v0.0.8

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>

.envrc

@@ -0,0 +1 @@
+use flake

.github/scripts/check-vendor-hash.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-CURRENT_HASH=$(grep -oP '(?<=vendorHash = ")[^"]+' flake.nix)
-
-go mod vendor
-
-COMPUTED_HASH=$(nix hash path vendor/)
-
-rm -rf vendor/
-
-if [ "$CURRENT_HASH" = "$COMPUTED_HASH" ]; then
-  echo "vendorHash is up to date"
-  exit 0
-fi
-
-echo "Updating vendorHash in flake.nix..."
-python3 -c "
-import sys
-with open('flake.nix', 'r') as f:
-    content = f.read()
-content = content.replace('$CURRENT_HASH', '$COMPUTED_HASH')
-with open('flake.nix', 'w') as f:
-    f.write(content)
-"
-echo "  Old: $CURRENT_HASH"
-echo "  New: $COMPUTED_HASH"

.github/workflows/release.yml

@@ -23,6 +23,6 @@ jobs:
       - uses: goreleaser/goreleaser-action@v6
         with:
           version: "~> v2"
-          args: release --clean
+          args: release --clean --config .github/.goreleaser.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,3 +1,4 @@
 .claude/
 CLAUDE.md
 result/
+.pre-commit-config.yaml

README.md

@@ -9,10 +9,10 @@
 > A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.  
 > Think Burp Suite or Caido, but entirely in your terminal.
 
-[![Go Version](https://img.shields.io/github/go-mod/go-version/anotherhadi/spilltea)](go.mod)
-[![Release](https://img.shields.io/github/v/release/anotherhadi/spilltea)](https://github.com/anotherhadi/spilltea/releases)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Go Report Card](https://goreportcard.com/badge/github.com/anotherhadi/spilltea)](https://goreportcard.com/report/github.com/anotherhadi/spilltea)
+![GitHub Stars](https://www.shieldcn.dev/github/stars/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+![Release](https://www.shieldcn.dev/github/release/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+![CI](https://www.shieldcn.dev/github/ci/anotherhadi/spilltea.svg?variant=outline&theme=violet)
+[![Ko-fi](https://www.shieldcn.dev/badge/Ko--fi-sponsor-FF5E5B.svg?logo=kofi&variant=secondary&theme=violet)](https://ko-fi.com/anotherhadi)
 
 <!-- START doctoc generated TOC please keep comment here to allow auto update -->
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
@@ -23,8 +23,10 @@
 - [Installation](#installation)
 - [Project Management](#project-management)
 - [Configuration](#configuration)
+  - [Per-project configuration](#per-project-configuration)
 - [CLI Flags](#cli-flags)
 - [Plugin System](#plugin-system)
+- [Vim / Neovim Integration](#vim--neovim-integration)
 - [Deployment](#deployment)
 - [Tech Stack](#tech-stack)
 
@@ -106,29 +108,49 @@ Spilltea organizes work into **projects**. Each project maps to a SQLite databas
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
 Spilltea is fully configured via a YAML file at `~/.config/spilltea/config.yaml`.
 Check the default configuration with all the options [here](./internal/config/default_config.yaml)
 
+Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
+
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
 <!-- endexec -->
 
@@ -137,6 +159,15 @@ Usage: spilltea [flags]
 Spilltea supports plugins written in **Lua**. Plugins are loaded from `~/.config/spilltea/plugins/` by default and do not require recompilation or access to the source code.
 For a full reference and examples, see the [plugin documentation](./docs/plugins.md) or [plugin examples](./plugins/).
 
+## Vim / Neovim Integration
+
+Spilltea pairs naturally with Neovim. If you live in your editor, these plugins let you inspect and transform captured traffic without switching context:
+
+- **[sttr.nvim](https://github.com/anotherhadi/sttr.nvim)**: Run string transformations (base64, URL encode/decode, hex, hashing, and more) on any selected text directly from Neovim. Handy for decoding values spotted in the proxy history.
+- **[jwt-tui.nvim](https://github.com/anotherhadi/jwt-tui.nvim)**: Decode and inspect JWT tokens in a floating TUI window. Great for quickly reading tokens intercepted through the proxy.
+
+Both plugins are built to feel native in a terminal workflow, just like Spilltea.
+
 ## Deployment
 
 spilltea runs **locally** on the machine used for pentesting or CTF. There is no separate server component.

cmd/spilltea/main.go

@@ -2,9 +2,9 @@ package main
 
 import (
 	"fmt"
-	"net"
 	"os"
 	"path/filepath"
+	"runtime/debug"
 
 	tea "charm.land/bubbletea/v2"
 	spilltea "github.com/anotherhadi/spilltea"
@@ -15,142 +15,167 @@ import (
 	"github.com/anotherhadi/spilltea/internal/style"
 	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
 	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
-	flag "github.com/spf13/pflag"
+	"github.com/spf13/cobra"
 )
 
 // Version is overwritten at build time by goreleaser/ldflag with the current version tag, or "dev" if not set.
 var version = "dev"
 
+func init() {
+	if version != "dev" {
+		return
+	}
+	if info, ok := debug.ReadBuildInfo(); ok && info.Main.Version != "" && info.Main.Version != "(devel)" {
+		version = info.Main.Version
+	}
+}
+
 func main() {
 	var (
-		flagConfig            = flag.StringP("config", "c", "", "path to config file")
-		flagPluginsDir        = flag.String("plugins-dir", "", "path to plugins dir (overrides config)")
-		flagHost              = flag.String("host", "", "proxy host (overrides config)")
-		flagPort              = flag.IntP("port", "p", 0, "proxy port (overrides config)")
-		flagUpstreamProxy     = flag.String("upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
-		flagVersion           = flag.BoolP("version", "v", false, "print version")
-		flagProject           = flag.StringP("project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
-		flagAddDefaultPlugins = flag.Bool("add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
-		flagAddDefaultConfig  = flag.Bool("add-default-config", false, "copy the default config file to the config path and exit")
+		flagConfig            string
+		flagPluginsDir        string
+		flagHost              string
+		flagPort              int
+		flagUpstreamProxy     string
+		flagProject           string
+		flagSslInsecure       bool
+		flagAddDefaultPlugins bool
+		flagAddDefaultConfig  bool
 	)
-	flag.CommandLine.SetOutput(os.Stdout)
-	flag.Usage = func() {
-		fmt.Println("Usage: spilltea [flags]\n")
-		flag.PrintDefaults()
-	}
-	flag.Parse()
 
-	if *flagVersion {
-		fmt.Println(version)
-		os.Exit(0)
-	}
-
-	if *flagAddDefaultPlugins {
-		cfgPath := filepath.Join(os.Getenv("HOME"), ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
+	rootCmd := &cobra.Command{
+		Use:           "spilltea",
+		Short:         "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.",
+		Version:       version,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if flagAddDefaultPlugins {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
 				}
 				if err := config.Load(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "config: %v\n", err)
-			os.Exit(1)
+					return fmt.Errorf("config: %w", err)
 				}
 				dir := config.ExpandPath(config.Global.App.PluginsDir)
-		if *flagPluginsDir != "" {
-			dir = *flagPluginsDir
+				if flagPluginsDir != "" {
+					dir = flagPluginsDir
 				}
 				n, err := spilltea.InstallDefaultPlugins(dir)
 				if err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-plugins: %v\n", err)
-			os.Exit(1)
+					return fmt.Errorf("add-default-plugins: %w", err)
 				}
 				fmt.Printf("added %d plugin(s) to %s\n", n, dir)
-		os.Exit(0)
+				return nil
 			}
 
-	if *flagAddDefaultConfig {
-		cfgPath := filepath.Join(os.Getenv("HOME"), ".config", "spilltea", "config.yaml")
-		if *flagConfig != "" {
-			cfgPath = *flagConfig
+			if flagAddDefaultConfig {
+				home, _ := os.UserHomeDir()
+				cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+				if flagConfig != "" {
+					cfgPath = flagConfig
 				}
 				if err := config.WriteDefaultConfig(cfgPath); err != nil {
-			fmt.Fprintf(os.Stderr, "add-default-config: %v\n", err)
-			os.Exit(1)
+					return fmt.Errorf("add-default-config: %w", err)
 				}
 				fmt.Printf("default config written to %s\n", cfgPath)
-		os.Exit(0)
+				return nil
 			}
 
-	if *flagProject != "" && !homeUI.IsValidProjectName(*flagProject) {
-		fmt.Fprintf(os.Stderr, "project: invalid name %q (only lowercase letters, digits, - and _ are allowed)\n", *flagProject)
-		os.Exit(1)
+			if flagProject != "" && !homeUI.IsValidProjectName(flagProject) {
+				return fmt.Errorf("project: invalid name %q (only lowercase letters, digits, - and _ are allowed)", flagProject)
 			}
 
-	cfgPath := filepath.Join(os.Getenv("HOME"), ".config", "spilltea", "config.yaml")
-	if *flagConfig != "" {
-		cfgPath = *flagConfig
+			home, _ := os.UserHomeDir()
+			cfgPath := filepath.Join(home, ".config", "spilltea", "config.yaml")
+			if flagConfig != "" {
+				cfgPath = flagConfig
 			}
 
 			if err := config.Load(cfgPath); err != nil {
-		fmt.Fprintf(os.Stderr, "config: %v\n", err)
-		os.Exit(1)
+				return fmt.Errorf("config: %w", err)
 			}
 			config.Global.Version = version
 
-	if *flagPluginsDir != "" {
-		config.Global.App.PluginsDir = *flagPluginsDir
+			sslInsecureChanged := cmd.Flags().Changed("ssl-insecure")
+			applyCLI := func(c *config.Config) {
+				if flagPluginsDir != "" {
+					c.App.PluginsDir = flagPluginsDir
 				}
-	if *flagHost != "" {
-		config.Global.App.Host = *flagHost
+				if flagHost != "" {
+					c.App.Host = flagHost
 				}
-	if *flagPort != 0 {
-		config.Global.App.Port = *flagPort
+				if flagPort != 0 {
+					c.App.Port = flagPort
 				}
-	if *flagUpstreamProxy != "" {
-		config.Global.App.UpstreamProxy = *flagUpstreamProxy
+				if flagUpstreamProxy != "" {
+					c.App.UpstreamProxy = flagUpstreamProxy
 				}
+				if sslInsecureChanged {
+					c.App.SslInsecure = flagSslInsecure
+				}
+			}
+			applyCLI(config.Global)
+			config.SetCLIOverrides(applyCLI)
 
-	addr := fmt.Sprintf("%s:%d", config.Global.App.Host, config.Global.App.Port)
-	// Check if the proxy port is available before starting the UI.
-	ln, err := net.Listen("tcp", addr)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "proxy: cannot bind to %s: %v\n", addr, err)
-		os.Exit(1)
-	}
-	ln.Close()
-
-	style.Init(config.Global)
+			style.Init()
 			icons.Init(config.Global)
 			keys.Init(config.Global)
 
 			projectDir := config.ExpandPath(config.Global.App.ProjectDir)
 
