		config.Global.App.Port = *flagPort
-	}
-	if *flagUpstreamProxy != "" {
-		config.Global.App.UpstreamProxy = *flagUpstreamProxy
-	}
-
-	style.Init()
-	icons.Init(config.Global)
-	keys.Init(config.Global)
-
-	projectDir := config.ExpandPath(config.Global.App.ProjectDir)
-
-	// If --project flag is set, skip the home screen entirely.
-	if *flagProject != "" {
-		project, err := homeUI.OpenProject(projectDir, *flagProject)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "project: %v\n", err)
-			os.Exit(1)
-		}
-		broker := intercept.NewBroker()
-		m := appUI.New(broker, project.Name, project.Path)
-		final, err := tea.NewProgram(m).Run()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "tui: %v\n", err)
-			os.Exit(1)
-		}
-		if app, ok := final.(appUI.Model); ok {
-			if ferr := app.FatalErr(); ferr != nil {
-				fmt.Fprintf(os.Stderr, "error: %v\n", ferr)
-				os.Exit(1)
+	rootCmd := &cobra.Command{
+		Use:           "spilltea",
+		Short:         "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.",
+		Version:       version,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if flagAddDefaultPlugins {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
+				}
+				if err := config.Load(cfgPath); err != nil {
+					return fmt.Errorf("config: %w", err)
+				}
+				dir := config.ExpandPath(config.Global.App.PluginsDir)
+				if flagPluginsDir != "" {
+					dir = flagPluginsDir
+				}
+				n, err := spilltea.InstallDefaultPlugins(dir)
+				if err != nil {
+					return fmt.Errorf("add-default-plugins: %w", err)
+				}
+				fmt.Printf("added %d plugin(s) to %s\n", n, dir)
+				return nil
 			}
-		}
-		return
+
+			if flagAddDefaultConfig {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
+				}
+				if err := config.WriteDefaultConfig(cfgPath); err != nil {
+					return fmt.Errorf("add-default-config: %w", err)
+				}
+				fmt.Printf("default config written to %s\n", cfgPath)
+				return nil
+			}
+
+			if flagProject != "" && !homeUI.IsValidProjectName(flagProject) {
+				return fmt.Errorf("project: invalid name %q (only lowercase letters, digits, - and _ are allowed)", flagProject)
+			}
+
+			home, _ := os.UserHomeDir()
+			cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+			if flagConfig != "" {
+				cfgPath = flagConfig
+			}
+
+			if err := config.Load(cfgPath); err != nil {
+				return fmt.Errorf("config: %w", err)
+			}
+			config.Global.Version = version
+
+			sslInsecureChanged := cmd.Flags().Changed("ssl-insecure")
+			applyCLI := func(c *config.Config) {
+				if flagPluginsDir != "" {
+					c.App.PluginsDir = flagPluginsDir
+				}
+				if flagHost != "" {
+					c.App.Host = flagHost
+				}
+				if flagPort != 0 {
+					c.App.Port = flagPort
+				}
+				if flagUpstreamProxy != "" {
+					c.App.UpstreamProxy = flagUpstreamProxy
+				}
+				if sslInsecureChanged {
+					c.App.SslInsecure = flagSslInsecure
+				}
+			}
+			applyCLI(config.Global)
+			config.SetCLIOverrides(applyCLI)
+
+			style.Init()
+			icons.Init(config.Global)
+			keys.Init(config.Global)
+
+			projectDir := config.ExpandPath(config.Global.App.ProjectDir)
+
+			if flagProject != "" {
+				project, err := homeUI.OpenProject(projectDir, flagProject)
+				if err != nil {
+					return fmt.Errorf("project: %w", err)
+				}
+				if err := config.MergeProjectConfig(filepath.Dir(project.Path)); err != nil {
+					return fmt.Errorf("project config: %w", err)
+				}
+				icons.Init(config.Global)
+				keys.Init(config.Global)
+				broker := intercept.NewBroker()
+				m := appUI.New(broker, project.Name, project.Path)
+				final, err := tea.NewProgram(m).Run()
+				if err != nil {
+					return fmt.Errorf("tui: %w", err)
+				}
+				if app, ok := final.(appUI.Model); ok {
+					if ferr := app.FatalErr(); ferr != nil {
+						return ferr
+					}
+				}
+				return nil
+			}
+
+			root := rootModel{home: homeUI.New(projectDir)}
+			final, err := tea.NewProgram(root).Run()
+			if err != nil {
+				return fmt.Errorf("tui: %w", err)
+			}
+			if r, ok := final.(rootModel); ok {
+				if ferr := r.FatalErr(); ferr != nil {
+					return ferr
+				}
+			}
+			return nil
+		},
 	}
 
-	// Run home + app in a single program to avoid a blank flash on transition.
-	root := rootModel{home: homeUI.New(projectDir)}
-	final, err := tea.NewProgram(root).Run()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "tui: %v\n", err)
+	rootCmd.Flags().StringVarP(&flagConfig, "config", "c", "", "path to config file")
+	rootCmd.Flags().StringVar(&flagPluginsDir, "plugins-dir", "", "path to plugins dir (overrides config)")
+	rootCmd.Flags().StringVar(&flagHost, "host", "", "proxy host (overrides config)")
+	rootCmd.Flags().IntVarP(&flagPort, "port", "p", 0, "proxy port (overrides config)")
+	rootCmd.Flags().StringVar(&flagUpstreamProxy, "upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
+	rootCmd.Flags().BoolVar(&flagSslInsecure, "ssl-insecure", false, "skip TLS certificate verification (overrides config)")
+	rootCmd.Flags().StringVarP(&flagProject, "project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
+	rootCmd.Flags().BoolVar(&flagAddDefaultPlugins, "add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
+	rootCmd.Flags().BoolVar(&flagAddDefaultConfig, "add-default-config", false, "copy the default config file to the config path and exit")
+
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
-	if r, ok := final.(rootModel); ok {
-		if ferr := r.FatalErr(); ferr != nil {
-			fmt.Fprintf(os.Stderr, "error: %v\n", ferr)
-			os.Exit(1)
-		}
-	}
 }

cmd/spilltea/root.go

@@ -1,8 +1,14 @@
 package main
 
 import (
+	"log"
+	"path/filepath"
+
 	tea "charm.land/bubbletea/v2"
+	"github.com/anotherhadi/spilltea/internal/config"
+	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/intercept"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
 	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
 )
@@ -34,6 +40,11 @@ func (m rootModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	if m.state == rootStateHome {
 		if sel, ok := msg.(homeUI.ProjectSelectedMsg); ok {
+			if err := config.MergeProjectConfig(filepath.Dir(sel.Project.Path)); err != nil {
+				log.Printf("project config: %v", err)
+			}
+			icons.Init(config.Global)
+			keys.Init(config.Global)
 			broker := intercept.NewBroker()
 			app := appUI.New(broker, sel.Project.Name, sel.Project.Path)
 			m.app = app

docs/basics.md

@@ -4,9 +4,9 @@ Spilltea organizes work into **projects**. Each project maps to a SQLite databas
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
@@ -15,20 +15,38 @@ Check the default configuration with all the options [here](./internal/config/de
 
 Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
 
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 <!-- exec: echo '```' && go run ./cmd/spilltea -h && echo '```' -->
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
 <!-- endexec -->

docs/main.md

@@ -11,5 +11,7 @@
 # Spilltea Documentation
 
 - **Version**: `{{.Cfg.Version}}`
+- **Proxy**: `{{.Cfg.App.Host}}:{{.Cfg.App.Port}}`
+- **SSL Insecure**: `{{.Cfg.App.SslInsecure}}`
 - **Repository**: `https://github.com/anotherhadi/spilltea`
 - **Sponsor this project**: `https://ko-fi.com/anotherhadi`

docs/plugins.md

@@ -155,7 +155,7 @@ If the user **dismisses** a finding it is permanently hidden and will never reap
 
 ## Configuration
 
-Plugin configuration is stored in a `plugins.yaml` file alongside the project database.
+Plugin configuration is stored in a `plugins.yaml` file alongside the project database and can be edited through the "Proxy" TUI page.
 Each plugin is keyed by its filename (without the `.lua` extension) and has an `enable` toggle and an optional `config` block (arbitrary YAML).
 
 ```yaml

docs/proxy.md

@@ -1,6 +1,12 @@
 ## Configuring your browser's proxy settings
 
-We recommend installing **FoxyProxy** to manage your browser's proxies.
+**If you use Nix**, you can launch a pre-configured browser (LibreWolf) with the proxy and certificate already set up:
+
+```sh
+nix run github:anotherhadi/spilltea#browser{{if or (ne .Cfg.App.Host "127.0.0.1") (ne .Cfg.App.Port 8080) (ne .Cfg.App.CertDir "~/.local/share/spilltea")}} --{{end}}{{if ne .Cfg.App.Host "127.0.0.1"}} --host {{.Cfg.App.Host}}{{end}}{{if ne .Cfg.App.Port 8080}} --port {{.Cfg.App.Port}}{{end}}{{if ne .Cfg.App.CertDir "~/.local/share/spilltea"}} --cert-dir {{.Cfg.App.CertDir}}{{end}}
+```
+
+Otherwise, we recommend installing **FoxyProxy** to manage your browser's proxies.
 You can install it from the [Google Chrome extension store](https://chromewebstore.google.com/) or from the [Firefox extension store](https://addons.mozilla.org/en-US/firefox/extensions)
 
 1. Open FoxyProxy's options, then click on `Add New Proxy` button.

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/yuin/gopher-lua v1.1.2
-	golang.org/x/net v0.54.0
+	golang.org/x/net v0.55.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.50.1
 )
@@ -41,6 +41,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-runewidth v0.0.23 // indirect
@@ -55,6 +56,7 @@ require (
 	github.com/satori/go.uuid v1.2.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.8.2 // indirect
@@ -62,7 +64,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -44,6 +44,7 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
@@ -72,6 +73,8 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
 github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -104,6 +107,7 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
@@ -116,6 +120,9 @@ github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
@@ -140,12 +147,12 @@ golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

internal/config/config.go

@@ -28,6 +28,7 @@ type Config struct {
 		ProxyAuth      string `mapstructure:"proxy_auth"`
 		MaxBodySizeMB  int    `mapstructure:"max_body_size_mb"`
 		ExternalEditor string `mapstructure:"external_editor"`
+		SslInsecure    bool   `mapstructure:"ssl_insecure"`
 	} `mapstructure:"app"`
 
 	TUI struct {
@@ -64,6 +65,43 @@ type GlobalPlugin struct {
 
 var Global *Config
 
+var projectCLIOverrides func(*Config)
+
+// SetCLIOverrides stores a function that re-applies CLI flag overrides.
+// It is called automatically after MergeProjectConfig so that CLI flags
+// always win over both global and per-project config.
+func SetCLIOverrides(fn func(*Config)) {
+	projectCLIOverrides = fn
+}
+
+// MergeProjectConfig merges <projectDir>/config.yaml on top of the current
+// Global config, then re-applies any registered CLI overrides.
+// If no config.yaml exists in the project directory, this is a no-op.
+func MergeProjectConfig(projectDir string) error {
+	projectConfigPath := filepath.Join(projectDir, "config.yaml")
+	if _, err := os.Stat(projectConfigPath); errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	pv := viper.New()
+	pv.SetConfigFile(projectConfigPath)
+	if err := pv.ReadInConfig(); err != nil {
+		return fmt.Errorf("project config: %w", err)
+	}
+	if err := viper.MergeConfigMap(pv.AllSettings()); err != nil {
+		return fmt.Errorf("merge project config: %w", err)
+	}
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	if projectCLIOverrides != nil {
+		projectCLIOverrides(Global)
+	}
+	return nil
+}
+
 func Load(path string) error {
 	var defaults map[string]any
 	if err := yaml.Unmarshal(defaultConfig, &defaults); err != nil {
@@ -82,11 +120,16 @@ func Load(path string) error {
 	}
 
 	Global = &Config{}
-	return viper.Unmarshal(Global)
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	return nil
 }
 
 func WriteDefaultConfig(path string) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
 		return fmt.Errorf("create config dir: %w", err)
 	}
 	if err := os.WriteFile(path, defaultConfig, 0o600); err != nil {
@@ -106,6 +149,17 @@ func ExpandPath(p string) string {
 	return p
 }
 
+// expandEnvValue replaces a value starting with "$" with the corresponding
+// environment variable, enabling secrets to be kept out of config files.
+func expandEnvValue(s string) string {
+	if len(s) > 1 && s[0] == '$' {
+		if val := os.Getenv(s[1:]); val != "" {
+			return val
+		}
+	}
+	return s
+}
+
 func flatten(prefix string, m map[string]any) map[string]any {
 	out := make(map[string]any)
 	for k, v := range m {

internal/config/default_config.yaml

@@ -4,15 +4,16 @@ app:
   cert_dir: ~/.local/share/spilltea
   project_dir: ~/.local/share/spilltea
   plugins_dir: ~/.config/spilltea/plugins
-  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or http://user:pass@host:8888
-  proxy_auth: "" # require basic auth to use the proxy, format: user:pass (empty = disabled). Also run: chmod 600 ~/.config/spilltea/config.yaml
+  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or $ENV_VAR
+  proxy_auth: "" # require basic auth to use the spilltea proxy, format: user:pass or $ENV_VAR (empty = disabled).
   max_body_size_mb: 50 # max response body size read into memory for large streamed responses (MB)
   external_editor: "" # override $EDITOR for external editing (e.g. nvim, code --wait)
+  ssl_insecure: false # bypass TLS certificate verification (enable for self-signed cert targets)
 
 intercept:
   default_intercept_enabled: true
   default_capture_response: false
-  queue_size: 64 # max pending intercepted requests/responses before the proxy blocks
+  queue_size: 128 # max pending intercepted requests/responses before the proxy blocks
   auto_forward_regex:
     - '\.(js|css|png|gif|ico|woff2?|ttf|svg)(\?.*)?$'
 
@@ -31,12 +32,13 @@ tui:
 keybindings:
   global:
     quit: "q,ctrl+c"
+    escape: "esc,ctrl+c"
     help: "?"
     open_logs: "ctrl+g"
     toggle_sidebar: "ctrl+b"
     cycle_focus: "tab"
     send_to_replay: "ctrl+r"
-    send_to_diff: "ctrl+d"
+    send_to_diff: "ctrl+x"
     copy_as: "ctrl+y"
     copy: "y"
     up: "up,k"
@@ -45,10 +47,10 @@ keybindings:
     right: "right,l"
     goto_top: "g"
     goto_bottom: "G,end"
-    scroll_up: "pgup"
-    scroll_down: "pgdown"
-    prev_page: "["
-    next_page: "]"
+    scroll_up: "pgup,ctrl+u"
+    scroll_down: "pgdown,ctrl+d"
+    prev_page: "[,ctrl+i"
+    next_page: "],ctrl+o"
 
   intercept:
     toggle_intercept: "i"
@@ -59,7 +61,7 @@ keybindings:
     drop_all: "D"
     edit: "e,enter"
     edit_external: "E"
-    undo_edits: "ctrl+z"
+    undo_edits: "u,ctrl+z"
 
   history:
     delete_entry: "x"
@@ -77,15 +79,19 @@ keybindings:
     send: "s, enter"
     edit: "e"
     edit_external: "E"
-    undo_edits: "ctrl+z"
+    undo_edits: "u,ctrl+z"
     delete_entry: "x"
     delete_all: "X"
+    filter: "/"
+    flag: "m"
 
   diff:
     clear: "x"
 
   findings:
     dismiss: "x"
+    dismiss_all: "X"
+    flag: "m"
 
   plugins:
     toggle: "space"

internal/config/keybindings.go

@@ -2,6 +2,7 @@ package config
 
 type GlobalKeys struct {
 	Quit          string `mapstructure:"quit"`
+	Escape        string `mapstructure:"escape"`
 	OpenLogs      string `mapstructure:"open_logs"`
 	ToggleSidebar string `mapstructure:"toggle_sidebar"`
 	Help          string `mapstructure:"help"`
@@ -55,6 +56,8 @@ type ReplayKeys struct {
 	UndoEdits string `mapstructure:"undo_edits"`
 	Delete    string `mapstructure:"delete_entry"`
 	DeleteAll string `mapstructure:"delete_all"`
+	Filter    string `mapstructure:"filter"`
+	Flag      string `mapstructure:"flag"`
 }
 
 type DiffKeys struct {
@@ -62,7 +65,9 @@ type DiffKeys struct {
 }
 
 type FindingsKeys struct {
-	Dismiss string `mapstructure:"dismiss"`
+	Dismiss    string `mapstructure:"dismiss"`
+	DismissAll string `mapstructure:"dismiss_all"`
+	Flag       string `mapstructure:"flag"`
 }
 
 type PluginsKeys struct {

internal/db/db.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"database/sql"
+	"log"
 	"sync"
 
 	_ "modernc.org/sqlite"
@@ -25,17 +26,25 @@ func Open(path string) (*DB, error) {
 	conn.SetMaxOpenConns(1)
 	d := &DB{conn: conn, path: path}
 	if err := d.migrate(); err != nil {
-		conn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
 		return nil, err
 	}
 	roConn, err := sql.Open("sqlite", path)
 	if err != nil {
-		conn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
 		return nil, err
 	}
 	if _, err := roConn.Exec("PRAGMA query_only=ON"); err != nil {
-		conn.Close()
-		roConn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
+		if cerr := roConn.Close(); cerr != nil {
+			log.Printf("db: close roConn: %v", cerr)
+		}
 		return nil, err
 	}
 	d.roConn = roConn
@@ -70,7 +79,8 @@ CREATE TABLE IF NOT EXISTS replay_entries (
 			request_raw  TEXT NOT NULL,
 			response_raw TEXT NOT NULL,
 			status_code  INTEGER NOT NULL,
-			error_msg    TEXT NOT NULL
+			error_msg    TEXT NOT NULL,
+			flagged      INTEGER NOT NULL DEFAULT 0