-	// Resolve project: either from --project flag or by running the home UI.
-	var project *homeUI.Project
-	if *flagProject != "" {
-		p, err := homeUI.OpenProject(projectDir, *flagProject)
+			if flagProject != "" {
+				project, err := homeUI.OpenProject(projectDir, flagProject)
 				if err != nil {
-			fmt.Fprintf(os.Stderr, "project: %v\n", err)
-			os.Exit(1)
+					return fmt.Errorf("project: %w", err)
 				}
-		project = p
-	} else {
-		finalModel, err := tea.NewProgram(homeUI.New(projectDir)).Run()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "tui: %v\n", err)
-			os.Exit(1)
+				if err := config.MergeProjectConfig(filepath.Dir(project.Path)); err != nil {
+					return fmt.Errorf("project config: %w", err)
 				}
-		project = finalModel.(homeUI.Model).Selected()
-	}
-
-	// User quit the home screen without selecting a project.
-	if project == nil {
-		return
-	}
-
+				icons.Init(config.Global)
+				keys.Init(config.Global)
 				broker := intercept.NewBroker()
 				m := appUI.New(broker, project.Name, project.Path)
-	if _, err := tea.NewProgram(m).Run(); err != nil {
-		fmt.Fprintf(os.Stderr, "tui: %v\n", err)
+				final, err := tea.NewProgram(m).Run()
+				if err != nil {
+					return fmt.Errorf("tui: %w", err)
+				}
+				if app, ok := final.(appUI.Model); ok {
+					if ferr := app.FatalErr(); ferr != nil {
+						return ferr
+					}
+				}
+				return nil
+			}
+
+			root := rootModel{home: homeUI.New(projectDir)}
+			final, err := tea.NewProgram(root).Run()
+			if err != nil {
+				return fmt.Errorf("tui: %w", err)
+			}
+			if r, ok := final.(rootModel); ok {
+				if ferr := r.FatalErr(); ferr != nil {
+					return ferr
+				}
+			}
+			return nil
+		},
+	}
+
+	rootCmd.Flags().StringVarP(&flagConfig, "config", "c", "", "path to config file")
+	rootCmd.Flags().StringVar(&flagPluginsDir, "plugins-dir", "", "path to plugins dir (overrides config)")
+	rootCmd.Flags().StringVar(&flagHost, "host", "", "proxy host (overrides config)")
+	rootCmd.Flags().IntVarP(&flagPort, "port", "p", 0, "proxy port (overrides config)")
+	rootCmd.Flags().StringVar(&flagUpstreamProxy, "upstream-proxy", "", "upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)")
+	rootCmd.Flags().BoolVar(&flagSslInsecure, "ssl-insecure", false, "skip TLS certificate verification (overrides config)")
+	rootCmd.Flags().StringVarP(&flagProject, "project", "P", "", `project name to open directly, or "tmp" for a temporary session`)
+	rootCmd.Flags().BoolVar(&flagAddDefaultPlugins, "add-default-plugins", false, "copy built-in example plugins into the plugins dir and exit")
+	rootCmd.Flags().BoolVar(&flagAddDefaultConfig, "add-default-config", false, "copy the default config file to the config path and exit")
+
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }

cmd/spilltea/root.go

@@ -0,0 +1,80 @@
+package main
+
+import (
+	"log"
+	"path/filepath"
+
+	tea "charm.land/bubbletea/v2"
+	"github.com/anotherhadi/spilltea/internal/config"
+	"github.com/anotherhadi/spilltea/internal/icons"
+	"github.com/anotherhadi/spilltea/internal/intercept"
+	"github.com/anotherhadi/spilltea/internal/keys"
+	appUI "github.com/anotherhadi/spilltea/internal/ui/app"
+	homeUI "github.com/anotherhadi/spilltea/internal/ui/home"
+)
+
+type rootState int
+
+const (
+	rootStateHome rootState = iota
+	rootStateApp
+)
+
+type rootModel struct {
+	state  rootState
+	home   homeUI.Model
+	app    tea.Model
+	width  int
+	height int
+}
+
+func (m rootModel) Init() tea.Cmd {
+	return m.home.Init()
+}
+
+func (m rootModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	if ws, ok := msg.(tea.WindowSizeMsg); ok {
+		m.width = ws.Width
+		m.height = ws.Height
+	}
+
+	if m.state == rootStateHome {
+		if sel, ok := msg.(homeUI.ProjectSelectedMsg); ok {
+			if err := config.MergeProjectConfig(filepath.Dir(sel.Project.Path)); err != nil {
+				log.Printf("project config: %v", err)
+			}
+			icons.Init(config.Global)
+			keys.Init(config.Global)
+			broker := intercept.NewBroker()
+			app := appUI.New(broker, sel.Project.Name, sel.Project.Path)
+			m.app = app
+			m.state = rootStateApp
+			return m, tea.Batch(app.Init(), func() tea.Msg {
+				return tea.WindowSizeMsg{Width: m.width, Height: m.height}
+			})
+		}
+		updated, cmd := m.home.Update(msg)
+		m.home = updated.(homeUI.Model)
+		return m, cmd
+	}
+
+	updated, cmd := m.app.Update(msg)
+	m.app = updated
+	return m, cmd
+}
+
+func (m rootModel) View() tea.View {
+	if m.state == rootStateApp {
+		return m.app.(interface{ View() tea.View }).View()
+	}
+	return m.home.View()
+}
+
+func (m rootModel) FatalErr() error {
+	if m.state == rootStateApp {
+		if app, ok := m.app.(appUI.Model); ok {
+			return app.FatalErr()
+		}
+	}
+	return nil
+}

docs.go

@@ -1,6 +0,0 @@
-package spilltea
-
-import "embed"
-
-//go:embed docs
-var DocsFS embed.FS

docs/basics.md

@@ -4,29 +4,49 @@ Spilltea organizes work into **projects**. Each project maps to a SQLite databas
 
 On startup, you choose:
 
-- **New project**: enter a name, stored in `~/.local/share/spilltea/projects/` by default
+- **New project**: enter a name, stored in `~/.local/share/spilltea/<name>/` by default
 - **Existing project**: pick from a list of previous projects
-- **Temporary**: no name needed, stored in `/tmp/spilltea/projects/` and will be deleted on your next reboot!
+- **Temporary**: no name needed, stored in `/tmp/spilltea/<random-id>/` and will be deleted on your next reboot!
 
 ## Configuration
 
 Spilltea is fully configured via a YAML file at `~/.config/spilltea/config.yaml`.
 Check the default configuration with all the options [here](./internal/config/default_config.yaml)
 
+Colors and styles can be customized using [ilovetui](https://github.com/anotherhadi/ilovetui), which applies theme changes across all compatible TUI applications at once.
+
+### Per-project configuration
+
+You can override any config value on a per-project basis by placing a `config.yaml` file inside the project directory (e.g. `~/.local/share/spilltea/projects/my-project/config.yaml`).
+
+Only the keys present in that file are overridden; everything else falls back to the global config.
+
+The priority order is:
+
+1. Global config (`~/.config/spilltea/config.yaml`)
+2. Project config (`<project-dir>/config.yaml`)
+3. CLI flags (always win)
+
 ## CLI Flags
 
 <!-- exec: echo '```' && go run ./cmd/spilltea -h && echo '```' -->
 ```
-Usage: spilltea [flags]
+A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.
 
+Usage:
+  spilltea [flags]
+
+Flags:
       --add-default-config      copy the default config file to the config path and exit
       --add-default-plugins     copy built-in example plugins into the plugins dir and exit
   -c, --config string           path to config file
+  -h, --help                    help for spilltea
       --host string             proxy host (overrides config)
       --plugins-dir string      path to plugins dir (overrides config)
   -p, --port int                proxy port (overrides config)
   -P, --project string          project name to open directly, or "tmp" for a temporary session
+      --ssl-insecure            skip TLS certificate verification (overrides config)
       --upstream-proxy string   upstream proxy URL, e.g. http://user:pass@host:8888 (overrides config)
-  -v, --version                 print version
+  -v, --version                 version for spilltea
 ```
 <!-- endexec -->

docs/certificate.md

@@ -5,7 +5,7 @@
    - On Chrome:
      - Open your Chrome settings, search for "Certificates" and click on "Security".
      - In the security settings page, scroll down and click on "Manage certificates".
-     - Select the "Authorities" tab and click on "Import tab and click on "Import".
+     - Select the "Authorities" tab and click on "Import".
      - Select the `mitmproxy-ca-cert.pem` file in `{{.Cfg.App.CertDir}}`.
    - On Firefox:
      - Open your Firefox settings, search for "Certificates" and click on "View Certificates".

docs/faq.md

@@ -0,0 +1,27 @@
+## How do I convert a temporary session into a regular project?
+
+Temporary sessions are stored under `/tmp/spilltea/<random-id>/` and will be lost on reboot. To keep the data, move the directory into the Spilltea projects folder and give it a name.
+
+**1. Find the temporary session directory**
+
+```bash
+ls /tmp/spilltea/
+```
+
+You will see one or more directories with a random hex name (e.g. `a1b2c3d4`).
+
+**2. Move it to the projects folder**
+
+```bash
+mv /tmp/spilltea/<random-id> ~/.local/share/spilltea/<project-name>
+```
+
+The project name must only contain lowercase letters, digits, `-`, and `_`.
+
+**3. Open the project**
+
+```bash
+spilltea -P my-project
+```
+
+Or simply launch Spilltea and pick `my-project` from the project list.

docs/history.md

@@ -4,9 +4,7 @@ The History page has a built-in search bar with two modes:
 
 **Fulltext search**: press `/` to open it. Results filter in real time as you type across all fields: method, host, path, and the raw request/response bodies.
 
-**SQL mode**: press `:` to open it, then `Enter` to run. You can write either a WHERE expression or a full SELECT query against the `entries` table.
-
-WHERE expression (the `SELECT` is added automatically):
+**SQL mode**: press `:` to open it, then `Enter` to run. Type a WHERE expression: the full `SELECT … FROM entries WHERE` is added automatically.
 
 ```sql
 status_code = 404
@@ -16,10 +14,8 @@ status_code = 404
 host LIKE '%.api.%' AND method = 'POST'
 ```
 
-Full SELECT query:
-
 ```sql
-SELECT * FROM entries WHERE response_raw LIKE '%password%' ORDER BY timestamp DESC LIMIT 20
+response_raw LIKE '%password%' ORDER BY timestamp DESC LIMIT 20
 ```
 
 The `entries` table has the following columns: `id`, `timestamp`, `method`, `host`, `path`, `status_code`, `request_raw`, `response_raw`.

docs/main.md

@@ -11,5 +11,7 @@
 # Spilltea Documentation
 
 - **Version**: `{{.Cfg.Version}}`
+- **Proxy**: `{{.Cfg.App.Host}}:{{.Cfg.App.Port}}`
+- **SSL Insecure**: `{{.Cfg.App.SslInsecure}}`
 - **Repository**: `https://github.com/anotherhadi/spilltea`
 - **Sponsor this project**: `https://ko-fi.com/anotherhadi`

docs/plugins.md

@@ -1,5 +1,7 @@
 # Plugins
 
+> **Warning:** Plugins can execute arbitrary shell commands, read and write files via `shell_pipe`, and access all intercepted traffic. Only load plugins you trust and have reviewed. You are solely responsible for the plugins you run.
+
 Spilltea supports Lua plugins that can intercept, modify, and analyze HTTP traffic.
 You can found some pre-built plugins [here](../../plugins/).
 
@@ -18,6 +20,7 @@ Plugin = {
   name               = "My Plugin",
   description        = "What this plugin does.",
   priority           = 0,     -- higher = runs before other plugins (default: 0)
+  disable_by_default = true,  -- if true, plugin starts disabled on first load (default: false)
 
   -- Declare which hooks you use and whether they are synchronous (default: false).
   -- on_config and on_quit are always sync and do not need to be declared here.
@@ -30,14 +33,14 @@ Plugin = {
 
 ### Hook reference
 
-| Hook                      | When called                          | Sync/async    | Return value (sync only)                              |
-| ------------------------- | ------------------------------------ | ------------- | ----------------------------------------------------- |
-| `on_config(config_text)`  | At startup and on config save        | always sync   | ignored                                               |
-| `on_start()`              | Once at startup, after `on_config`   | configurable  | ignored                                               |
+| Hook                      | When called                           | Sync/async   | Return value                                                                              |
+| ------------------------- | ------------------------------------- | ------------ | ----------------------------------------------------------------------------------------- |
+| `on_config()`             | At startup and on config save         | always sync  | ignored                                                                                   |
+| `on_start()`              | Once at startup, after `on_config`    | configurable | `false` to self-disable the plugin, otherwise ignored                                     |
 | `on_quit()`               | When the app exits                    | always sync  | ignored                                                                                   |
-| `on_request(req)`         | Every request, before auto-forward   | configurable  | `"drop"`, `"forward"`, or `nil`                       |
-| `on_response(req, res)`   | Every response                       | configurable  | `"drop"`, `"forward"`, or `nil`                       |
-| `on_history_entry(entry)` | Sync: before DB insert / Async: after | configurable | `"skip"` (don't save), `"keep"` or `nil` (save)      |
+| `on_request(req)`         | Every request, before auto-forward    | configurable | `"drop"`, `"forward"`, or `nil` (nil does nothing and le the user/TUI choose) (sync only) |
+| `on_response(req, res)`   | Every response                        | configurable | `"drop"`, `"forward"`, or `nil` (nil does nothing and le the user/TUI choose) (sync only) |
+| `on_history_entry(entry)` | Sync: before DB insert / Async: after | configurable | `"skip"` (don't save), `"keep"` or `nil` (save) (sync only)                               |
 