 		);
 CREATE TABLE IF NOT EXISTS findings (
 			id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -80,6 +90,7 @@ CREATE TABLE IF NOT EXISTS findings (
 			description TEXT NOT NULL DEFAULT '',
 			severity    TEXT NOT NULL DEFAULT 'info',
 			dismissed   INTEGER NOT NULL DEFAULT 0,
+			flagged     INTEGER NOT NULL DEFAULT 0,
 			created_at  DATETIME NOT NULL,
 			UNIQUE(plugin_name, dedup_key)
 		);
@@ -114,6 +125,8 @@ func CountEntriesAt(path string) int {
 	}
 	defer conn.Close()
 	var n int
-	conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n)
+	if err := conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n); err != nil {
+		log.Printf("db: count entries: %v", err)
+	}
 	return n
 }

internal/db/entries.go

@@ -81,7 +81,11 @@ func scanEntries(rows *sql.Rows) ([]Entry, error) {
 		if err := rows.Scan(&e.ID, &ts, &e.Method, &e.Host, &e.Path, &e.StatusCode, &e.RequestRaw, &e.ResponseRaw, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse timestamp %q: %v", ts, tsErr)
+		}
 		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
@@ -121,7 +125,7 @@ func (d *DB) SearchEntries(term string) ([]Entry, error) {
 // Uses the persistent read-only connection (PRAGMA query_only=ON) so that any
 // DML or DDL in the user-supplied expression is rejected by SQLite before it executes.
 func (d *DB) QueryEntries(where string) ([]Entry, error) {
-	q := "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged FROM entries WHERE " + strings.TrimSpace(where)
+	q := "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged FROM entries WHERE " + strings.TrimSpace(where) // #nosec G202 -- intentional: user-supplied WHERE clause on a PRAGMA query_only=ON connection
 	rows, err := d.roConn.Query(q)
 	if err != nil {
 		return nil, err

internal/db/findings.go

@@ -11,6 +11,7 @@ type Finding struct {
 	Title       string
 	Description string
 	Severity    string
+	Flagged     bool
 	CreatedAt   time.Time
 }
 
@@ -34,7 +35,7 @@ func (d *DB) UpsertFinding(f Finding) (bool, error) {
 
 func (d *DB) LoadFindings() ([]Finding, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, plugin_name, dedup_key, title, description, severity, created_at
+		`SELECT id, plugin_name, dedup_key, title, description, severity, flagged, created_at
 		 FROM findings WHERE dismissed = 0 ORDER BY id ASC`,
 	)
 	if err != nil {
@@ -45,9 +46,11 @@ func (d *DB) LoadFindings() ([]Finding, error) {
 	for rows.Next() {
 		var f Finding
 		var ts string
-		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &ts); err != nil {
+		var flagged int
+		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &flagged, &ts); err != nil {
 			return nil, err
 		}
+		f.Flagged = flagged != 0
 		for _, layout := range findingTimeFormats {
 			if t, err := time.Parse(layout, ts); err == nil {
 				f.CreatedAt = t.Local()
@@ -63,3 +66,23 @@ func (d *DB) DismissFinding(id int64) error {
 	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE id = ?`, id)
 	return err
 }
+
+func (d *DB) ToggleFindingFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE findings SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
+// DismissAllFindings dismisses unflagged findings first. If none are unflagged
+// (only flagged ones remain), it dismisses everything.
+func (d *DB) DismissAllFindings() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM findings WHERE dismissed = 0 AND flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1`)
+	return err
+}

internal/db/replay.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"log"
 	"time"
 )
 
@@ -16,16 +17,17 @@ type ReplayEntry struct {
 	ResponseRaw string
 	StatusCode  int
 	ErrorMsg    string
+	Flagged     bool
 }
 
 func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 	res, err := d.conn.Exec(
-		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		e.Timestamp.UTC().Format(time.RFC3339),
 		e.Scheme, e.Host, e.Path, e.Method,
 		e.OriginalRaw, e.RequestRaw, e.ResponseRaw,
-		e.StatusCode, e.ErrorMsg,
+		e.StatusCode, e.ErrorMsg, e.Flagged,
 	)
 	if err != nil {
 		return 0, err
@@ -35,15 +37,15 @@ func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 
 func (d *DB) UpdateReplayEntry(e ReplayEntry) error {
 	_, err := d.conn.Exec(
-		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=? WHERE id=?`,
-		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.ID,
+		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=?, flagged=? WHERE id=?`,
+		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.Flagged, e.ID,
 	)
 	return err
 }
 
 func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg
+		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged
 		 FROM replay_entries ORDER BY id ASC`,
 	)
 	if err != nil {
@@ -55,16 +57,27 @@ func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	for rows.Next() {
 		var e ReplayEntry
 		var ts string
+		var flagged int
 		if err := rows.Scan(&e.ID, &ts, &e.Scheme, &e.Host, &e.Path, &e.Method,
-			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg); err != nil {
+			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse replay timestamp %q: %v", ts, tsErr)
+		}
+		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
 	return entries, rows.Err()
 }
 
+func (d *DB) ToggleReplayFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE replay_entries SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
 func (d *DB) DeleteReplayEntry(id int64) error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE id = ?`, id)
 	return err
@@ -74,3 +87,18 @@ func (d *DB) DeleteAllReplayEntries() error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
 	return err
 }
+
+// DeleteAllReplayEntriesExceptFlagged deletes all unflagged replay entries. If
+// none are unflagged (only flagged ones remain), it deletes everything.
+func (d *DB) DeleteAllReplayEntriesExceptFlagged() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM replay_entries WHERE flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
+	return err
+}

internal/icons/icons.go

@@ -48,6 +48,8 @@ func Init(cfg *config.Config) {
 			Flag:      "󰈻 ",
 		}
 	} else {
-		I = &Icons{}
+		I = &Icons{
+			Flag: "*",
+		}
 	}
 }

internal/intercept/format.go

@@ -14,6 +14,9 @@ func FormatRawRequest(f *proxy.Flow) string {
 	r := f.Request
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "%s %s %s\n", r.Method, r.URL.RequestURI(), r.Proto)
+	if r.URL.Host != "" {
+		fmt.Fprintf(&sb, "Host: %s\n", r.URL.Host)
+	}
 	for _, line := range util.SortedHeaderLines(r.Header) {
 		sb.WriteString(line)
 	}

internal/keys/findings.go

@@ -6,15 +6,19 @@ import (
 )
 
 type FindingsKeyMap struct {
-	Dismiss key.Binding
+	Dismiss    key.Binding
+	DismissAll key.Binding
+	Flag       key.Binding
 }
 
 func newFindingsKeyMap(cfg config.FindingsKeys) FindingsKeyMap {
 	return FindingsKeyMap{
-		Dismiss: binding(cfg.Dismiss, "dismiss"),
+		Dismiss:    binding(cfg.Dismiss, "dismiss"),
+		DismissAll: binding(cfg.DismissAll, "dismiss all"),
+		Flag:       binding(cfg.Flag, "flag"),
 	}
 }
 
 func (f FindingsKeyMap) Bindings() []key.Binding {
-	return []key.Binding{f.Dismiss}
+	return []key.Binding{f.Flag, f.Dismiss, f.DismissAll}
 }

internal/keys/global.go

@@ -41,7 +41,7 @@ func newGlobalKeyMap(cfg config.GlobalKeys) GlobalKeyMap {
 		CycleFocus:    binding(cfg.CycleFocus, "cycle focus"),
 		CopyAs:        binding(cfg.CopyAs, "copy as..."),
 		Copy:          binding(cfg.Copy, "copy..."),
-		Escape:        key.NewBinding(key.WithKeys("esc"), key.WithHelp("esc", "cancel")),
+		Escape:        binding(cfg.Escape, "cancel"),
 		SendToReplay:  binding(cfg.SendToReplay, "send to replay"),
 		ScrollUp:      binding(cfg.ScrollUp, "scroll up"),
 		ScrollDown:    binding(cfg.ScrollDown, "scroll down"),

internal/keys/replay.go

@@ -12,6 +12,8 @@ type ReplayKeyMap struct {
 	UndoEdits key.Binding
 	Delete    key.Binding
 	DeleteAll key.Binding
+	Filter    key.Binding
+	Flag      key.Binding
 }
 
 func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
@@ -22,9 +24,11 @@ func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
 		UndoEdits: binding(cfg.UndoEdits, "undo edits"),
 		Delete:    binding(cfg.Delete, "delete"),
 		DeleteAll: binding(cfg.DeleteAll, "delete all"),
+		Filter:    binding(cfg.Filter, "filter"),
+		Flag:      binding(cfg.Flag, "flag"),
 	}
 }
 
 func (r ReplayKeyMap) Bindings() []key.Binding {
-	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Delete, r.DeleteAll}
+	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Flag, r.Delete, r.DeleteAll, r.Filter}
 }

internal/plugins/lua.go

@@ -46,7 +46,7 @@ func newLuaState(mgr *Manager, p *Plugin) *lua.LState {
 func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 	L.SetGlobal("log", L.NewFunction(func(L *lua.LState) int {
 		msg := L.CheckString(1)
-		log.Printf("[plugin:%s] %s", p.Name, msg)
+		log.Printf("plugin %s: %s", p.Name, msg)
 		return 0
 	}))
 
@@ -85,7 +85,7 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 			CreatedAt:   time.Now(),
 		})
 		if err != nil {
-			log.Printf("[plugin:%s] create_finding error: %v", p.Name, err)
+			log.Printf("plugin %s: create_finding error: %v", p.Name, err)
 			return 0
 		}
 		_ = inserted
@@ -281,7 +281,7 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
 
-		c := exec.CommandContext(ctx, "sh", "-c", cmd)
+		c := exec.CommandContext(ctx, "sh", "-c", cmd) // #nosec G204 -- intentional: shell_pipe is a Lua plugin API for user-written scripts
 		c.Stdin = strings.NewReader(input)
 
 		var stdout, stderr bytes.Buffer
@@ -337,7 +337,7 @@ func luaTableString(t *lua.LTable, key string) string {
 	return ""
 }
 
-func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
+func pushRequest(L *lua.LState, p *Plugin, f *goproxy.Flow) *lua.LTable {
 	t := L.NewTable()
 	r := f.Request
 	L.SetField(t, "method", lua.LString(r.Method))
@@ -377,7 +377,7 @@ func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
 	L.SetField(t, "set_url", L.NewFunction(func(L *lua.LState) int {
 		parsed, err := url.Parse(L.CheckString(2))
 		if err != nil {
-			log.Printf("[plugin] set_url: %v", err)
+			log.Printf("plugin %s: set_url: %v", p.Name, err)
 			return 0
 		}
 		r.URL = parsed

internal/plugins/manager.go

@@ -395,25 +395,25 @@ func (m *Manager) runAsyncForPlugins(hookName string, argsFor func(*Plugin) []lu
 
 func (m *Manager) RunSyncOnRequest(f *goproxy.Flow) intercept.Decision {
 	return m.runSyncDecisionForPlugins("on_request", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f)}
 	})
 }
 
 func (m *Manager) RunAsyncOnRequest(f *goproxy.Flow) {
 	m.runAsyncForPlugins("on_request", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f)}
 	})
 }
 
 func (m *Manager) RunSyncOnResponse(f *goproxy.Flow) intercept.Decision {
 	return m.runSyncDecisionForPlugins("on_response", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f), pushResponse(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
 	})
 }
 
 func (m *Manager) RunAsyncOnResponse(f *goproxy.Flow) {
 	m.runAsyncForPlugins("on_response", func(p *Plugin) []lua.LValue {
-		return []lua.LValue{pushRequest(p.L, f), pushResponse(p.L, f)}
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
 	})
 }
 

internal/plugins/pluginsfile.go

@@ -1,6 +1,7 @@
 package plugins
 
 import (
+	"log"
 	"os"
 	"path/filepath"
 
@@ -27,7 +28,7 @@ func OpenPluginsFile(dbPath string) (*PluginsFile, error) {
 		path: path,
 		data: pluginsFileData{Plugins: make(map[string]pluginFileEntry)},
 	}
-	raw, err := os.ReadFile(path)
+	raw, err := os.ReadFile(path) // #nosec G304 -- path is filepath.Join(dbDir, "plugins.yaml"), hardcoded filename
 	if os.IsNotExist(err) {
 		return pf, nil
 	}
@@ -76,7 +77,9 @@ func (pf *PluginsFile) register(id string, defaultEnabled bool, configText strin
 			}
 		}
 		pf.data.Plugins[id] = entry
-		_ = pf.save()
+		if err := pf.save(); err != nil {
+			log.Printf("plugin %s: register save: %v", id, err)
+		}
 	}
 }
 

internal/proxy/proxy.go

@@ -120,6 +120,7 @@ func Start(broker *intercept.Broker, mgr *plugins.Manager) error {
 		StreamLargeBodies: int64(cfg.MaxBodySizeMB) * 1024 * 1024,
 		CaRootPath:        caPath,
 		Upstream:          cfg.UpstreamProxy,
+		SslInsecure:       cfg.SslInsecure,
 	}
 
 	p, err := goproxy.NewProxy(opts)

internal/ui/app/model.go

@@ -1,7 +1,6 @@
 package app
 
 import (
-	"fmt"
 	"log"
 	"os"
 	"path/filepath"
@@ -37,11 +36,9 @@ func tickCmd() tea.Cmd {
 	})
 }
 
-var sidebarEntries = pageRegistry
-
 var pageShortcuts = func() map[string]page {
-	m := make(map[string]page, len(sidebarEntries))
-	for i, e := range sidebarEntries {
+	m := make(map[string]page, len(pageRegistry))
+	for i, e := range pageRegistry {
 		m[strconv.Itoa(i+1)] = e.id
 	}
 	return m
@@ -56,6 +53,7 @@ type Model struct {
 	logFile       *os.File
 	pluginManager *plugins.Manager
 	fatalErr      error
+	logFileErr    error
 
 	width         int
 	height        int
@@ -97,8 +95,8 @@ func New(broker *intercept.Broker, name, path string) Model {
 
 	d, err := db.Open(path)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "db: %v\n", err)
-		os.Exit(1)
+		m.fatalErr = err
+		return m
 	}
 	m.database = d
 	broker.SetDB(d)
@@ -131,6 +129,8 @@ func New(broker *intercept.Broker, name, path string) Model {
 		m.logFile = lf
 		log.SetOutput(lf)
 		logrus.SetOutput(lf)
+	} else {
+		m.logFileErr = err
 	}
 
 	return m
@@ -140,7 +140,7 @@ func (m Model) FatalErr() error { return m.fatalErr }
 
 func (m Model) Init() tea.Cmd {
 	mgr := m.pluginManager
-	return tea.Batch(
+	cmds := []tea.Cmd{
 		intercept.WaitForRequest(m.broker),
 		intercept.WaitForResponse(m.broker),
 		tickCmd(),
@@ -149,5 +149,16 @@ func (m Model) Init() tea.Cmd {
 		plugins.WaitForQuit(mgr),
 		findingsUI.RefreshCmd(m.database),
 		func() tea.Msg { mgr.RunOnStart(); return nil },
-	)
+	}
+	if m.logFileErr != nil {
+		err := m.logFileErr
+		cmds = append(cmds, func() tea.Msg {
+			return notificationsUI.NotificationMsg{
+				Title: "Warning",
+				Body:  "Could not open log file: " + err.Error(),
+				Kind:  notificationsUI.KindWarning,
+			}
+		})
+	}
+	return tea.Batch(cmds...)
 }

internal/ui/app/sidebar.go

@@ -62,7 +62,7 @@ func (m *Model) renderSidebar() string {
 	var items strings.Builder
 	badgeUnread := lipgloss.NewStyle().Foreground(ilovetui.S.Warning).Bold(true)
 
-	for i, entry := range sidebarEntries {
+	for i, entry := range pageRegistry {
 		selected := entry.id == m.page
 		badgeStyle, textStyle := badgeNormal, textNormal
 		if selected {

internal/ui/app/update.go

@@ -2,7 +2,6 @@ package app
 
 import (
 	"log"
-	"os"
 	"os/exec"
 	"path/filepath"
 
@@ -21,6 +20,7 @@ import (
 	historyUI "github.com/anotherhadi/spilltea/internal/ui/history"
 	interceptUI "github.com/anotherhadi/spilltea/internal/ui/intercept"
 	replayUI "github.com/anotherhadi/spilltea/internal/ui/replay"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -162,23 +162,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, cmd
 
 	case tea.KeyPressMsg:
-		// ctrl+c always quits, even when a textarea is focused.
-		if msg.String() == "ctrl+c" {
-			m.pluginManager.RunOnQuit()
-			return m, tea.Quit
-		}
 		if key.Matches(msg, keys.Keys.Global.Quit) && !m.activeIsEditing() {
 			m.pluginManager.RunOnQuit()
 			return m, tea.Quit
 		}
 
 		if key.Matches(msg, keys.Keys.Global.OpenLogs) {
-			editor := os.Getenv("EDITOR")
-			if editor == "" {
-				editor = "vi"
-			}
 			logPath := filepath.Join(filepath.Dir(m.projectPath), "logs.log")
-			return m, tea.ExecProcess(exec.Command(editor, logPath), nil)
+			return m, tea.ExecProcess(exec.Command(util.ResolveEditor(), logPath), nil) // #nosec G204 G702 -- editor from trusted config/$EDITOR, logPath is a fixed path
 		}
 
 		if !m.activeIsEditing() {

internal/ui/app/view.go

@@ -6,25 +6,28 @@ import (
 	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
+func (m Model) newView(content string) tea.View {
+	v := tea.NewView(content)
+	v.AltScreen = true
+	v.WindowTitle = "Spilltea: " + m.projectName
+	return v
+}
+
 func (m Model) View() tea.View {
 	if m.width == 0 {
-		v := tea.NewView("")
-		v.AltScreen = true
-		return v
+		return m.newView("")
 	}
 
 	normal := m.renderNormal()
 
 	if m.copyAs.IsOpen() {
-		v := tea.NewView(m.copyAs.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copyAs.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
 
 	if m.copy.IsOpen() {
-		v := tea.NewView(m.copy.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copy.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
@@ -34,8 +37,7 @@ func (m Model) View() tea.View {
 		rendered = m.notifications.View(normal)
 	}
 
-	v := tea.NewView(rendered)
-	v.AltScreen = true
+	v := m.newView(rendered)
 	v.MouseMode = tea.MouseModeCellMotion
 	return v
 }

internal/ui/components/copyas/formats.go

@@ -16,7 +16,7 @@ type parsedRequest struct {
 	path    string
 	host    string
 	scheme  string
-	headers []header // garder header{key, value} pour compat locale
+	headers []header
 	body    string
 }
 

internal/ui/diff/model.go

@@ -300,7 +300,7 @@ func (m *Model) refreshViewports() {
 		placeholder := lipgloss.Place(
 			m.leftViewport.Width(), m.leftViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("<(^_^)>", "send two entries here to compare")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.leftViewport.Width(), "<(^_^)>", "send two entries here to compare")),
 		)
 		m.leftViewport.SetContent(placeholder)
 		m.rightViewport.SetContent("")
@@ -312,7 +312,7 @@ func (m *Model) refreshViewports() {
 		placeholder := lipgloss.Place(
 			m.rightViewport.Width(), m.rightViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(・3・)", "waiting for second entry…")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.rightViewport.Width(), "(・3・)", "waiting for second entry…")),
 		)
 		m.rightViewport.SetContent(placeholder)
 		return

internal/ui/docs/model.go

@@ -25,10 +25,10 @@ func readDoc(name string) string {
 
 var contentMarkdown = strings.Join([]string{
 	readDoc("main.md"),
-	readDoc("legal-disclaimer.md"),
-	readDoc("basics.md"),
 	readDoc("proxy.md"),
 	readDoc("certificate.md"),
+	readDoc("legal-disclaimer.md"),
+	readDoc("basics.md"),
 	readDoc("history.md"),
 }, "\n")
 

internal/ui/docs/update.go

@@ -18,12 +18,9 @@ func (e Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case tea.KeyPressMsg:
 		if e.searching {
 			switch {
-			case key.Matches(msg, d.SearchReset):
+			case key.Matches(msg, g.Escape):
 				e.searching = false
 				e.searchInput.Blur()
-				e.searchInput.SetValue("")
-				e.matches = nil
-				e.matchIndex = 0
 				e.SetSize(e.width, e.height)
 			case msg.String() == "enter":
 				e.searching = false