 ## Request and response objects
 
@@ -109,17 +112,87 @@ end
 
 -- Quit the app (useful for startup checks that fail)
 quit("reason message")
+
+-- Run a shell command, optionally piping a string to its stdin.
+-- Returns: output string, error string (nil on success).
+-- The command runs via "sh -c" with a 30-second timeout.
+local out, err = shell_pipe("trufflehog filesystem --no-update --json /dev/stdin", body)
+if err then
+  log("command failed: " .. err)
+else
+  log("output: " .. out)
+end
+
+-- Send an HTTP request directly (bypasses the proxy pipeline and other plugins).
+-- method:  HTTP method ("GET", "POST", etc.)
+-- url:     full URL to request
+-- headers: table of request headers (optional, pass {} if unused)
+-- body:    request body string (optional, pass "" if unused)
+-- options: optional table of options:
+--   insecure = true  skip TLS certificate verification
+-- Returns: response table, error string (nil on success).
+local res, err = send_request("POST", "https://example.com/api", {
+  ["Authorization"] = "Bearer " .. token,
+  ["Content-Type"]  = "application/json",
+}, '{"key":"value"}', { insecure = true })
+if err then
+  log("request failed: " .. err)
+else
+  log(tostring(res.status_code))
+  log(res.body)
+  log(res.headers["Content-Type"] or "")
+end
+
+-- Return the plugin's config section as a Lua table (parsed from YAML).
+-- Returns an empty table if no config is set.
+local cfg = get_config()
 ```
 
 ### Finding deduplication
 
-A finding is identified by `(plugin_name, key)`. If a finding with that pair already exists in the database it will **not** be re-created, even across restarts. If the user **dismisses** a finding it is permanently hidden and will never reappear, even if the plugin generates it again.
+A finding is identified by `(plugin_name, key)`. If a finding with that pair already exists in the database it will **not** be re-created, even across restarts.
+If the user **dismisses** a finding it is permanently hidden and will never reappear, even if the plugin generates it again.
 
 ## Configuration
 
-Each plugin gets a **config textarea** on the Plugins page. The raw text is passed as-is to `on_config(config_text)`. Parse it however you like (line by line, key=value, JSON, etc.).
+Plugin configuration is stored in a `plugins.yaml` file alongside the project database and can be edited through the "Proxy" TUI page.
+Each plugin is keyed by its filename (without the `.lua` extension) and has an `enable` toggle and an optional `config` block (arbitrary YAML).
 
-`on_config` is called once at startup (before `on_start`) and again every time the user saves the config in the UI.
+```yaml
+plugins:
+  my_plugin:
+    enable: true
+    config:
+      some_key: some_value
+      list:
+        - item1
+        - item2
+  other_plugin:
+    enable: false
+```
+
+The config block is edited from the **Plugins** page in the TUI.
+Inside a plugin, call `get_config()` to retrieve the config as a Lua table.
+
+Global defaults for any plugin can be set in `~/.config/spilltea/config.yaml` under a `plugins` key with the same structure as `plugins.yaml`.
+These defaults are applied the first time a plugin is loaded in a project; once the plugin has an entry in the project's `plugins.yaml`, the project config takes full precedence and the global defaults are ignored.
+
+`on_config()` is called once at startup (before `on_start`) and again every time the user saves the config in the TUI.
+It is the right place to read `get_config()` and populate local variables.
+
+```lua
+local items = {}
+
+function on_config()
+  items = {}
+  local cfg = get_config()
+  if cfg and cfg.list then
+    for _, v in ipairs(cfg.list) do
+      table.insert(items, v)
+    end
+  end
+end
+```
 
 ## Sync vs async
 
@@ -128,28 +201,13 @@ Each plugin gets a **config textarea** on the Plugins page. The raw text is pass
 
 `on_config` and `on_quit` are always synchronous regardless of the Plugin table declaration.
 
-### Return values for sync hooks
-
-**`on_request` and `on_response`:**
-
-| Return value | Effect                                                                            |
-| ------------ | --------------------------------------------------------------------------------- |
-| `"drop"`     | The flow is dropped immediately and never shown in the intercept panel.           |
-| `"forward"`  | The flow is forwarded immediately without going through the intercept panel.      |
-| `nil`        | Normal behaviour: the flow appears in the intercept panel for the user to decide. |
-
-**`on_history_entry` (sync only):**
-
-| Return value        | Effect                                 |
-| ------------------- | -------------------------------------- |
-| `"skip"`            | The entry is not saved to the DB.      |
-| `"keep"` or `nil`   | The entry is saved normally.           |
-
-Sync `on_history_entry` runs **before** the DB insert, so it can prevent an entry from ever appearing in history. Async `on_history_entry` runs **after** the insert and cannot affect it.
+Sync `on_history_entry` runs **before** the DB insert, so it can prevent an entry from ever appearing in history.
+Async `on_history_entry` runs **after** the insert and cannot affect it.
 
 ## Priority
 
-Plugins with a higher `priority` value run before plugins with a lower value (default `0`). This matters for sync hooks that return a decision: the first plugin to return a non-nil value short-circuits the remaining plugins.
+Plugins with a higher `priority` value run before plugins with a lower value (default `0`).
+This matters for sync hooks that return a decision: the first plugin to return a non-nil value short-circuits the remaining plugins.
 
 ```lua
 Plugin = {

docs/proxy.md

@@ -1,9 +1,17 @@
 ## Configuring your browser's proxy settings
 
-We recommend installing **FoxyProxy** to manage your browser's proxies.
+**If you use Nix**, you can launch a pre-configured browser (LibreWolf) with the proxy and certificate already set up:
+
+```sh
+nix run github:anotherhadi/spilltea#browser{{if or (ne .Cfg.App.Host "127.0.0.1") (ne .Cfg.App.Port 8080) (ne .Cfg.App.CertDir "~/.local/share/spilltea")}} --{{end}}{{if ne .Cfg.App.Host "127.0.0.1"}} --host {{.Cfg.App.Host}}{{end}}{{if ne .Cfg.App.Port 8080}} --port {{.Cfg.App.Port}}{{end}}{{if ne .Cfg.App.CertDir "~/.local/share/spilltea"}} --cert-dir {{.Cfg.App.CertDir}}{{end}}
+```
+
+Otherwise, we recommend installing **FoxyProxy** to manage your browser's proxies.
 You can install it from the [Google Chrome extension store](https://chromewebstore.google.com/) or from the [Firefox extension store](https://addons.mozilla.org/en-US/firefox/extensions)
 
 1. Open FoxyProxy's options, then click on `Add New Proxy` button.
 2. Click the "Manual Proxy Configuration" radio button. Set the "HTTP Proxy" field to `{{.Cfg.App.Host}}` and the "Port" field to `{{.Cfg.App.Port}}`. Click "Save".
 3. Forward traffic to Spilltea by selecting the new proxy in FoxyProxy's extension button.
 4. You're all set! You can now use Spilltea.
+
+If `proxy_auth` is set in the config (`user:pass`), enter the same credentials in FoxyProxy under "Username" and "Password" in the proxy settings.

flake.lock

@@ -1,5 +1,103 @@
 {
   "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gomod2nix": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770585520,
+        "narHash": "sha256-yBz9Ozd5Wb56i3e3cHZ8WcbzCQ9RlVaiW18qDYA/AzA=",
+        "owner": "nix-community",
+        "repo": "gomod2nix",
+        "rev": "1201ddd1279c35497754f016ef33d5e060f3da8d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "gomod2nix",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1777954456,
@@ -18,8 +116,25 @@
     },
     "root": {
       "inputs": {
+        "git-hooks": "git-hooks",
+        "gomod2nix": "gomod2nix",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,55 +1,41 @@
 {
   description = "Spilltea: A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.";
 
-  inputs = {nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";};
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    gomod2nix = {
+      url = "github:nix-community/gomod2nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs = {
     self,
     nixpkgs,
+    gomod2nix,
+    git-hooks,
   }: let
     supportedSystems = ["x86_64-linux" "aarch64-linux"];
 
     forAllSystems = f:
       nixpkgs.lib.genAttrs supportedSystems
       (system: f system (import nixpkgs {inherit system;}));
-
-    pname = "spilltea";
-    version = "0.0.4";
-
-    ldflags = ["-s" "-w" "-X main.version=${version}"];
   in {
-    packages = forAllSystems (system: pkgs: let
-      pkg = pkgs.buildGoModule {
-        inherit pname version ldflags;
-
-        src = ./.;
-        outputs = ["out"];
-
-        vendorHash = "sha256-1iPwFsyzdonak9EWMRnudwcCQZfI+Uvre38+puG4s0s=";
-
-        meta = with pkgs.lib; {
-          description = "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.";
-          homepage = "https://github.com/anotherhadi/spilltea";
-          platforms = platforms.unix;
-        };
-      };
-    in {
-      "${pname}" = pkg;
-      default = pkg;
+    packages = forAllSystems (system: pkgs:
+      import ./nix/package.nix {
+        inherit pkgs;
+        buildGoApplication = gomod2nix.legacyPackages.${system}.buildGoApplication;
       });
 
     devShells = forAllSystems (system: pkgs: {
-      default = pkgs.mkShell {
-        packages = with pkgs; [
-          go
-          python3
-          lefthook
-          doctoc
-        ];
-
-        shellHook = ''
-          lefthook install
-        '';
+      default = import ./nix/shell.nix {
+        inherit pkgs;
+        gitHooksLib = git-hooks.lib.${system};
+        gomod2nixPkgs = gomod2nix.legacyPackages.${system};
       };
     });
   };

go.mod

@@ -7,20 +7,22 @@ require (
 	charm.land/bubbletea/v2 v2.0.6
 	charm.land/glamour/v2 v2.0.0
 	charm.land/lipgloss/v2 v2.0.3
+	github.com/andybalholm/brotli v1.0.4
+	github.com/anotherhadi/ilovetui v0.1.6
 	github.com/charmbracelet/x/ansi v0.11.7
+	github.com/klauspost/compress v1.17.8
 	github.com/lqqyt2423/go-mitmproxy v1.8.11
 	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/yuin/gopher-lua v1.1.2
-	golang.org/x/net v0.54.0
+	golang.org/x/net v0.55.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.50.1
 )
 
 require (
 	github.com/alecthomas/chroma/v2 v2.24.1 // indirect
-	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
@@ -39,7 +41,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/klauspost/compress v1.17.8 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-runewidth v0.0.23 // indirect
@@ -54,6 +56,7 @@ require (
 	github.com/satori/go.uuid v1.2.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.8.2 // indirect
@@ -61,7 +64,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -16,6 +16,8 @@ github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/anotherhadi/ilovetui v0.1.6 h1:NKg+T1DpV08Q4r+iowFrXF+0bTd6Y2f4OFpFwhsfsyY=
+github.com/anotherhadi/ilovetui v0.1.6/go.mod h1:HVai6u5NGKSMOpmioYpwrN0lSxQjc7HtISUc5hTwvOw=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
@@ -42,6 +44,7 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
@@ -70,6 +73,8 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
 github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -102,6 +107,7 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
@@ -114,6 +120,9 @@ github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
@@ -138,12 +147,12 @@ golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

internal/config/colors.go

@@ -1,20 +0,0 @@
-package config
-
-type Colors struct {
-	Base00 string `mapstructure:"base00"`
-	Base01 string `mapstructure:"base01"`
-	Base02 string `mapstructure:"base02"`
-	Base03 string `mapstructure:"base03"`
-	Base04 string `mapstructure:"base04"`
-	Base05 string `mapstructure:"base05"`
-	Base06 string `mapstructure:"base06"`
-	Base07 string `mapstructure:"base07"`
-	Base08 string `mapstructure:"base08"`
-	Base09 string `mapstructure:"base09"`
-	Base0A string `mapstructure:"base0a"`
-	Base0B string `mapstructure:"base0b"`
-	Base0C string `mapstructure:"base0c"`
-	Base0D string `mapstructure:"base0d"`
-	Base0E string `mapstructure:"base0e"`
-	Base0F string `mapstructure:"base0f"`
-}

internal/config/config.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	_ "embed"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -24,10 +25,13 @@ type Config struct {
 		ProjectDir     string `mapstructure:"project_dir"`
 		PluginsDir     string `mapstructure:"plugins_dir"`
 		UpstreamProxy  string `mapstructure:"upstream_proxy"`
+		ProxyAuth      string `mapstructure:"proxy_auth"`
+		MaxBodySizeMB  int    `mapstructure:"max_body_size_mb"`
+		ExternalEditor string `mapstructure:"external_editor"`
+		SslInsecure    bool   `mapstructure:"ssl_insecure"`
 	} `mapstructure:"app"`
 
 	TUI struct {
-		Colors              Colors `mapstructure:"colors"`
 		UseNerdfontIcons    bool   `mapstructure:"use_nerdfont_icons"`
 		DefaultSidebarState string `mapstructure:"default_sidebar_state"`
 		PrettyPrintBody     bool   `mapstructure:"pretty_print_body"`
@@ -37,6 +41,7 @@ type Config struct {
 		DefaultInterceptEnabled bool     `mapstructure:"default_intercept_enabled"`
 		DefaultCaptureResponse  bool     `mapstructure:"default_capture_response"`
 		AutoForwardRegex        []string `mapstructure:"auto_forward_regex"`
+		QueueSize               int      `mapstructure:"queue_size"`
 	} `mapstructure:"intercept"`
 
 	Replay struct {
@@ -49,10 +54,54 @@ type Config struct {
 	} `mapstructure:"history"`
 
 	Keybindings Keybindings `mapstructure:"keybindings"`
+
+	Plugins map[string]GlobalPlugin `mapstructure:"plugins"`
+}
+
+type GlobalPlugin struct {
+	Enable *bool       `mapstructure:"enable"`
+	Config interface{} `mapstructure:"config"`
 }
 
 var Global *Config
 
+var projectCLIOverrides func(*Config)
+
+// SetCLIOverrides stores a function that re-applies CLI flag overrides.
+// It is called automatically after MergeProjectConfig so that CLI flags
+// always win over both global and per-project config.
+func SetCLIOverrides(fn func(*Config)) {
+	projectCLIOverrides = fn
+}
+
+// MergeProjectConfig merges <projectDir>/config.yaml on top of the current
+// Global config, then re-applies any registered CLI overrides.
+// If no config.yaml exists in the project directory, this is a no-op.
+func MergeProjectConfig(projectDir string) error {
+	projectConfigPath := filepath.Join(projectDir, "config.yaml")
+	if _, err := os.Stat(projectConfigPath); errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	pv := viper.New()
+	pv.SetConfigFile(projectConfigPath)
+	if err := pv.ReadInConfig(); err != nil {
+		return fmt.Errorf("project config: %w", err)
+	}
+	if err := viper.MergeConfigMap(pv.AllSettings()); err != nil {
+		return fmt.Errorf("merge project config: %w", err)
+	}
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	if projectCLIOverrides != nil {
+		projectCLIOverrides(Global)
+	}
+	return nil
+}
+
 func Load(path string) error {
 	var defaults map[string]any
 	if err := yaml.Unmarshal(defaultConfig, &defaults); err != nil {
@@ -65,20 +114,25 @@ func Load(path string) error {
 	viper.SetConfigType("yaml")
 	viper.SetConfigFile(path)
 	if err := viper.ReadInConfig(); err != nil {
-		if !os.IsNotExist(err) {
+		if !errors.Is(err, os.ErrNotExist) {
 			return err
 		}
 	}
 
 	Global = &Config{}
-	return viper.Unmarshal(Global)
+	if err := viper.Unmarshal(Global); err != nil {
+		return err
+	}
+	Global.App.ProxyAuth = expandEnvValue(Global.App.ProxyAuth)
+	Global.App.UpstreamProxy = expandEnvValue(Global.App.UpstreamProxy)
+	return nil
 }
 
 func WriteDefaultConfig(path string) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
 		return fmt.Errorf("create config dir: %w", err)
 	}
-	if err := os.WriteFile(path, defaultConfig, 0o644); err != nil {
+	if err := os.WriteFile(path, defaultConfig, 0o600); err != nil {
 		return fmt.Errorf("write config: %w", err)
 	}
 	return nil
@@ -95,6 +149,17 @@ func ExpandPath(p string) string {
 	return p
 }
 
+// expandEnvValue replaces a value starting with "$" with the corresponding
+// environment variable, enabling secrets to be kept out of config files.
+func expandEnvValue(s string) string {
+	if len(s) > 1 && s[0] == '$' {
+		if val := os.Getenv(s[1:]); val != "" {
+			return val
+		}
+	}
+	return s
+}
+
 func flatten(prefix string, m map[string]any) map[string]any {
 	out := make(map[string]any)
 	for k, v := range m {

internal/config/default_config.yaml

@@ -4,11 +4,16 @@ app:
   cert_dir: ~/.local/share/spilltea
   project_dir: ~/.local/share/spilltea
   plugins_dir: ~/.config/spilltea/plugins
-  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or http://user:pass@host:8888
+  upstream_proxy: "" # e.g. http://corporate-proxy:8888 or $ENV_VAR
+  proxy_auth: "" # require basic auth to use the spilltea proxy, format: user:pass or $ENV_VAR (empty = disabled).
+  max_body_size_mb: 50 # max response body size read into memory for large streamed responses (MB)
+  external_editor: "" # override $EDITOR for external editing (e.g. nvim, code --wait)
+  ssl_insecure: false # bypass TLS certificate verification (enable for self-signed cert targets)
 
 intercept:
   default_intercept_enabled: true
   default_capture_response: false
+  queue_size: 128 # max pending intercepted requests/responses before the proxy blocks
   auto_forward_regex:
     - '\.(js|css|png|gif|ico|woff2?|ttf|svg)(\?.*)?$'
 
@@ -23,77 +28,70 @@ tui:
   use_nerdfont_icons: false
   default_sidebar_state: "expanded" # hidden, collapsed, expanded
   pretty_print_body: true # auto-indent JSON and HTML response bodies
-  colors:
-    base00: "110F12" # Default Background
-    base01: "1C1920" # Lighter Background (status bars, line numbers)
-    base02: "1D1A26" # Selection Background
-    base03: "514D63" # Comments, Invisibles, faint text
-    base04: "8E8AA0" # Dark Foreground (status bars)
-    base05: "C2BED6" # Default Foreground, Caret, Delimiters
-    base06: "D8D5EA" # Light Foreground (rarely used)
-    base07: "EAE7F7" # Light Background (rarely used)
-    base08: "E07080" # Red: errors, diff deleted
-    base09: "D49070" # Orange: integers, constants, warnings
-    base0a: "C4B060" # Yellow: classes, search highlight
-    base0b: "80B880" # Green: strings, diff inserted, success
-    base0c: "70B8C0" # Cyan: support, regex, escape chars
-    base0d: "9E97F8" # Blue/Accent: functions, headings, primary
-    base0e: "C090E8" # Purple: keywords, storage
-    base0f: "D080A0" # Pink: deprecated, embedded language tags
 
 keybindings:
   global:
     quit: "q,ctrl+c"
+    escape: "esc,ctrl+c"
+    help: "?"
     open_logs: "ctrl+g"
     toggle_sidebar: "ctrl+b"
-    help: "?"
+    cycle_focus: "tab"
+    send_to_replay: "ctrl+r"
+    send_to_diff: "ctrl+x"
+    copy_as: "ctrl+y"
+    copy: "y"
     up: "up,k"
     down: "down,j"
     left: "left,h"
     right: "right,l"
-    cycle_focus: "tab"
-    copy_as: "ctrl+y"
-    copy: "y"
-    send_to_replay: "ctrl+r"
-    scroll_up: "pgup"
-    scroll_down: "pgdown"
-    send_to_diff: "ctrl+d"
+    goto_top: "g"
+    goto_bottom: "G,end"
+    scroll_up: "pgup,ctrl+u"
+    scroll_down: "pgdown,ctrl+d"
+    prev_page: "[,ctrl+i"
+    next_page: "],ctrl+o"
 
   intercept:
+    toggle_intercept: "i"
+    capture_response: "r"
     forward: "f"
     forward_all: "F"
     drop: "d"
     drop_all: "D"
-    toggle_intercept: "i"
-    capture_response: "r"
-    undo_edits: "ctrl+z"
     edit: "e,enter"
     edit_external: "E"
+    undo_edits: "u,ctrl+z"
 
   history:
     delete_entry: "x"
     delete_all: "X"
     sql_query: ":"
     filter: "/"
+    flag: "m"
 
   home:
-    open: "enter,l"
+    open: "l,enter"
     delete: "x"
     filter: "/"
 
   replay:
-    send: "enter,s"
+    send: "s, enter"
     edit: "e"
     edit_external: "E"
-    undo_edits: "R"
+    undo_edits: "u,ctrl+z"
     delete_entry: "x"
     delete_all: "X"
+    filter: "/"
+    flag: "m"
 
   diff:
-    clear: "c"
+    clear: "x"
 
   findings:
     dismiss: "x"
+    dismiss_all: "X"
+    flag: "m"
 
   plugins:
     toggle: "space"

internal/config/keybindings.go

@@ -2,6 +2,7 @@ package config
 
 type GlobalKeys struct {
 	Quit          string `mapstructure:"quit"`
+	Escape        string `mapstructure:"escape"`
 	OpenLogs      string `mapstructure:"open_logs"`
 	ToggleSidebar string `mapstructure:"toggle_sidebar"`
 	Help          string `mapstructure:"help"`
@@ -16,6 +17,10 @@ type GlobalKeys struct {
 	ScrollUp      string `mapstructure:"scroll_up"`
 	ScrollDown    string `mapstructure:"scroll_down"`
 	SendToDiff    string `mapstructure:"send_to_diff"`
+	GotoTop       string `mapstructure:"goto_top"`
+	GotoBottom    string `mapstructure:"goto_bottom"`
+	PrevPage      string `mapstructure:"prev_page"`
+	NextPage      string `mapstructure:"next_page"`
 }
 
 type InterceptKeys struct {
@@ -35,6 +40,7 @@ type HistoryKeys struct {
 	DeleteAll   string `mapstructure:"delete_all"`
 	Filter      string `mapstructure:"filter"`
 	SqlQuery    string `mapstructure:"sql_query"`
+	Flag        string `mapstructure:"flag"`
 }
 
 type HomeKeys struct {
@@ -50,6 +56,8 @@ type ReplayKeys struct {
 	UndoEdits string `mapstructure:"undo_edits"`
 	Delete    string `mapstructure:"delete_entry"`
 	DeleteAll string `mapstructure:"delete_all"`
+	Filter    string `mapstructure:"filter"`
+	Flag      string `mapstructure:"flag"`
 }
 
 type DiffKeys struct {
@@ -58,6 +66,8 @@ type DiffKeys struct {
 
 type FindingsKeys struct {
 	Dismiss    string `mapstructure:"dismiss"`
+	DismissAll string `mapstructure:"dismiss_all"`
+	Flag       string `mapstructure:"flag"`
 }
 
 type PluginsKeys struct {

internal/db/db.go

@@ -2,12 +2,17 @@ package db
 
 import (
 	"database/sql"
+	"log"
+	"sync"
 