internal/ui/findings/model.go

@@ -186,7 +186,7 @@ type findingsKeyMap struct{ width int }
 func (findingsKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	f := keys.Keys.Findings
-	return []key.Binding{g.Up, g.Down, f.Dismiss, g.Copy, g.Help}
+	return []key.Binding{g.Up, g.Down, f.Flag, f.Dismiss, f.DismissAll, g.Copy, g.Help}
 }
 
 func (m findingsKeyMap) FullHelp() [][]key.Binding {

internal/ui/findings/update.go

@@ -72,6 +72,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.refreshListViewport()
 				m.refreshBody()
 			}
+		case key.Matches(msg, f.Flag):
+			if len(m.findings) > 0 && m.database != nil {
+				if err := m.database.ToggleFindingFlag(m.findings[m.cursor].ID); err != nil {
+					log.Printf("findings: toggle flag: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, f.Dismiss):
 			if len(m.findings) > 0 && m.database != nil {
 				if err := m.database.DismissFinding(m.findings[m.cursor].ID); err != nil {
@@ -80,6 +88,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				return m, RefreshCmd(m.database)
 			}
+		case key.Matches(msg, f.DismissAll):
+			if m.database != nil {
+				if err := m.database.DismissAllFindings(); err != nil {
+					log.Printf("findings: dismiss all: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, g.ScrollUp):
 			util.ScrollViewport(&m.bodyViewport, -1)
 		case key.Matches(msg, g.ScrollDown):

internal/ui/findings/view.go

@@ -52,7 +52,7 @@ func (m *Model) renderList() string {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(҂◡_◡) ᕤ", "no findings")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(҂◡_◡) ᕤ", "no findings")),
 		)
 	}
 
@@ -66,9 +66,10 @@ func (m *Model) renderList() string {
 		sevStyle := style.SeverityStyle(f.Severity)
 		sevLabel := sevStyle.Width(8).Render(f.Severity)
 		ts := f.CreatedAt.Format("15:04:05")
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 8 + 1 + 8 + 1 + 10 + 1
+		const fixedW = 2 + 2 + 8 + 1 + 8 + 1 + 10 + 1
 		titleW := w - fixedW
 		if titleW < 0 {
 			titleW = 0
@@ -79,8 +80,13 @@ func (m *Model) renderList() string {
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(ilovetui.S.Selection)
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
 				sevStyle.Background(ilovetui.S.Selection).Width(8).Render(f.Severity),
 				bg.Width(1).Render(""),
 				bg.Foreground(ilovetui.S.Subtle).Width(8).Render(util.Truncate(f.PluginName, 8)),
@@ -90,8 +96,13 @@ func (m *Model) renderList() string {
 				bg.Bold(true).Width(titleW).Render(f.Title),
 			)
 		} else {
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
+				flagSt.Width(2).Render(flagStr),
 				sevLabel,
 				" ",
 				pluginStr,

internal/ui/history/update.go

@@ -2,6 +2,7 @@ package history
 
 import (
 	"fmt"
+	"log"
 	"net/http"
 
 	"charm.land/bubbles/v2/key"
@@ -25,7 +26,10 @@ func LoadEntriesCmd(database *db.DB) tea.Cmd {
 		if database == nil {
 			return EntriesLoadedMsg{}
 		}
-		entries, _ := database.ListEntries()
+		entries, err := database.ListEntries()
+		if err != nil {
+			log.Printf("history: load entries: %v", err)
+		}
 		return EntriesLoadedMsg{Entries: entries}
 	}
 }
@@ -72,14 +76,28 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 
 	case SearchResultMsg:
+		var selectedID int64
+		if m.cursor >= 0 && m.cursor < len(m.entries) {
+			selectedID = m.entries[m.cursor].ID
+		}
 		m.entries = msg.Entries
 		m.cursor = 0
+		if selectedID != 0 {
+			for i, e := range m.entries {
+				if e.ID == selectedID {
+					m.cursor = i
+					break
+				}
+			}
+		}
 		m.searchErr = ""
 		m.pager.SetTotalPages(len(m.entries))
 		m.refreshListViewport()
 		m.refreshBody()
-		m.bodyViewport.SetYOffset(0)
-		m.bodyViewport.SetXOffset(0)
+		if selectedID == 0 {
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+		}
 		if m.searchKind == searchKindSQL {
 			m.acceptSearch()
 		}
@@ -101,7 +119,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		g := keys.Keys.Global
 
 		if m.searchKind != searchKindOff && !m.searchAccepted {
-			// Actively typing: only search navigation + accept/cancel.
 			switch {
 			case key.Matches(msg, g.Escape):
 				return m, m.clearSearch()
@@ -112,24 +129,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				m.acceptSearch()
 
-			case key.Matches(msg, g.Up):
-				if m.cursor > 0 {
-					m.cursor--
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
-			case key.Matches(msg, g.Down):
-				if m.cursor < len(m.entries)-1 {
-					m.cursor++
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
 			default:
 				var cmd tea.Cmd
 				m.searchInput, cmd = m.searchInput.Update(msg)
@@ -234,7 +233,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 		case key.Matches(msg, h.Flag):
 			if len(m.entries) > 0 && m.database != nil {
-				m.database.ToggleFlag(m.entries[m.cursor].ID)
+				if err := m.database.ToggleFlag(m.entries[m.cursor].ID); err != nil {
+					log.Printf("history: toggle flag: %v", err)
+				}
 				return m, m.RefreshCmd()
 			}
 
@@ -242,7 +243,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if len(m.entries) > 0 {
 				id := m.entries[m.cursor].ID
 				if m.database != nil {
-					m.database.DeleteEntry(id)
+					if err := m.database.DeleteEntry(id); err != nil {
+						log.Printf("history: delete entry: %v", err)
+					}
 				}
 				return m, LoadEntriesCmd(m.database)
 			}
@@ -261,10 +264,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 						if hasUnflagged && e.Flagged {
 							continue
 						}
-						m.database.DeleteEntry(e.ID)
+						if err := m.database.DeleteEntry(e.ID); err != nil {
+							log.Printf("history: delete entry: %v", err)
+						}
 					}
 				} else {
-					m.database.DeleteAllExceptFlagged()
+					if err := m.database.DeleteAllExceptFlagged(); err != nil {
+						log.Printf("history: delete all unflagged: %v", err)
+					}
 				}
 			}
 			return m, m.clearSearch()
@@ -346,7 +353,7 @@ func (m *Model) refreshBody() {
 	}
 	if raw == "" {
 		w, h := m.bodyViewport.Width(), m.bodyViewport.Height()
-		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(˘･_･˘)", "no response stored"))))
+		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(w, "(˘･_･˘)", "no response stored"))))
 		return
 	}
 	m.bodyViewport.SetContent(style.HighlightHTTP(raw))

internal/ui/history/view.go

@@ -82,9 +82,9 @@ func (m *Model) renderList() string {
 		)
 	}
 	if len(m.entries) == 0 {
-		msg := util.CenterLines("(⌐■_■)", "no history yet")
+		msg := util.EmptyState(m.listViewport.Width(), "(⌐■_■)", "no history yet")
 		if m.searchKind != searchKindOff {
-			msg = util.CenterLines("ʕノ•ᴥ•ʔノ ︵ ┻━┻", "no results")
+			msg = util.EmptyState(m.listViewport.Width(), "ʕノ•ᴥ•ʔノ ︵ ┻━┻", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
@@ -120,9 +120,6 @@ func (m *Model) renderList() string {
 			flagStr := "  "
 			if e.Flagged {
 				flagStr = icons.I.Flag + " "
-				if icons.I.Flag == "" {
-					flagStr = "★ "
-				}
 			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
@@ -139,9 +136,6 @@ func (m *Model) renderList() string {
 			flagStr := "  "
 			if e.Flagged {
 				flagStr = icons.I.Flag + " "
-				if icons.I.Flag == "" {
-					flagStr = "★ "
-				}
 			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",

internal/ui/home/model.go

@@ -318,13 +318,14 @@ func (m Model) renderHelpLine() string {
 	}
 
 	var parts []string
+	escKey := keys.Keys.Global.Escape.Help().Key
 	if fs == list.Filtering {
 		parts = append(parts, item("enter", "apply filter"))
-		parts = append(parts, item("esc", "cancel"))
+		parts = append(parts, item(escKey, "cancel"))
 	} else {
 		parts = append(parts, item("↑/↓", "navigate"))
 		if fs == list.FilterApplied {
-			parts = append(parts, item("esc", "clear filter"))
+			parts = append(parts, item(escKey, "clear filter"))
 		} else {
 			parts = append(parts, binding(k.Filter))
 		}

internal/ui/home/update.go

@@ -3,6 +3,7 @@ package home
 import (
 	crypto "crypto/rand"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,7 +73,8 @@ func (m Model) handleSelection() (tea.Model, tea.Cmd) {
 		return m, m.nameInput.Focus()
 	case kindTemp:
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create temp dir: %v", err)
 			return m, nil
 		}
 		initProjectFiles(dir)
@@ -90,7 +92,9 @@ func (m Model) deleteSelected() (tea.Model, tea.Cmd) {
 		return m, nil
 	}
 	dir := filepath.Dir(item.path) // parent dir of data.db
-	os.RemoveAll(dir)
+	if err := os.RemoveAll(dir); err != nil {
+		log.Printf("home: remove project dir: %v", err)
+	}
 	idx := m.list.GlobalIndex()
 	m.list.RemoveItem(idx)
 	if idx > 0 && idx >= len(m.list.Items()) {
@@ -113,7 +117,8 @@ func (m Model) updateNaming(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.mode = modeSelect
 		m.nameInput.Blur()
 		dir := filepath.Join(m.projectDir, name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create project dir %q: %v", name, err)
 			return m, nil
 		}
 		initProjectFiles(dir)
@@ -147,14 +152,14 @@ func IsValidProjectName(s string) bool {
 func OpenProject(projectDir, name string) (*Project, error) {
 	if name == "tmp" || name == "temp" || name == "temporary" {
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
 			return nil, err
 		}
 		initProjectFiles(dir)
 		return &Project{Name: "temporary", Path: filepath.Join(dir, "data.db")}, nil
 	}
 	dir := filepath.Join(projectDir, name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, err