 	_ "modernc.org/sqlite"
 )
 
 type DB struct {
 	conn    *sql.DB
+	roConn  *sql.DB
+	path    string
+	dedupMu sync.Mutex
 }
 
 func Open(path string) (*DB, error) {
@@ -15,15 +20,41 @@ func Open(path string) (*DB, error) {
 	if err != nil {
 		return nil, err
 	}
-	d := &DB{conn: conn}
+	// SQLite only supports one concurrent writer; a pool of connections would
+	// cause SQLITE_BUSY errors when multiple proxy goroutines try to insert
+	// history entries at the same time.
+	conn.SetMaxOpenConns(1)
+	d := &DB{conn: conn, path: path}
 	if err := d.migrate(); err != nil {
-		conn.Close()
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
 		return nil, err
 	}
+	roConn, err := sql.Open("sqlite", path)
+	if err != nil {
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
+		return nil, err
+	}
+	if _, err := roConn.Exec("PRAGMA query_only=ON"); err != nil {
+		if cerr := conn.Close(); cerr != nil {
+			log.Printf("db: close conn: %v", cerr)
+		}
+		if cerr := roConn.Close(); cerr != nil {
+			log.Printf("db: close roConn: %v", cerr)
+		}
+		return nil, err
+	}
+	d.roConn = roConn
 	return d, nil
 }
 
 func (d *DB) migrate() error {
+	if _, err := d.conn.Exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA foreign_keys=OFF;`); err != nil {
+		return err
+	}
 	_, err := d.conn.Exec(`
 		CREATE TABLE IF NOT EXISTS entries (
 			id           INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -33,7 +64,9 @@ func (d *DB) migrate() error {
 			path         TEXT NOT NULL,
 			status_code  INTEGER NOT NULL,
 			request_raw  TEXT NOT NULL,
-			response_raw TEXT NOT NULL
+			response_raw TEXT NOT NULL,
+			body_hash    TEXT NOT NULL DEFAULT '',
+			flagged      INTEGER NOT NULL DEFAULT 0
 		);
 CREATE TABLE IF NOT EXISTS replay_entries (
 			id           INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -46,12 +79,8 @@ CREATE TABLE IF NOT EXISTS replay_entries (
 			request_raw  TEXT NOT NULL,
 			response_raw TEXT NOT NULL,
 			status_code  INTEGER NOT NULL,
-			error_msg    TEXT NOT NULL
-		);
-		CREATE TABLE IF NOT EXISTS plugins (
-			name        TEXT PRIMARY KEY,
-			enabled     INTEGER NOT NULL DEFAULT 1,
-			config_text TEXT NOT NULL DEFAULT ''
+			error_msg    TEXT NOT NULL,
+			flagged      INTEGER NOT NULL DEFAULT 0
 		);
 CREATE TABLE IF NOT EXISTS findings (
 			id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -61,10 +90,15 @@ CREATE TABLE IF NOT EXISTS replay_entries (
 			description TEXT NOT NULL DEFAULT '',
 			severity    TEXT NOT NULL DEFAULT 'info',
 			dismissed   INTEGER NOT NULL DEFAULT 0,
+			flagged     INTEGER NOT NULL DEFAULT 0,
 			created_at  DATETIME NOT NULL,
 			UNIQUE(plugin_name, dedup_key)
 		);
 	`)
+	if err != nil {
+		return err
+	}
+	_, err = d.conn.Exec(`CREATE INDEX IF NOT EXISTS idx_entries_dedup ON entries(method, host, path, body_hash)`)
 	return err
 }
 
@@ -78,6 +112,7 @@ func (d *DB) Close() error {
 	if d == nil {
 		return nil
 	}
+	_ = d.roConn.Close()
 	return d.conn.Close()
 }
 
@@ -90,6 +125,8 @@ func CountEntriesAt(path string) int {
 	}
 	defer conn.Close()
 	var n int
-	conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n)
+	if err := conn.QueryRow(`SELECT COUNT(*) FROM entries`).Scan(&n); err != nil {
+		log.Printf("db: count entries: %v", err)
+	}
 	return n
 }

internal/db/entries.go

@@ -1,8 +1,10 @@
 package db
 
 import (
+	"crypto/sha256"
 	"database/sql"
 	"fmt"
+	"log"
 	"strings"
 	"time"
 )
@@ -16,47 +18,57 @@ type Entry struct {
 	StatusCode  int
 	RequestRaw  string
 	ResponseRaw string
+	Flagged     bool
+}
+
+func bodyHash(body string) string {
+	sum := sha256.Sum256([]byte(body))
+	return fmt.Sprintf("%x", sum)
 }
 
 // HasDuplicate returns true if an entry with the same method, host, path and
-// request body already exists. Used to implement skip_duplicates filtering.
+// request body hash already exists.
 func (d *DB) HasDuplicate(method, host, path, body string) (bool, error) {
-	rows, err := d.conn.Query(
-		`SELECT request_raw FROM entries WHERE method = ? AND host = ? AND path = ?`,
-		method, host, path,
-	)
-	if err != nil {
-		return false, err
+	hash := bodyHash(body)
+	var exists int
+	err := d.conn.QueryRow(
+		`SELECT 1 FROM entries WHERE method = ? AND host = ? AND path = ? AND body_hash = ? LIMIT 1`,
+		method, host, path, hash,
+	).Scan(&exists)
+	if err == sql.ErrNoRows {
+		return false, nil
 	}
-	defer rows.Close()
-	for rows.Next() {
-		var raw string
-		if err := rows.Scan(&raw); err != nil {
-			return false, err
-		}
-		parts := strings.SplitN(raw, "\n\n", 2)
-		entryBody := ""
-		if len(parts) == 2 {
-			entryBody = parts[1]
-		}
-		if entryBody == body {
-			return true, nil
-		}
-	}
-	return false, rows.Err()
+	return err == nil, err
 }
 
-func (d *DB) InsertEntry(e Entry) (Entry, error) {
+// InsertIfNotDuplicate atomically checks for a duplicate and inserts if none
+// exists. Returns (entry, isDuplicate, error).
+func (d *DB) InsertIfNotDuplicate(e Entry, body string) (Entry, bool, error) {
+	d.dedupMu.Lock()
+	defer d.dedupMu.Unlock()
+	dup, err := d.HasDuplicate(e.Method, e.Host, e.Path, body)
+	if err != nil || dup {
+		return e, dup, err
+	}
+	e, err = d.InsertEntry(e, body)
+	return e, false, err
+}
+
+func (d *DB) InsertEntry(e Entry, body string) (Entry, error) {
 	res, err := d.conn.Exec(
-		`INSERT INTO entries (timestamp, method, host, path, status_code, request_raw, response_raw)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		`INSERT INTO entries (timestamp, method, host, path, status_code, request_raw, response_raw, body_hash)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
 		e.Timestamp.UTC().Format(time.RFC3339),
-		e.Method, e.Host, e.Path, e.StatusCode, e.RequestRaw, e.ResponseRaw,
+		e.Method, e.Host, e.Path, e.StatusCode, e.RequestRaw, e.ResponseRaw, bodyHash(body),
 	)
 	if err != nil {
 		return e, err
 	}
-	e.ID, _ = res.LastInsertId()
+	var idErr error
+	e.ID, idErr = res.LastInsertId()
+	if idErr != nil {
+		log.Printf("db: LastInsertId: %v", idErr)
+	}
 	return e, nil
 }
 
@@ -65,10 +77,16 @@ func scanEntries(rows *sql.Rows) ([]Entry, error) {
 	for rows.Next() {
 		var e Entry
 		var ts string
-		if err := rows.Scan(&e.ID, &ts, &e.Method, &e.Host, &e.Path, &e.StatusCode, &e.RequestRaw, &e.ResponseRaw); err != nil {
+		var flagged int
+		if err := rows.Scan(&e.ID, &ts, &e.Method, &e.Host, &e.Path, &e.StatusCode, &e.RequestRaw, &e.ResponseRaw, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse timestamp %q: %v", ts, tsErr)
+		}
+		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
 	return entries, rows.Err()
@@ -76,7 +94,7 @@ func scanEntries(rows *sql.Rows) ([]Entry, error) {
 
 func (d *DB) ListEntries() ([]Entry, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw
+		`SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged
 		 FROM entries ORDER BY id DESC`,
 	)
 	if err != nil {
@@ -89,7 +107,7 @@ func (d *DB) ListEntries() ([]Entry, error) {
 func (d *DB) SearchEntries(term string) ([]Entry, error) {
 	like := "%" + term + "%"
 	rows, err := d.conn.Query(
-		`SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw
+		`SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged
 		 FROM entries
 		 WHERE method LIKE ? OR host LIKE ? OR path LIKE ? OR request_raw LIKE ? OR response_raw LIKE ?
 		 ORDER BY id DESC`,
@@ -102,17 +120,13 @@ func (d *DB) SearchEntries(term string) ([]Entry, error) {
 	return scanEntries(rows)
 }
 
-// QueryEntries executes a user-supplied query against the entries table.
-// If the query does not start with SELECT, it is treated as a WHERE expression
-// and wrapped automatically (e.g. "status_code = 404" becomes a full SELECT).
-func (d *DB) QueryEntries(rawSQL string) ([]Entry, error) {
-	q := strings.TrimSpace(rawSQL)
-	if !strings.HasPrefix(strings.ToUpper(q), "SELECT") {
-		q = "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw FROM entries WHERE " + q
-	} else if strings.ContainsAny(strings.ToUpper(q), "INSERTDELETEUPDATEDROP") {
-		return nil, fmt.Errorf("only SELECT queries are allowed")
-	}
-	rows, err := d.conn.Query(q)
+// QueryEntries runs a WHERE expression supplied by the user against the entries
+// table (e.g. "status_code = 404" or "host LIKE '%example.com%'").
+// Uses the persistent read-only connection (PRAGMA query_only=ON) so that any
+// DML or DDL in the user-supplied expression is rejected by SQLite before it executes.
+func (d *DB) QueryEntries(where string) ([]Entry, error) {
+	q := "SELECT id, timestamp, method, host, path, status_code, request_raw, response_raw, flagged FROM entries WHERE " + strings.TrimSpace(where) // #nosec G202 -- intentional: user-supplied WHERE clause on a PRAGMA query_only=ON connection
+	rows, err := d.roConn.Query(q)
 	if err != nil {
 		return nil, err
 	}
@@ -120,6 +134,11 @@ func (d *DB) QueryEntries(rawSQL string) ([]Entry, error) {
 	return scanEntries(rows)
 }
 
+func (d *DB) ToggleFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE entries SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
 func (d *DB) DeleteEntry(id int64) error {
 	_, err := d.conn.Exec(`DELETE FROM entries WHERE id = ?`, id)
 	return err
@@ -129,3 +148,18 @@ func (d *DB) DeleteAllEntries() error {
 	_, err := d.conn.Exec(`DELETE FROM entries`)
 	return err
 }
+
+// DeleteAllExceptFlagged deletes all unflagged entries. If there are no
+// unflagged entries (only flagged ones remain), it deletes everything.
+func (d *DB) DeleteAllExceptFlagged() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM entries WHERE flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`DELETE FROM entries WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`DELETE FROM entries`)
+	return err
+}

internal/db/findings.go

@@ -11,12 +11,15 @@ type Finding struct {
 	Title       string
 	Description string
 	Severity    string
+	Flagged     bool
 	CreatedAt   time.Time
 }
 
 // UpsertFinding inserts the finding if the (plugin_name, dedup_key) pair does
 // not already exist. Returns true when the row was actually inserted.
 func (d *DB) UpsertFinding(f Finding) (bool, error) {
+	d.dedupMu.Lock()
+	defer d.dedupMu.Unlock()
 	res, err := d.conn.Exec(
 		`INSERT OR IGNORE INTO findings (plugin_name, dedup_key, title, description, severity, dismissed, created_at)
 		 VALUES (?, ?, ?, ?, ?, 0, ?)`,
@@ -32,8 +35,8 @@ func (d *DB) UpsertFinding(f Finding) (bool, error) {
 
 func (d *DB) LoadFindings() ([]Finding, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, plugin_name, dedup_key, title, description, severity, created_at
-		 FROM findings WHERE dismissed = 0 ORDER BY id DESC`,
+		`SELECT id, plugin_name, dedup_key, title, description, severity, flagged, created_at
+		 FROM findings WHERE dismissed = 0 ORDER BY id ASC`,
 	)
 	if err != nil {
 		return nil, err
@@ -43,9 +46,11 @@ func (d *DB) LoadFindings() ([]Finding, error) {
 	for rows.Next() {
 		var f Finding
 		var ts string
-		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &ts); err != nil {
+		var flagged int
+		if err := rows.Scan(&f.ID, &f.PluginName, &f.DedupKey, &f.Title, &f.Description, &f.Severity, &flagged, &ts); err != nil {
 			return nil, err
 		}
+		f.Flagged = flagged != 0
 		for _, layout := range findingTimeFormats {
 			if t, err := time.Parse(layout, ts); err == nil {
 				f.CreatedAt = t.Local()
@@ -61,3 +66,23 @@ func (d *DB) DismissFinding(id int64) error {
 	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE id = ?`, id)
 	return err
 }
+
+func (d *DB) ToggleFindingFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE findings SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
+// DismissAllFindings dismisses unflagged findings first. If none are unflagged
+// (only flagged ones remain), it dismisses everything.
+func (d *DB) DismissAllFindings() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM findings WHERE dismissed = 0 AND flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1 WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`UPDATE findings SET dismissed = 1`)
+	return err
+}

internal/db/plugins.go

@@ -1,35 +0,0 @@
-package db
-
-type PluginState struct {
-	Name       string
-	Enabled    bool
-	ConfigText string
-}
-
-func (d *DB) SavePluginState(name string, enabled bool, configText string) error {
-	_, err := d.conn.Exec(
-		`INSERT INTO plugins (name, enabled, config_text) VALUES (?, ?, ?)
-		 ON CONFLICT(name) DO UPDATE SET enabled = excluded.enabled, config_text = excluded.config_text`,
-		name, enabled, configText,
-	)
-	return err
-}
-
-func (d *DB) LoadPluginStates() ([]PluginState, error) {
-	rows, err := d.conn.Query(`SELECT name, enabled, config_text FROM plugins`)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []PluginState
-	for rows.Next() {
-		var s PluginState
-		var enabled int
-		if err := rows.Scan(&s.Name, &enabled, &s.ConfigText); err != nil {
-			return nil, err
-		}
-		s.Enabled = enabled != 0
-		out = append(out, s)
-	}
-	return out, rows.Err()
-}

internal/db/replay.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"log"
 	"time"
 )
 
@@ -16,16 +17,17 @@ type ReplayEntry struct {
 	ResponseRaw string
 	StatusCode  int
 	ErrorMsg    string
+	Flagged     bool
 }
 
 func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 	res, err := d.conn.Exec(
-		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		`INSERT INTO replay_entries (timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		e.Timestamp.UTC().Format(time.RFC3339),
 		e.Scheme, e.Host, e.Path, e.Method,
 		e.OriginalRaw, e.RequestRaw, e.ResponseRaw,
-		e.StatusCode, e.ErrorMsg,
+		e.StatusCode, e.ErrorMsg, e.Flagged,
 	)
 	if err != nil {
 		return 0, err
@@ -35,15 +37,15 @@ func (d *DB) InsertReplayEntry(e ReplayEntry) (int64, error) {
 
 func (d *DB) UpdateReplayEntry(e ReplayEntry) error {
 	_, err := d.conn.Exec(
-		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=? WHERE id=?`,
-		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.ID,
+		`UPDATE replay_entries SET request_raw=?, response_raw=?, status_code=?, error_msg=?, flagged=? WHERE id=?`,
+		e.RequestRaw, e.ResponseRaw, e.StatusCode, e.ErrorMsg, e.Flagged, e.ID,
 	)
 	return err
 }
 
 func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	rows, err := d.conn.Query(
-		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg
+		`SELECT id, timestamp, scheme, host, path, method, original_raw, request_raw, response_raw, status_code, error_msg, flagged
 		 FROM replay_entries ORDER BY id ASC`,
 	)
 	if err != nil {
@@ -55,16 +57,27 @@ func (d *DB) ListReplayEntries() ([]ReplayEntry, error) {
 	for rows.Next() {
 		var e ReplayEntry
 		var ts string
+		var flagged int
 		if err := rows.Scan(&e.ID, &ts, &e.Scheme, &e.Host, &e.Path, &e.Method,
-			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg); err != nil {
+			&e.OriginalRaw, &e.RequestRaw, &e.ResponseRaw, &e.StatusCode, &e.ErrorMsg, &flagged); err != nil {
 			return nil, err
 		}
-		e.Timestamp, _ = time.Parse(time.RFC3339, ts)
+		var tsErr error
+		e.Timestamp, tsErr = time.Parse(time.RFC3339, ts)
+		if tsErr != nil {
+			log.Printf("db: parse replay timestamp %q: %v", ts, tsErr)
+		}
+		e.Flagged = flagged != 0
 		entries = append(entries, e)
 	}
 	return entries, rows.Err()
 }
 
+func (d *DB) ToggleReplayFlag(id int64) error {
+	_, err := d.conn.Exec(`UPDATE replay_entries SET flagged = NOT flagged WHERE id = ?`, id)
+	return err
+}
+
 func (d *DB) DeleteReplayEntry(id int64) error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE id = ?`, id)
 	return err
@@ -74,3 +87,18 @@ func (d *DB) DeleteAllReplayEntries() error {
 	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
 	return err
 }
+
+// DeleteAllReplayEntriesExceptFlagged deletes all unflagged replay entries. If
+// none are unflagged (only flagged ones remain), it deletes everything.
+func (d *DB) DeleteAllReplayEntriesExceptFlagged() error {
+	var count int
+	if err := d.conn.QueryRow(`SELECT COUNT(*) FROM replay_entries WHERE flagged = 0`).Scan(&count); err != nil {
+		return err
+	}
+	if count > 0 {
+		_, err := d.conn.Exec(`DELETE FROM replay_entries WHERE flagged = 0`)
+		return err
+	}
+	_, err := d.conn.Exec(`DELETE FROM replay_entries`)
+	return err
+}

internal/icons/icons.go

@@ -20,6 +20,7 @@ type Icons struct {
 	New       string
 	Temp      string
 	Project   string
+	Flag      string
 }
 
 var I *Icons
@@ -44,8 +45,11 @@ func Init(cfg *config.Config) {
 			New:       "󰐕 ",
 			Temp:      "󰙨 ",
 			Project:   "󰉋 ",
+			Flag:      "󰈻 ",
 		}
 	} else {
-		I = &Icons{}
+		I = &Icons{
+			Flag: "*",
+		}
 	}
 }

internal/intercept/broker.go

@@ -1,6 +1,7 @@
 package intercept
 
 import (
+	"log"
 	"regexp"
 	"sync"
 	"sync/atomic"
@@ -57,9 +58,13 @@ func (b *Broker) SetOnNewEntry(cb func(db.Entry)) {
 }
 
 func NewBroker() *Broker {
+	size := config.Global.Intercept.QueueSize
+	if size <= 0 {
+		size = 64
+	}
 	b := &Broker{
-		Incoming:         make(chan *PendingRequest, 64),
-		IncomingResponse: make(chan *PendingResponse, 64),
+		Incoming:         make(chan *PendingRequest, size),
+		IncomingResponse: make(chan *PendingResponse, size),
 	}
 	b.SetAutoForwardRegex(config.Global.Intercept.AutoForwardRegex)
 	return b
@@ -75,9 +80,12 @@ func (b *Broker) SetCaptureResponse(v bool) {
 func (b *Broker) SetAutoForwardRegex(patterns []string) {
 	compiled := make([]*regexp.Regexp, 0, len(patterns))
 	for _, p := range patterns {
-		if r, err := regexp.Compile(p); err == nil {
-			compiled = append(compiled, r)
+		r, err := regexp.Compile(p)
+		if err != nil {
+			log.Printf("intercept: invalid auto_forward_regex %q: %v", p, err)
+			continue
 		}
+		compiled = append(compiled, r)
 	}
 	b.autoFwdMu.Lock()
 	b.autoFwdRegexes = compiled
@@ -164,12 +172,7 @@ func (b *Broker) SaveEntry(f *proxy.Flow) {
 	if path == "" {
 		path = "/"
 	}
-	if config.Global.History.SkipDuplicates {
 	body := string(r.Body)
-		if dup, _ := d.HasDuplicate(r.Method, r.URL.Host, path, body); dup {
-			return
-		}
-	}
 	pending := db.Entry{
 		Timestamp:  time.Now(),
 		Method:     r.Method,
@@ -189,13 +192,27 @@ func (b *Broker) SaveEntry(f *proxy.Flow) {
 			return
 		}
 	}
-	entry, err := d.InsertEntry(pending)
-	if err == nil {
+	var (
+		entry db.Entry
+		err   error
+	)
+	if config.Global.History.SkipDuplicates {
+		var dup bool
+		entry, dup, err = d.InsertIfNotDuplicate(pending, body)
+		if dup {
+			return
+		}
+	} else {
+		entry, err = d.InsertEntry(pending, body)
+	}
+	if err != nil {
+		log.Printf("intercept: failed to save history entry: %v", err)
+		return
+	}
 	if cb := b.onNewEntry; cb != nil {
 		go cb(entry)
 	}
 }
-}
 
 func (b *Broker) Decide(p *PendingRequest, d Decision) {
 	p.decision <- d

internal/intercept/format.go

@@ -3,9 +3,9 @@ package intercept
 import (
 	"fmt"
 	"net/http"
-	"sort"
 	"strings"
 
+	"github.com/anotherhadi/spilltea/internal/util"
 	"github.com/lqqyt2423/go-mitmproxy/proxy"
 )
 
@@ -14,15 +14,11 @@ func FormatRawRequest(f *proxy.Flow) string {
 	r := f.Request
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "%s %s %s\n", r.Method, r.URL.RequestURI(), r.Proto)
-	keys := make([]string, 0, len(r.Header))
-	for k := range r.Header {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		for _, v := range r.Header[k] {
-			fmt.Fprintf(&sb, "%s: %s\n", k, v)
+	if r.URL.Host != "" {
+		fmt.Fprintf(&sb, "Host: %s\n", r.URL.Host)
 	}
+	for _, line := range util.SortedHeaderLines(r.Header) {
+		sb.WriteString(line)
 	}
 	sb.WriteString("\n")
 	if len(r.Body) > 0 {
@@ -43,15 +39,8 @@ func FormatRawResponse(f *proxy.Flow) string {
 		proto = "HTTP/1.1"
 	}
 	fmt.Fprintf(&sb, "%s %d %s\n", proto, r.StatusCode, http.StatusText(r.StatusCode))
-	keys := make([]string, 0, len(r.Header))
-	for k := range r.Header {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		for _, v := range r.Header[k] {
-			fmt.Fprintf(&sb, "%s: %s\n", k, v)
-		}
+	for _, line := range util.SortedHeaderLines(r.Header) {
+		sb.WriteString(line)
 	}
 	sb.WriteString("\n")
 	if len(r.Body) > 0 {

internal/keys/findings.go

@@ -7,14 +7,18 @@ import (
 
 type FindingsKeyMap struct {
 	Dismiss    key.Binding
+	DismissAll key.Binding
+	Flag       key.Binding
 }
 
 func newFindingsKeyMap(cfg config.FindingsKeys) FindingsKeyMap {
 	return FindingsKeyMap{
 		Dismiss:    binding(cfg.Dismiss, "dismiss"),
+		DismissAll: binding(cfg.DismissAll, "dismiss all"),
+		Flag:       binding(cfg.Flag, "flag"),
 	}
 }
 
 func (f FindingsKeyMap) Bindings() []key.Binding {
-	return []key.Binding{f.Dismiss}
+	return []key.Binding{f.Flag, f.Dismiss, f.DismissAll}
 }

internal/keys/global.go

@@ -22,6 +22,10 @@ type GlobalKeyMap struct {
 	ScrollUp      key.Binding
 	ScrollDown    key.Binding
 	SendToDiff    key.Binding
+	GotoTop       key.Binding
+	GotoBottom    key.Binding
+	PrevPage      key.Binding
+	NextPage      key.Binding
 }
 
 func newGlobalKeyMap(cfg config.GlobalKeys) GlobalKeyMap {
@@ -37,11 +41,15 @@ func newGlobalKeyMap(cfg config.GlobalKeys) GlobalKeyMap {
 		CycleFocus:    binding(cfg.CycleFocus, "cycle focus"),
 		CopyAs:        binding(cfg.CopyAs, "copy as..."),
 		Copy:          binding(cfg.Copy, "copy..."),
-		Escape:        key.NewBinding(key.WithKeys("esc"), key.WithHelp("esc", "cancel")),
+		Escape:        binding(cfg.Escape, "cancel"),
 		SendToReplay:  binding(cfg.SendToReplay, "send to replay"),
 		ScrollUp:      binding(cfg.ScrollUp, "scroll up"),
 		ScrollDown:    binding(cfg.ScrollDown, "scroll down"),
 		SendToDiff:    binding(cfg.SendToDiff, "send to diff"),
+		GotoTop:       binding(cfg.GotoTop, "go to top"),
+		GotoBottom:    binding(cfg.GotoBottom, "go to bottom"),
+		PrevPage:      binding(cfg.PrevPage, "prev page"),
+		NextPage:      binding(cfg.NextPage, "next page"),
 	}
 }
 