 	}
 	initProjectFiles(dir)
@@ -171,9 +176,11 @@ func initProjectFiles(dir string) {
 	for _, name := range []string{"data.db", "logs.log"} {
 		p := filepath.Join(dir, name)
 		if _, err := os.Stat(p); os.IsNotExist(err) {
-			f, err := os.Create(p)
+			f, err := os.Create(p) // #nosec G304 -- p is filepath.Join(dir, hardcoded_name), no traversal possible
 			if err == nil {
-				f.Close()
+				if cerr := f.Close(); cerr != nil {
+					log.Printf("home: close project file: %v", cerr)
+				}
 			}
 		}
 	}

internal/ui/home/view.go

@@ -6,6 +6,7 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/ui/components/teapot"
 )
 
@@ -45,6 +46,7 @@ func (m Model) View() tea.View {
 	v := tea.NewView(content)
 	v.AltScreen = true
 	v.MouseMode = tea.MouseModeCellMotion
+	v.WindowTitle = "Spilltea"
 	return v
 }
 
@@ -69,7 +71,8 @@ func (m Model) renderNamingPanel() string {
 		Width(panelW).
 		Render(label + "\n" + inputLine)
 
-	hint := ilovetui.S.Faint.Render("[enter] confirm  [esc] cancel")
+	escKey := keys.Keys.Global.Escape.Help().Key
+	hint := ilovetui.S.Faint.Render("[enter] confirm  [" + escKey + "] cancel")
 
 	var sb strings.Builder
 	sb.WriteString(center(iw, panel))

internal/ui/intercept/helpers.go

@@ -28,8 +28,14 @@ func parseRawRequest(content string, req *intercept.PendingRequest) {
 	if parsed.Proto != "" {
 		r.Proto = parsed.Proto
 	}
+	if parsed.Host != "" {
+		r.URL.Host = parsed.Host
+	}
 	r.Header = make(http.Header)
 	for _, h := range parsed.Headers {
+		if strings.EqualFold(h.Key, "host") {
+			continue
+		}
 		r.Header.Set(h.Key, h.Value)
 	}
 	if parsed.Body != "" {

internal/ui/intercept/keymap.go

@@ -2,24 +2,17 @@ package intercept
 
 import (
 	"charm.land/bubbles/v2/key"
-	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
 )
 
 type interceptKeyMap struct{ width int }
 
-func iconBinding(b key.Binding, icon string) key.Binding {
-	h := b.Help()
-	return key.NewBinding(key.WithKeys(b.Keys()...), key.WithHelp(h.Key, icon+h.Desc))
-}
-
 func (interceptKeyMap) ShortHelp() []key.Binding {
 	ic := keys.Keys.Intercept
-	i := icons.I
 	return []key.Binding{
-		iconBinding(ic.Forward, i.Forward),
-		iconBinding(ic.Drop, i.Drop),
-		iconBinding(ic.Edit, i.Edit),
+		ic.Forward,
+		ic.Drop,
+		ic.Edit,
 		keys.Keys.Global.Help,
 	}
 }

internal/ui/intercept/update.go

@@ -287,8 +287,6 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 }
 
 func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model, tea.Cmd) {
-	onResponses := m.captureResponse && m.focusedPanel == panelResponses
-
 	switch {
 	case key.Matches(msg, keys.Keys.Global.Escape):
 		m.saveCurrentEdit()
@@ -296,19 +294,6 @@ func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model,
 		m.textarea.Blur()
 		m.refreshBodyViewport()
 
-	case key.Matches(msg, keys.Keys.Intercept.UndoEdits):
-		if onResponses {
-			if len(m.responseQueue) > 0 {
-				delete(m.pendingResponseEdits, m.responseQueue[m.responseCursor])
-				m.textarea.SetValue(intercept.FormatRawResponse(m.responseQueue[m.responseCursor].Flow))
-			}
-		} else {
-			if len(m.queue) > 0 {
-				delete(m.pendingEdits, m.queue[m.cursor])
-				m.textarea.SetValue(intercept.FormatRawRequest(m.queue[m.cursor].Flow))
-			}
-		}
-
 	default:
 		var cmd tea.Cmd
 		m.textarea, cmd = m.textarea.Update(msg)

internal/ui/intercept/view.go

@@ -100,7 +100,7 @@ func (m *Model) renderStatusBar() string {
 
 func (m *Model) renderList() string {
 	if len(m.queue) == 0 {
-		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(｡◕‿‿◕｡)", "waiting for a request")))
+		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(｡◕‿‿◕｡)", "waiting for a request")))
 	}
 
 	start, end := util.PageBounds(m.pager, len(m.queue))
@@ -149,7 +149,7 @@ func (m *Model) renderList() string {
 
 func (m *Model) renderResponseList() string {
 	if len(m.responseQueue) == 0 {
-		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(҂◡_◡)", "no response yet")))
+		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(҂◡_◡)", "no response yet")))
 	}
 
 	start, end := util.PageBounds(m.responsePager, len(m.responseQueue))

internal/ui/plugins/view.go

@@ -15,7 +15,7 @@ import (
 
 func (m Model) View() tea.View {
 	if m.width == 0 || m.manager == nil {
-		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(._.)~*.'", "no plugins loaded"))))
+		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.width, "(._.)~*.'", "no plugins loaded"))))
 	}
 
 	listH, detailH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.4)
@@ -127,9 +127,9 @@ func (m *Model) renderStatusBar() string {
 
 func (m *Model) renderList() string {
 	if len(m.filtered) == 0 {
-		msg := util.CenterLines("(ง •̀_•́)ง", "no plugins", "", "spilltea --add-default-plugins")
+		msg := util.EmptyState(m.listViewport.Width(), "(ง •̀_•́)ง", "no plugins", "", "spilltea --add-default-plugins")
 		if m.filter != "" {
-			msg = util.CenterLines("= _ =", "no results")
+			msg = util.EmptyState(m.listViewport.Width(), "= _ =", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),

internal/ui/replay/model.go

@@ -2,11 +2,13 @@ package replay
 
 import (
 	"fmt"
+	"strings"
 
 	"charm.land/bubbles/v2/help"
 	"charm.land/bubbles/v2/key"
 	"charm.land/bubbles/v2/paginator"
 	"charm.land/bubbles/v2/textarea"
+	"charm.land/bubbles/v2/textinput"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
@@ -31,6 +33,7 @@ type Entry struct {
 	ResponseRaw string // filled after send
 	StatusCode  int    // 0 = not sent yet
 	Sending     bool
+	Flagged     bool
 	Err         error
 }
 
@@ -43,12 +46,18 @@ const (
 )
 
 type Model struct {
-	entries      []Entry
+	allEntries   []Entry
+	entries      []Entry // filtered view; equals allEntries when no filter
+	entryIndices []int   // maps entries[i] -> allEntries[i]; nil when no filter
 	cursor       int
 	editing      bool
 	focusedPanel panel
 	database     *db.DB
 
+	filterInput    textinput.Model
+	filterActive   bool
+	filterAccepted bool
+
 	listViewport     viewport.Model
 	requestViewport  viewport.Model
 	responseViewport viewport.Model
@@ -63,11 +72,14 @@ type Model struct {
 func New() Model {
 	ta := ilovetui.NewTextarea(false)
 	ta.Blur()
+	ti := textinput.New()
+	ti.Prompt = ""
 	return Model{
 		listViewport:     ilovetui.NewViewport(),
 		requestViewport:  ilovetui.NewViewport(),
 		responseViewport: ilovetui.NewViewport(),
 		textarea:         ta,
+		filterInput:      ti,
 		pager:            ilovetui.NewPaginator(),
 		help:             ilovetui.NewHelp(),
 	}
@@ -75,7 +87,7 @@ func New() Model {
 
 func (m Model) Init() tea.Cmd { return nil }
 
-func (m Model) IsEditing() bool { return m.editing }
+func (m Model) IsEditing() bool { return m.editing || (m.filterActive && !m.filterAccepted) }
 
 func (m Model) IsResponseFocused() bool {
 	return m.focusedPanel == panelResponse
@@ -111,8 +123,9 @@ func (m *Model) SetDB(d *db.DB) {
 		return
 	}
 	for _, dbe := range entries {
-		m.entries = append(m.entries, entryFromDB(dbe))
+		m.allEntries = append(m.allEntries, entryFromDB(dbe))
 	}
+	m.entries = m.allEntries
 	m.pager.SetTotalPages(len(m.entries))
 	if len(m.entries) > 0 {
 		m.cursor = len(m.entries) - 1
@@ -136,6 +149,7 @@ func entryFromDB(dbe db.ReplayEntry) Entry {
 		RequestRaw:  dbe.RequestRaw,
 		ResponseRaw: dbe.ResponseRaw,
 		StatusCode:  dbe.StatusCode,
+		Flagged:     dbe.Flagged,
 		Err:         err,
 	}
 }
@@ -148,6 +162,7 @@ func (m *Model) SetSize(w, h int) {
 
 func (m *Model) recalcSizes() {
 	m.help.SetWidth(m.width - 2)
+	m.filterInput.SetWidth(m.width - 4)
 
 	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
@@ -194,12 +209,77 @@ func (m *Model) bodyHalfWidths() (left, right int) {
 	return
 }
 
+func (m *Model) currentAllIdx() int {
+	if m.entryIndices != nil && m.cursor < len(m.entryIndices) {
+		return m.entryIndices[m.cursor]
+	}
+	if m.cursor < len(m.allEntries) {
+		return m.cursor
+	}
+	return -1
+}
+
+func matchesFilter(e Entry, term string) bool {
+	return strings.Contains(strings.ToLower(e.Host), term) ||
+		strings.Contains(strings.ToLower(e.Path), term) ||
+		strings.Contains(strings.ToLower(strings.TrimSpace(e.Method)), term)
+}
+
+func (m *Model) applyFilter(preferAllIdx int) {
+	term := strings.ToLower(m.filterInput.Value())
+	if !m.filterActive || term == "" {
+		m.entries = m.allEntries
+		m.entryIndices = nil
+		if preferAllIdx >= 0 && preferAllIdx < len(m.allEntries) {
+			m.cursor = preferAllIdx
+		}
+	} else {
+		m.entries = nil
+		m.entryIndices = nil
+		newCursor := 0
+		found := false
+		for i, e := range m.allEntries {
+			if matchesFilter(e, term) {
+				if i == preferAllIdx && !found {
+					newCursor = len(m.entries)
+					found = true
+				}
+				m.entries = append(m.entries, e)
+				m.entryIndices = append(m.entryIndices, i)
+			}
+		}
+		if found {
+			m.cursor = newCursor
+		} else {
+			m.cursor = 0
+		}
+	}
+	if len(m.entries) == 0 {
+		m.cursor = 0
+	} else if m.cursor >= len(m.entries) {
+		m.cursor = len(m.entries) - 1
+	}
+	m.pager.SetTotalPages(len(m.entries))
+	m.refreshListViewport()
+	m.refreshBody()
+}
+
+func (m *Model) clearFilter() {
+	prevAllIdx := m.currentAllIdx()
+	m.filterActive = false
+	m.filterAccepted = false
+	m.filterInput.SetValue("")
+	m.filterInput.Blur()
+	m.recalcSizes()
+	m.applyFilter(prevAllIdx)
+}
+