@@ -52,6 +60,7 @@ func (g GlobalKeyMap) Bindings() []key.Binding {
 		g.OpenLogs, g.ToggleSidebar, g.CopyAs, g.Copy,
 		g.SendToReplay, g.SendToDiff,
 		g.ScrollUp, g.ScrollDown,
+		g.GotoTop, g.GotoBottom, g.PrevPage, g.NextPage,
 	}
 }
 

internal/keys/history.go

@@ -10,6 +10,7 @@ type HistoryKeyMap struct {
 	DeleteAll   key.Binding
 	Filter      key.Binding
 	SqlQuery    key.Binding
+	Flag        key.Binding
 }
 
 func newHistoryKeyMap(cfg config.HistoryKeys) HistoryKeyMap {
@@ -18,9 +19,10 @@ func newHistoryKeyMap(cfg config.HistoryKeys) HistoryKeyMap {
 		DeleteAll:   binding(cfg.DeleteAll, "delete all"),
 		Filter:      binding(cfg.Filter, "filter"),
 		SqlQuery:    binding(cfg.SqlQuery, "sql query"),
+		Flag:        binding(cfg.Flag, "flag"),
 	}
 }
 
 func (h HistoryKeyMap) Bindings() []key.Binding {
-	return []key.Binding{h.DeleteEntry, h.DeleteAll}
+	return []key.Binding{h.DeleteEntry, h.DeleteAll, h.Flag}
 }

internal/keys/replay.go

@@ -12,6 +12,8 @@ type ReplayKeyMap struct {
 	UndoEdits key.Binding
 	Delete    key.Binding
 	DeleteAll key.Binding
+	Filter    key.Binding
+	Flag      key.Binding
 }
 
 func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
@@ -22,9 +24,11 @@ func newReplayKeyMap(cfg config.ReplayKeys) ReplayKeyMap {
 		UndoEdits: binding(cfg.UndoEdits, "undo edits"),
 		Delete:    binding(cfg.Delete, "delete"),
 		DeleteAll: binding(cfg.DeleteAll, "delete all"),
+		Filter:    binding(cfg.Filter, "filter"),
+		Flag:      binding(cfg.Flag, "flag"),
 	}
 }
 
 func (r ReplayKeyMap) Bindings() []key.Binding {
-	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Delete, r.DeleteAll}
+	return []key.Binding{r.Send, r.Edit, r.EditExt, r.UndoEdits, r.Flag, r.Delete, r.DeleteAll, r.Filter}
 }

internal/plugins/lua.go

@@ -1,17 +1,44 @@
 package plugins
 
 import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
 	"log"
+	"net/http"
+	"net/url"
+	"os/exec"
 	"strings"
 	"time"
 
+	"github.com/anotherhadi/spilltea/internal/config"
 	"github.com/anotherhadi/spilltea/internal/db"
 	goproxy "github.com/lqqyt2423/go-mitmproxy/proxy"
 	lua "github.com/yuin/gopher-lua"
+	"gopkg.in/yaml.v3"
 )
 
 func newLuaState(mgr *Manager, p *Plugin) *lua.LState {
-	L := lua.NewState()
+	L := lua.NewState(lua.Options{SkipOpenLibs: true})
+	for _, lib := range []struct {
+		name string
+		fn   lua.LGFunction
+	}{
+		{lua.BaseLibName, lua.OpenBase},
+		{lua.TabLibName, lua.OpenTable},
+		{lua.StringLibName, lua.OpenString},
+		{lua.MathLibName, lua.OpenMath},
+		{lua.CoroutineLibName, lua.OpenCoroutine},
+	} {
+		L.Push(L.NewFunction(lib.fn))
+		L.Push(lua.LString(lib.name))
+		L.Call(1, 0)
+	}
+	// Remove filesystem-access functions to prevent plugins from reading/executing arbitrary files.
+	for _, name := range []string{"dofile", "loadfile", "load"} {
+		L.SetGlobal(name, lua.LNil)
+	}
 	registerUtilities(L, mgr, p)
 	return L
 }
@@ -19,7 +46,7 @@ func newLuaState(mgr *Manager, p *Plugin) *lua.LState {
 func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 	L.SetGlobal("log", L.NewFunction(func(L *lua.LState) int {
 		msg := L.CheckString(1)
-		log.Printf("[plugin:%s] %s", p.Name, msg)
+		log.Printf("plugin %s: %s", p.Name, msg)
 		return 0
 	}))
 
@@ -58,7 +85,7 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 			CreatedAt:   time.Now(),
 		})
 		if err != nil {
-			log.Printf("[plugin:%s] create_finding error: %v", p.Name, err)
+			log.Printf("plugin %s: create_finding error: %v", p.Name, err)
 			return 0
 		}
 		_ = inserted
@@ -153,6 +180,153 @@ func registerUtilities(L *lua.LState, mgr *Manager, p *Plugin) {
 		}
 		return 0
 	}))
+
+	L.SetGlobal("get_config", L.NewFunction(func(L *lua.LState) int {
+		// p.mu is already held by the hook caller - do not lock again.
+		configText := p.ConfigText
+		if configText == "" {
+			L.Push(L.NewTable())
+			return 1
+		}
+		var data interface{}
+		if err := yaml.Unmarshal([]byte(configText), &data); err != nil || data == nil {
+			L.Push(L.NewTable())
+			return 1
+		}
+		lv := goToLuaValue(L, data)
+		if _, ok := lv.(*lua.LTable); !ok {
+			L.Push(L.NewTable())
+			return 1
+		}
+		L.Push(lv)
+		return 1
+	}))
+
+	L.SetGlobal("send_request", L.NewFunction(func(L *lua.LState) int {
+		method := L.CheckString(1)
+		rawURL := L.CheckString(2)
+		hdrs := L.OptTable(3, L.NewTable())
+		body := L.OptString(4, "")
+		opts := L.OptTable(5, L.NewTable())
+
+		insecure := false
+		if v, ok := L.GetField(opts, "insecure").(lua.LBool); ok {
+			insecure = bool(v)
+		}
+
+		transport := &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},
+		}
+		if up := config.Global.App.UpstreamProxy; up != "" {
+			if proxyURL, err := url.Parse(up); err == nil {
+				transport.Proxy = http.ProxyURL(proxyURL)
+			}
+		}
+		client := &http.Client{
+			Transport: transport,
+			Timeout:   30 * time.Second,
+		}
+
+		var bodyReader io.Reader
+		if body != "" {
+			bodyReader = strings.NewReader(body)
+		}
+		req, err := http.NewRequest(method, rawURL, bodyReader)
+		if err != nil {
+			L.Push(lua.LNil)
+			L.Push(lua.LString(err.Error()))
+			return 2
+		}
+		hdrs.ForEach(func(k, v lua.LValue) {
+			ks, kok := k.(lua.LString)
+			vs, vok := v.(lua.LString)
+			if kok && vok {
+				req.Header.Set(string(ks), string(vs))
+			}
+		})
+
+		resp, err := client.Do(req)
+		if err != nil {
+			L.Push(lua.LNil)
+			L.Push(lua.LString(err.Error()))
+			return 2
+		}
+		defer resp.Body.Close()
+
+		respBody, err := io.ReadAll(resp.Body)
+		if err != nil {
+			L.Push(lua.LNil)
+			L.Push(lua.LString(err.Error()))
+			return 2
+		}
+
+		result := L.NewTable()
+		L.SetField(result, "status_code", lua.LNumber(resp.StatusCode))
+		L.SetField(result, "body", lua.LString(string(respBody)))
+		respHeaders := L.NewTable()
+		for k, vals := range resp.Header {
+			L.SetField(respHeaders, k, lua.LString(strings.Join(vals, ", ")))
+		}
+		L.SetField(result, "headers", respHeaders)
+
+		L.Push(result)
+		L.Push(lua.LNil)
+		return 2
+	}))
+
+	L.SetGlobal("shell_pipe", L.NewFunction(func(L *lua.LState) int {
+		cmd := L.CheckString(1)
+		input := L.OptString(2, "")
+
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		c := exec.CommandContext(ctx, "sh", "-c", cmd) // #nosec G204 -- intentional: shell_pipe is a Lua plugin API for user-written scripts
+		c.Stdin = strings.NewReader(input)
+
+		var stdout, stderr bytes.Buffer
+		c.Stdout = &stdout
+		c.Stderr = &stderr
+
+		err := c.Run()
+		if err != nil {
+			L.Push(lua.LString(stdout.String()))
+			L.Push(lua.LString(err.Error() + ": " + stderr.String()))
+			return 2
+		}
+		L.Push(lua.LString(stdout.String()))
+		L.Push(lua.LNil)
+		return 2
+	}))
+}
+
+func goToLuaValue(L *lua.LState, v interface{}) lua.LValue {
+	switch val := v.(type) {
+	case map[string]interface{}:
+		t := L.NewTable()
+		for k, v2 := range val {
+			L.SetField(t, k, goToLuaValue(L, v2))
+		}
+		return t
+	case []interface{}:
+		t := L.NewTable()
+		for i, v2 := range val {
+			L.RawSetInt(t, i+1, goToLuaValue(L, v2))
+		}
+		return t
+	case string:
+		return lua.LString(val)
+	case int:
+		return lua.LNumber(val)
+	case float64:
+		return lua.LNumber(val)
+	case bool:
+		if val {
+			return lua.LTrue
+		}
+		return lua.LFalse
+	}
+	return lua.LNil
 }
 
 func luaTableString(t *lua.LTable, key string) string {
@@ -163,7 +337,7 @@ func luaTableString(t *lua.LTable, key string) string {
 	return ""
 }
 
-func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
+func pushRequest(L *lua.LState, p *Plugin, f *goproxy.Flow) *lua.LTable {
 	t := L.NewTable()
 	r := f.Request
 	L.SetField(t, "method", lua.LString(r.Method))
@@ -195,6 +369,21 @@ func pushRequest(L *lua.LState, f *goproxy.Flow) *lua.LTable {
 		return 0
 	}))
 
+	L.SetField(t, "set_path", L.NewFunction(func(L *lua.LState) int {
+		r.URL.Path = L.CheckString(2)
+		return 0
+	}))
+
+	L.SetField(t, "set_url", L.NewFunction(func(L *lua.LState) int {
+		parsed, err := url.Parse(L.CheckString(2))
+		if err != nil {
+			log.Printf("plugin %s: set_url: %v", p.Name, err)
+			return 0
+		}
+		r.URL = parsed
+		return 0
+	}))
+
 	return t
 }
 
@@ -246,22 +435,19 @@ func pushEntry(L *lua.LState, e db.Entry) *lua.LTable {
 	return t
 }
 
-func callHook(p *Plugin, hookName string, args ...lua.LValue) (string, error) {
+func callHook(p *Plugin, hookName string, args ...lua.LValue) (lua.LValue, error) {
 	fn := p.L.GetGlobal(hookName)
 	if fn == lua.LNil {
-		return "", nil
+		return lua.LNil, nil
 	}
 	if err := p.L.CallByParam(lua.P{
 		Fn:      fn,
 		NRet:    1,
 		Protect: true,
 	}, args...); err != nil {
-		return "", err
+		return lua.LNil, err
 	}
 	ret := p.L.Get(-1)
 	p.L.Pop(1)
-	if s, ok := ret.(lua.LString); ok {
-		return string(s), nil
-	}
-	return "", nil
+	return ret, nil
 }

internal/plugins/manager.go

@@ -13,14 +13,23 @@ import (
 	"github.com/anotherhadi/spilltea/internal/intercept"
 	goproxy "github.com/lqqyt2423/go-mitmproxy/proxy"
 	lua "github.com/yuin/gopher-lua"
+	"gopkg.in/yaml.v3"
 )
 
+// GlobalDefault holds global defaults for a single plugin, read from config.yaml.
+type GlobalDefault struct {
+	Enable *bool
+	Config interface{}
+}
+
 type Manager struct {
 	mu      sync.RWMutex
 	plugins []*Plugin
 
 	db             *db.DB
+	pluginsFile    *PluginsFile
 	broker         *intercept.Broker
+	globalDefaults map[string]GlobalDefault
 
 	Notifs chan PluginNotifMsg
 	Quit   chan string
@@ -43,6 +52,14 @@ func (m *Manager) SetDB(d *db.DB) {
 	m.db = d
 }
 
+func (m *Manager) SetPluginsFile(pf *PluginsFile) {
+	m.pluginsFile = pf
+}
+
+func (m *Manager) SetGlobalDefaults(defaults map[string]GlobalDefault) {
+	m.globalDefaults = defaults
+}
+
 func (m *Manager) LoadFromDir(dir string) error {
 	entries, err := os.ReadDir(dir)
 	if os.IsNotExist(err) {
@@ -52,17 +69,6 @@ func (m *Manager) LoadFromDir(dir string) error {
 		return err
 	}
 