 type replayKeyMap struct{ width int }
 
 func (replayKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
-	return []key.Binding{g.Up, g.Down, g.CycleFocus, r.Send, r.Edit, g.Help}
+	return []key.Binding{g.Up, g.Down, g.CycleFocus, r.Send, r.Edit, r.Flag, r.Filter, g.Help}
 }
 
 func (m replayKeyMap) FullHelp() [][]key.Binding {

internal/ui/replay/update.go

@@ -5,9 +5,14 @@ import (
 	"compress/gzip"
 	"compress/zlib"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -62,15 +67,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				entry.DBID = id
 			}
 		}
-		m.entries = append(m.entries, entry)
-		m.cursor = len(m.entries) - 1
-		m.pager.SetTotalPages(len(m.entries))
-		m.refreshListViewport()
-		m.refreshBody()
+		m.allEntries = append(m.allEntries, entry)
+		m.applyFilter(len(m.allEntries) - 1)
 
 	case sentMsg:
-		if msg.index >= 0 && msg.index < len(m.entries) {
-			e := &m.entries[msg.index]
+		allIdx := msg.index
+		if allIdx >= 0 && allIdx < len(m.allEntries) {
+			e := m.allEntries[allIdx]
 			e.Sending = false
 			e.StatusCode = msg.statusCode
 			e.ResponseRaw = msg.responseRaw
@@ -79,11 +82,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				e.ResponseRaw = "Error: " + msg.err.Error()
 			}
 			if m.database != nil && e.DBID != 0 {
-				m.database.UpdateReplayEntry(entryToDB(*e))
+				if err := m.database.UpdateReplayEntry(entryToDB(e)); err != nil {
+					log.Printf("replay: update entry: %v", err)
+				}
 			}
+			m.allEntries[allIdx] = e
 		}
-		m.refreshListViewport()
-		m.refreshBody()
+		prevAllIdx := m.currentAllIdx()
+		m.applyFilter(prevAllIdx)
 
 	case util.EditorFinishedMsg:
 		if msg.Err == nil && msg.Content != "" && len(m.entries) > 0 {
@@ -96,24 +102,20 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			switch msg.Button {
 			case tea.MouseWheelUp:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollLeft(6)
-					m.responseViewport.ScrollLeft(6)
+					m.scrollBothViewports(true)
 				} else {
 					m.scrollFocusedViewportVertical(-1)
 				}
 			case tea.MouseWheelDown:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollRight(6)
-					m.responseViewport.ScrollRight(6)
+					m.scrollBothViewports(false)
 				} else {
 					m.scrollFocusedViewportVertical(1)
 				}
 			case tea.MouseWheelLeft:
-				m.requestViewport.ScrollLeft(6)
-				m.responseViewport.ScrollLeft(6)
+				m.scrollBothViewports(true)
 			case tea.MouseWheelRight:
-				m.requestViewport.ScrollRight(6)
-				m.responseViewport.ScrollRight(6)
+				m.scrollBothViewports(false)
 			}
 		}
 
@@ -130,6 +132,32 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
+
+	if m.filterActive && !m.filterAccepted {
+		switch {
+		case key.Matches(msg, g.Escape):
+			m.clearFilter()
+		case msg.String() == "enter":
+			m.filterAccepted = true
+			m.filterInput.Blur()
+			m.recalcSizes()
+		default:
+			var cmd tea.Cmd
+			m.filterInput, cmd = m.filterInput.Update(msg)
+			prevAllIdx := m.currentAllIdx()
+			m.applyFilter(prevAllIdx)
+			return m, cmd
+		}
+		return m, nil
+	}
+
+	if m.filterActive && m.filterAccepted {
+		if key.Matches(msg, g.Escape) {
+			m.clearFilter()
+			return m, nil
+		}
+	}
+
 	switch {
 	case key.Matches(msg, g.Up):
 		if m.focusedPanel == panelList {
@@ -165,12 +193,13 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 
 	case key.Matches(msg, r.Send):
 		if len(m.entries) > 0 && !m.entries[m.cursor].Sending {
-			m.entries[m.cursor].Sending = true
-			m.entries[m.cursor].ResponseRaw = ""
-			m.entries[m.cursor].Err = nil
-			m.refreshListViewport()
-			m.refreshBody()
-			return m, sendCmd(m.entries[m.cursor], m.cursor)
+			allIdx := m.currentAllIdx()
+			m.allEntries[allIdx].Sending = true
+			m.allEntries[allIdx].ResponseRaw = ""
+			m.allEntries[allIdx].Err = nil
+			entry := m.allEntries[allIdx]
+			m.applyFilter(allIdx)
+			return m, sendCmd(entry, allIdx)
 		}
 
 	case key.Matches(msg, r.Edit):
@@ -212,30 +241,67 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.requestViewport.ScrollRight(6)
 		m.responseViewport.ScrollRight(6)
 
+	case key.Matches(msg, r.Flag):
+		if len(m.entries) > 0 {
+			allIdx := m.currentAllIdx()
+			if m.database != nil && m.allEntries[allIdx].DBID != 0 {
+				if err := m.database.ToggleReplayFlag(m.allEntries[allIdx].DBID); err != nil {
+					log.Printf("replay: toggle flag: %v", err)
+				}
+			}
+			m.allEntries[allIdx].Flagged = !m.allEntries[allIdx].Flagged
+			m.applyFilter(allIdx)
+		}
+
 	case key.Matches(msg, r.Delete):
 		if len(m.entries) > 0 {
-			e := m.entries[m.cursor]
+			allIdx := m.currentAllIdx()
+			e := m.allEntries[allIdx]
 			if m.database != nil && e.DBID != 0 {
-				m.database.DeleteReplayEntry(e.DBID)
+				if err := m.database.DeleteReplayEntry(e.DBID); err != nil {
+					log.Printf("replay: delete entry: %v", err)
+				}
 			}
-			m.entries = append(m.entries[:m.cursor], m.entries[m.cursor+1:]...)
-			if m.cursor >= len(m.entries) && m.cursor > 0 {
-				m.cursor--
+			m.allEntries = append(m.allEntries[:allIdx], m.allEntries[allIdx+1:]...)
+			preferAllIdx := allIdx
+			if preferAllIdx >= len(m.allEntries) {
+				preferAllIdx = len(m.allEntries) - 1
 			}
-			m.pager.SetTotalPages(len(m.entries))
-			m.refreshListViewport()
-			m.refreshBody()
+			m.applyFilter(preferAllIdx)
 		}
 
 	case key.Matches(msg, r.DeleteAll):
 		if m.database != nil {
-			m.database.DeleteAllReplayEntries()
+			if err := m.database.DeleteAllReplayEntriesExceptFlagged(); err != nil {
+				log.Printf("replay: delete all entries: %v", err)
+			}
+		}
+		// Mirror the DB logic in memory: delete unflagged first; if none, delete all.
+		hasUnflagged := false
+		for _, e := range m.allEntries {
+			if !e.Flagged {
+				hasUnflagged = true
+				break
+			}
+		}
+		if hasUnflagged {
+			filtered := m.allEntries[:0]
+			for _, e := range m.allEntries {
+				if e.Flagged {
+					filtered = append(filtered, e)
+				}
+			}
+			m.allEntries = filtered
+		} else {
+			m.allEntries = nil
 		}
-		m.entries = nil
 		m.cursor = 0
-		m.pager.SetTotalPages(0)
-		m.refreshListViewport()
-		m.refreshBody()
+		m.filterActive = false
+		m.filterAccepted = false
+		m.filterInput.SetValue("")
+		m.filterInput.Blur()
+		m.recalcSizes()
+		m.applyFilter(-1)
 
 	case key.Matches(msg, keys.Keys.Global.GotoTop):
 		m.cursor = 0
@@ -276,6 +342,15 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 			}
 		}
 
+	case key.Matches(msg, r.Filter):
+		if m.focusedPanel == panelList {
+			m.filterActive = true
+			m.filterAccepted = false
+			m.filterInput.Placeholder = "filter requests..."
+			m.filterInput.Focus()
+			m.recalcSizes()
+		}
+
 	case key.Matches(msg, g.Help):
 		m.help.ShowAll = !m.help.ShowAll
 		m.recalcSizes()
@@ -320,6 +395,16 @@ func (m *Model) setFocusedViewport(vp viewport.Model) {
 	}
 }
 
+func (m *Model) scrollBothViewports(left bool) {
+	if left {
+		m.requestViewport.ScrollLeft(6)
+		m.responseViewport.ScrollLeft(6)
+	} else {
+		m.requestViewport.ScrollRight(6)
+		m.responseViewport.ScrollRight(6)
+	}
+}
+
 func (m *Model) scrollFocusedViewportVertical(delta int) {
 	vp := m.focusedViewport()
 	vp.SetYOffset(vp.YOffset() + delta)
@@ -351,11 +436,11 @@ func (m *Model) refreshBody() {
 	m.requestViewport.SetXOffset(0)
 
 	if e.Sending {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("(ﾉ◕ヮ◕)ﾉ*:･ﾟ", "sending..."))))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(ﾉ◕ヮ◕)ﾉ*:･ﾟ", "sending..."))))
 	} else if e.ResponseRaw != "" {
 		m.responseViewport.SetContent(style.HighlightHTTP(e.ResponseRaw))
 	} else {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.CenterLines("( •_•)>⌐■", "press send to fire"))))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "( •_•)>⌐■", "press send to fire"))))
 	}
 	m.responseViewport.SetYOffset(0)
 	m.responseViewport.SetXOffset(0)
@@ -396,11 +481,27 @@ func doSend(entry Entry) (responseRaw string, statusCode int, err error) {
 	}
 	req.Header = headers
 
+	tlsCfg := &tls.Config{InsecureSkipVerify: config.Global.App.SslInsecure} // #nosec G402 -- controlled by ssl_insecure config
+	if !config.Global.App.SslInsecure {
+		if certPool, err := x509.SystemCertPool(); err == nil {
+			caPath := filepath.Join(config.ExpandPath(config.Global.App.CertDir), "mitmproxy-ca-cert.pem")
+			if pem, err := os.ReadFile(caPath); err == nil {
+				certPool.AppendCertsFromPEM(pem)
+			}
+			tlsCfg.RootCAs = certPool
+		}
+	}
+	transport := &http.Transport{
+		TLSClientConfig: tlsCfg,
+	}
+	if up := config.Global.App.UpstreamProxy; up != "" {
+		if proxyURL, err := url.Parse(up); err == nil {
+			transport.Proxy = http.ProxyURL(proxyURL)
+		}
+	}
 	client := &http.Client{
-		Timeout: 30 * time.Second,
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-		},
+		Timeout:   30 * time.Second,
+		Transport: transport,
 		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
@@ -480,6 +581,7 @@ func entryToDB(e Entry) db.ReplayEntry {
 		ResponseRaw: e.ResponseRaw,
 		StatusCode:  e.StatusCode,
 		ErrorMsg:    errMsg,
+		Flagged:     e.Flagged,
 	}
 }
 

internal/ui/replay/view.go

@@ -8,6 +8,7 @@ import (
 	"charm.land/lipgloss/v2"
 	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
 	"github.com/anotherhadi/spilltea/internal/util"
 )
@@ -73,7 +74,18 @@ func (m *Model) renderResponsePanel(w, h int) string {
 }
 
 func (m *Model) renderStatusBar() string {
-	return lipgloss.NewStyle().Padding(0, 1).Render(m.help.View(replayKeyMap{width: m.width}))
+	pad := lipgloss.NewStyle().Padding(0, 1)
+	if m.filterActive {
+		filterKey := keys.Keys.Replay.Filter.Help().Key
+		escKey := keys.Keys.Global.Escape.Help().Key
+		if m.filterAccepted {
+			accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+			filterLine := pad.Render(accent.Render(filterKey) + " " + ilovetui.S.Bold.Render(m.filterInput.Value()) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
+			return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(replayKeyMap{width: m.width})))
+		}
+		return pad.Render(ilovetui.S.Faint.Render(filterKey) + " " + m.filterInput.View())
+	}
+	return pad.Render(m.help.View(replayKeyMap{width: m.width}))
 }
 
 func (m *Model) renderList() string {
@@ -81,7 +93,7 @@ func (m *Model) renderList() string {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			ilovetui.S.Faint.Render(util.CenterLines("(╥﹏╥)", "send a request from History or Intercept")),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(╥﹏╥)", "send a request from History or Intercept")),
 		)
 	}
 
@@ -94,19 +106,25 @@ func (m *Model) renderList() string {
 		selBg := ilovetui.S.Selection
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 7 + 1 + 3 + 1
+		const fixedW = 2 + 2 + 7 + 1 + 3 + 1
 		hostPathW := w - fixedW
 		if hostPathW < 0 {
 			hostPathW = 0
 		}
 
 		statusStr, statusSt := entryStatus(e)
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
 				style.S.Method(e.Method).Background(selBg).Render(e.Method),
 				bg.Width(1).Render(""),
 				statusSt.Background(selBg).Render(statusStr),
@@ -114,8 +132,13 @@ func (m *Model) renderList() string {
 				bg.Bold(true).Width(hostPathW).Render(e.Host+e.Path),
 			)
 		} else {
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
+				flagSt.Width(2).Render(flagStr),
 				style.S.Method(e.Method).Render(e.Method),
 				" ",
 				statusSt.Render(statusStr),

internal/util/editor.go

@@ -15,7 +15,7 @@ type EditorFinishedMsg struct {
 	Err     error
 }
 
-func resolveEditor() string {
+func ResolveEditor() string {
 	editor := config.Global.App.ExternalEditor
 	if editor == "" {
 		editor = os.Getenv("EDITOR")
@@ -29,14 +29,17 @@ func resolveEditor() string {
 func openWithEditor(content string, callback func(string, error) tea.Msg) tea.Cmd {
 	f, err := os.CreateTemp("", "spilltea-*.http")
 	if err != nil {
+		log.Printf("editor: create temp file: %v", err)
 		return nil
 	}
 	tmpPath := f.Name()
 	if _, err := f.WriteString(content); err != nil {
 		log.Printf("editor: writing temp file: %v", err)
 	}
-	f.Close()
-	return tea.ExecProcess(exec.Command(resolveEditor(), tmpPath), func(err error) tea.Msg {
+	if err := f.Close(); err != nil {
+		log.Printf("editor: closing temp file: %v", err)
+	}
+	return tea.ExecProcess(exec.Command(ResolveEditor(), tmpPath), func(err error) tea.Msg { // #nosec G204 -- editor from trusted config/$EDITOR, tmpPath from os.CreateTemp
 		defer os.Remove(tmpPath)
 		return callback(tmpPath, err)
 	})
@@ -47,7 +50,7 @@ func OpenExternalEditor(content string) tea.Cmd {
 		if err != nil {
 			return EditorFinishedMsg{Err: err}
 		}
-		data, readErr := os.ReadFile(tmpPath)
+		data, readErr := os.ReadFile(tmpPath) // #nosec G304 -- tmpPath is from os.CreateTemp, controlled by this process
 		if readErr != nil {
 			return EditorFinishedMsg{Err: readErr}
 		}

internal/util/util.go

@@ -14,6 +14,14 @@ func Truncate(s string, max int) string {
 	return s[:max-1] + "…"
 }
 
+// EmptyState renders centered placeholder lines, word-wrapping to fit maxW.
+func EmptyState(maxW int, lines ...string) string {
+	return lipgloss.NewStyle().
+		Width(maxW).
+		AlignHorizontal(lipgloss.Center).
+		Render(strings.Join(lines, "\n"))
+}
+
 // CenterLines centers each line horizontally relative to the longest one.
 func CenterLines(lines ...string) string {
 	maxWidth := 0

nix/browser.nix

@@ -0,0 +1,61 @@
+{pkgs}: let
+  defaultCertDir = "$HOME/.local/share/spilltea";
+  defaultHost = "127.0.0.1";
+  defaultPort = "8080";
+in
+  pkgs.writeShellApplication {
+    name = "spilltea-browser";
+    runtimeInputs = with pkgs; [nss.tools librewolf netcat-gnu procps];
+    text = ''
+      CERT_DIR="${defaultCertDir}"
+      HOST="${defaultHost}"
+      PORT="${defaultPort}"
+
+      while [[ $# -gt 0 ]]; do
+        case "$1" in
+          --cert-dir) CERT_DIR="$2"; shift 2 ;;
+          --host)     HOST="$2";     shift 2 ;;
+          --port)     PORT="$2";     shift 2 ;;
+          *) echo "Unknown argument: $1"; exit 1 ;;
+        esac
+      done
+
+      CERT_FILE="$CERT_DIR/mitmproxy-ca-cert.pem"
+
+      if [[ ! -f "$CERT_FILE" ]]; then
+        echo "Certificate not found at $CERT_FILE"
+        echo "Launch spilltea first, or use --cert-dir if you changed cert_dir in your config."
+        exit 1
+      fi
+
+      if ! pgrep -x spilltea > /dev/null 2>&1; then
+        echo "spilltea is not running. Launch spilltea first."
+        exit 1
+      fi
+
+      if ! nc -z "$HOST" "$PORT" > /dev/null 2>&1; then
+        echo "Nothing is listening on $HOST:$PORT."
+        echo "Is spilltea configured on that port? Use --host and --port if you changed them in your config."
+        exit 1
+      fi
+
+      PROFILE=$(mktemp -d)
+      trap 'rm -rf "$PROFILE"' EXIT
+
+      certutil -N -d sql:"$PROFILE" --empty-password
+      certutil -d sql:"$PROFILE" -A -n "spilltea" -t "CT,," -i "$CERT_FILE"
+
+      cat > "$PROFILE/user.js" <<EOF
+      user_pref("network.proxy.type", 1);
+      user_pref("network.proxy.http", "$HOST");
+      user_pref("network.proxy.http_port", $PORT);
+      user_pref("network.proxy.ssl", "$HOST");
+      user_pref("network.proxy.ssl_port", $PORT);
+      user_pref("network.proxy.no_proxies_on", "");
+      user_pref("network.stricttransportsecurity.preloadlist", false);
+      user_pref("dom.security.https_only_mode", false);
+      EOF
+
+      librewolf --profile "$PROFILE" --no-remote
+    '';
+  }

nix/gomod2nix.toml

@@ -105,6 +105,10 @@ schema = 3
     version = 'v1.5.0'
     hash = 'sha256-EYVgkSEMo4HaVrsWKqnsYRp8SSS8gNf7t+Elva02Ofc='
 
+  [mod.'github.com/inconshreveable/mousetrap']
+    version = 'v1.1.0'
+    hash = 'sha256-XWlYH0c8IcxAwQTnIi6WYqq44nOKUylSWxWO/vi+8pE='
+
   [mod.'github.com/klauspost/compress']
     version = 'v1.17.8'
     hash = 'sha256-8rgCCfHX29le8m6fyVn6gwFde5TPUHjwQqZqv9JIubs='
@@ -173,6 +177,10 @@ schema = 3
     version = 'v1.10.0'
     hash = 'sha256-dQ6Qqf26IZsa6XsGKP7GDuCj+WmSsBmkBwGTDfue/rk='
 
+  [mod.'github.com/spf13/cobra']
+    version = 'v1.10.2'
+    hash = 'sha256-nbRCTFiDCC2jKK7AHi79n7urYCMP5yDZnWtNVJrDi+k='
+
   [mod.'github.com/spf13/pflag']
     version = 'v1.0.10'
     hash = 'sha256-uDPnWjHpSrzXr17KEYEA1yAbizfcsfo5AyztY2tS6ZU='
@@ -210,16 +218,16 @@ schema = 3
     hash = 'sha256-NkGFiDPoCxbr3LFsI6OCygjjkY0rdmg5ggvVVwpyDQ4='
 
   [mod.'golang.org/x/net']
-    version = 'v0.54.0'
-    hash = 'sha256-/EoIXzTQzK/yP/lxOyx0Z/bhns4FdPTIF4uyt4gIP80='
+    version = 'v0.55.0'
+    hash = 'sha256-Phi2mSmBGOJcvqPPAit3uqF3UP8SKRI9dHj6yTM3s5s='
 
   [mod.'golang.org/x/sync']
     version = 'v0.20.0'
     hash = 'sha256-ybcjhCfK6lroUM0yswUvWooW8MOQZBXyiSqoxG6Uy0Y='
 
   [mod.'golang.org/x/sys']
-    version = 'v0.44.0'
-    hash = 'sha256-JDlj+PKsG6I6kjv5JyOUNreY51u5An0oZ5OZMHZSk+A='
+    version = 'v0.45.0'
+    hash = 'sha256-hkBoNazrDA67ER6sWhb+EKxx9nJ24+nz3zGy+zT5Hvw='
 
   [mod.'golang.org/x/text']
     version = 'v0.37.0'

nix/package.nix

@@ -2,13 +2,22 @@
   pkgs,
   buildGoApplication,
 }: let
+  browser = import ./browser.nix {inherit pkgs;};
   pname = "spilltea";
-  version = "0.0.6";
+  version = "0.0.8";
   ldflags = ["-s" "-w" "-X main.version=${version}"];
   pkg = buildGoApplication {
     inherit pname version ldflags;
     src = ../.;
     modules = ./gomod2nix.toml;
+    nativeBuildInputs = [pkgs.installShellFiles];
+    env.GOTOOLCHAIN = "local";
+    postInstall = ''
+      installShellCompletion --cmd spilltea \
+        --bash <($out/bin/spilltea completion bash) \
+        --zsh <($out/bin/spilltea completion zsh) \
+        --fish <($out/bin/spilltea completion fish)
+    '';
     meta = with pkgs.lib; {
       description = "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.";
       homepage = "https://github.com/anotherhadi/spilltea";
@@ -18,4 +27,5 @@
 in {
   "${pname}" = pkg;
   default = pkg;
+  browser = browser;
 }

nix/shell.nix

@@ -52,6 +52,8 @@ in
     packages = with pkgs;
       [
         go
+        gosec
+        govulncheck
         python3
         doctoc
         stylua

spilltea.go

@@ -17,7 +17,7 @@ var PluginsFS embed.FS
 // InstallDefaultPlugins copies embedded default plugins into dir, skipping
 // files that already exist. Returns the number of files written.
 func InstallDefaultPlugins(dir string) (int, error) {
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return 0, fmt.Errorf("create plugins dir: %w", err)
 	}
 
@@ -39,7 +39,7 @@ func InstallDefaultPlugins(dir string) (int, error) {
 		if err != nil {
 			return written, fmt.Errorf("read embedded %s: %w", e.Name(), err)
 		}
-		if err := os.WriteFile(dst, data, 0o644); err != nil {
+		if err := os.WriteFile(dst, data, 0o600); err != nil {
 			return written, fmt.Errorf("write %s: %w", dst, err)
 		}
 		written++