-	var states map[string]db.PluginState
-	if m.db != nil {
-		list, err := m.db.LoadPluginStates()
-		if err == nil {
-			states = make(map[string]db.PluginState, len(list))
-			for _, s := range list {
-				states[s.Name] = s
-			}
-		}
-	}
-
 	for _, e := range entries {
 		if e.IsDir() || !strings.HasSuffix(e.Name(), ".lua") {
 			continue
@@ -73,19 +79,37 @@ func (m *Manager) LoadFromDir(dir string) error {
 			log.Printf("plugin load error %s: %v", path, err)
 			continue
 		}
-		if s, ok := states[p.Name]; ok {
-			p.Enabled = s.Enabled
-			p.ConfigText = s.ConfigText
+		if m.pluginsFile != nil {
+			if enabled, configText, found := m.pluginsFile.get(p.ID); found {
+				p.Enabled = enabled
+				p.ConfigText = configText
+			} else {
+				if def, ok := m.globalDefaults[p.ID]; ok {
+					if def.Enable != nil {
+						p.Enabled = *def.Enable
+					}
+					if def.Config != nil {
+						if raw, err := yaml.Marshal(def.Config); err == nil {
+							p.ConfigText = string(raw)
+						}
+					}
+				}
+				m.pluginsFile.register(p.ID, p.Enabled, p.ConfigText)
+			}
 		}
 		m.mu.Lock()
 		m.plugins = append(m.plugins, p)
 		m.mu.Unlock()
 	}
+	m.mu.Lock()
+	sort.Slice(m.plugins, func(i, j int) bool { return m.plugins[i].Priority > m.plugins[j].Priority })
+	m.mu.Unlock()
 	return nil
 }
 
 func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 	p := &Plugin{
+		ID:       strings.TrimSuffix(filepath.Base(path), ".lua"),
 		FilePath: path,
 		Enabled:  true,
 		hooks:    make(map[string]HookConfig),
@@ -106,7 +130,7 @@ func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 		p.Name = string(s)
 	}
 	if p.Name == "" {
-		p.Name = strings.TrimSuffix(filepath.Base(path), ".lua")
+		p.Name = p.ID
 	}
 
 	if s, ok := pluginTable.RawGetString("description").(lua.LString); ok {
@@ -117,6 +141,10 @@ func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 		p.Priority = int(n)
 	}
 
+	if pluginTable.RawGetString("disable_by_default") == lua.LTrue {
+		p.Enabled = false
+	}
+
 	// Hooks configurable via the Plugin table (sync field).
 	configurableHooks := map[string]bool{
 		"on_start":         false, // async by default
@@ -124,12 +152,6 @@ func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 		"on_response":      false,
 		"on_history_entry": false,
 	}
-	// Fixed-sync hooks: always sync, not configurable.
-	fixedSyncHooks := map[string]struct{}{
-		"on_config": {},
-		"on_quit":   {},
-	}
-
 	for hookName, defaultSync := range configurableHooks {
 		if tbl, ok := pluginTable.RawGetString(hookName).(*lua.LTable); ok {
 			p.hooks[hookName] = HookConfig{Sync: tbl.RawGetString("sync") == lua.LTrue}
@@ -139,9 +161,9 @@ func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 			p.hooks[hookName] = HookConfig{Sync: defaultSync}
 		}
 	}
-	for hookName := range fixedSyncHooks {
-		if p.L.GetGlobal(hookName) != lua.LNil {
-			p.hooks[hookName] = HookConfig{Sync: true}
+	for _, fixedSync := range []string{"on_config", "on_quit"} {
+		if p.L.GetGlobal(fixedSync) != lua.LNil {
+			p.hooks[fixedSync] = HookConfig{Sync: true}
 		}
 	}
 
@@ -153,15 +175,14 @@ func (m *Manager) GetPlugins() []*Plugin {
 	defer m.mu.RUnlock()
 	out := make([]*Plugin, len(m.plugins))
 	copy(out, m.plugins)
-	sort.Slice(out, func(i, j int) bool { return out[i].Priority > out[j].Priority })
 	return out
 }
 
-func (m *Manager) TogglePlugin(name string) {
+func (m *Manager) TogglePlugin(id string) {
 	m.mu.RLock()
 	var found *Plugin
 	for _, p := range m.plugins {
-		if p.Name == name {
+		if p.ID == id {
 			found = p
 			break
 		}
@@ -173,18 +194,57 @@ func (m *Manager) TogglePlugin(name string) {
 	found.mu.Lock()
 	found.Enabled = !found.Enabled
 	enabled := found.Enabled
-	configText := found.ConfigText
 	found.mu.Unlock()
-	if m.db != nil {
-		_ = m.db.SavePluginState(name, enabled, configText)
+	if m.pluginsFile != nil {
+		if err := m.pluginsFile.setEnabled(id, enabled); err != nil {
+			log.Printf("plugin %s: save state: %v", id, err)
+		}
+	}
+	if !enabled {
+		return
+	}
+	hc, ok := found.hooks["on_start"]
+	if !ok {
+		return
+	}
+	disableIfFalse := func(p *Plugin, ret lua.LValue) {
+		if ret == lua.LFalse {
+			p.Enabled = false
+			if m.pluginsFile != nil {
+				if err := m.pluginsFile.setEnabled(p.ID, false); err != nil {
+					log.Printf("plugin %s: save state: %v", p.ID, err)
+				}
+			}
+		}
+	}
+	if hc.Sync {
+		found.mu.Lock()
+		ret, err := callHook(found, "on_start")
+		if err != nil {
+			log.Printf("plugin %s on_start: %v", found.Name, err)
+		} else {
+			disableIfFalse(found, ret)
+		}
+		found.mu.Unlock()
+	} else {
+		go func() {
+			found.mu.Lock()
+			ret, err := callHook(found, "on_start")
+			if err != nil {
+				log.Printf("plugin %s on_start: %v", found.Name, err)
+			} else {
+				disableIfFalse(found, ret)
+			}
+			found.mu.Unlock()
+		}()
 	}
 }
 
-func (m *Manager) SaveConfig(name, configText string) {
+func (m *Manager) SaveConfig(id, configText string) {
 	m.mu.RLock()
 	var found *Plugin
 	for _, p := range m.plugins {
-		if p.Name == name {
+		if p.ID == id {
 			found = p
 			break
 		}
@@ -195,39 +255,35 @@ func (m *Manager) SaveConfig(name, configText string) {
 	}
 	found.mu.Lock()
 	found.ConfigText = configText
-	enabled := found.Enabled
-	_, hasOnConfig := found.hooks["on_config"]
 	found.mu.Unlock()
-	if m.db != nil {
-		_ = m.db.SavePluginState(name, enabled, configText)
+	if m.pluginsFile != nil {
+		if err := m.pluginsFile.setConfig(id, configText); err != nil {
+			log.Printf("plugin %s: save config: %v", id, err)
 		}
-	if !hasOnConfig {
+	}
+	if _, ok := found.hooks["on_config"]; !ok {
 		return
 	}
-	// on_config is always sync.
 	found.mu.Lock()
-	if _, err := callHook(found, "on_config", lua.LString(configText)); err != nil {
-		log.Printf("plugin %s on_config (config reload): %v", name, err)
+	if _, err := callHook(found, "on_config"); err != nil {
+		log.Printf("plugin %s on_config: %v", id, err)
 	}
 	found.mu.Unlock()
 }
 
 func (m *Manager) RunOnStart() {
-	// on_config runs first, always sync, for every enabled plugin that has it.
 	for _, p := range m.GetPlugins() {
 		if !p.Enabled {
 			continue
 		}
-		if _, ok := p.hooks["on_config"]; !ok {
-			continue
-		}
+		if _, ok := p.hooks["on_config"]; ok {
 			p.mu.Lock()
-		if _, err := callHook(p, "on_config", lua.LString(p.ConfigText)); err != nil {
+			if _, err := callHook(p, "on_config"); err != nil {
 				log.Printf("plugin %s on_config: %v", p.Name, err)
 			}
 			p.mu.Unlock()
 		}
-	// on_start runs after, sync or async depending on plugin config.
+	}
 	for _, p := range m.GetPlugins() {
 		if !p.Enabled {
 			continue
@@ -236,17 +292,33 @@ func (m *Manager) RunOnStart() {
 		if !ok {
 			continue
 		}
+		disableIfFalse := func(p *Plugin, ret lua.LValue) {
+			if ret == lua.LFalse {
+				p.Enabled = false
+				if m.pluginsFile != nil {
+					if err := m.pluginsFile.setEnabled(p.ID, false); err != nil {
+						log.Printf("plugin %s: save state: %v", p.ID, err)
+					}
+				}
+			}
+		}
 		if hc.Sync {
 			p.mu.Lock()
-			if _, err := callHook(p, "on_start"); err != nil {
+			ret, err := callHook(p, "on_start")
+			if err != nil {
 				log.Printf("plugin %s on_start: %v", p.Name, err)
+			} else {
+				disableIfFalse(p, ret)
 			}
 			p.mu.Unlock()
 		} else {
 			go func(p *Plugin) {
 				p.mu.Lock()
-				if _, err := callHook(p, "on_start"); err != nil {
+				ret, err := callHook(p, "on_start")
+				if err != nil {
 					log.Printf("plugin %s on_start: %v", p.Name, err)
+				} else {
+					disableIfFalse(p, ret)
 				}
 				p.mu.Unlock()
 			}(p)
@@ -270,94 +342,79 @@ func (m *Manager) RunOnQuit() {
 	}
 }
 
-func (m *Manager) RunSyncOnRequest(f *goproxy.Flow) intercept.Decision {
+// runSyncDecisionForPlugins runs hookName synchronously for all enabled plugins
+// that registered it as sync, and returns the first non-Intercept decision.
+func (m *Manager) runSyncDecisionForPlugins(hookName string, argsFor func(*Plugin) []lua.LValue) intercept.Decision {
 	for _, p := range m.GetPlugins() {
 		if !p.Enabled {
 			continue
 		}
-		hc, ok := p.hooks["on_request"]
+		hc, ok := p.hooks[hookName]
 		if !ok || !hc.Sync {
 			continue
 		}
 		p.mu.Lock()
-		result, err := callHook(p, "on_request", pushRequest(p.L, f))
+		result, err := callHook(p, hookName, argsFor(p)...)
 		p.mu.Unlock()
 		if err != nil {
-			log.Printf("plugin %s on_request: %v", p.Name, err)
+			log.Printf("plugin %s %s: %v", p.Name, hookName, err)
 			continue
 		}
-		switch result {
+		if s, ok := result.(lua.LString); ok {
+			switch string(s) {
 			case "drop":
 				return intercept.Drop
 			case "forward":
 				return intercept.Forward
 			}
 		}
+	}
 	return intercept.Intercept
 }
 
+// runAsyncForPlugins fires hookName asynchronously for all enabled plugins
+// that registered it as async.
+func (m *Manager) runAsyncForPlugins(hookName string, argsFor func(*Plugin) []lua.LValue) {
+	for _, p := range m.GetPlugins() {
+		if !p.Enabled {
+			continue
+		}
+		hc, ok := p.hooks[hookName]
+		if !ok || hc.Sync {
+			continue
+		}
+		go func(p *Plugin) {
+			p.mu.Lock()
+			if _, err := callHook(p, hookName, argsFor(p)...); err != nil {
+				log.Printf("plugin %s %s: %v", p.Name, hookName, err)
+			}
+			p.mu.Unlock()
+		}(p)
+	}
+}
+
+func (m *Manager) RunSyncOnRequest(f *goproxy.Flow) intercept.Decision {
+	return m.runSyncDecisionForPlugins("on_request", func(p *Plugin) []lua.LValue {
+		return []lua.LValue{pushRequest(p.L, p, f)}
+	})
+}
+
 func (m *Manager) RunAsyncOnRequest(f *goproxy.Flow) {
-	for _, p := range m.GetPlugins() {
-		if !p.Enabled {
-			continue
-		}
-		hc, ok := p.hooks["on_request"]
-		if !ok || hc.Sync {
-			continue
-		}
-		go func(p *Plugin) {
-			p.mu.Lock()
-			if _, err := callHook(p, "on_request", pushRequest(p.L, f)); err != nil {
-				log.Printf("plugin %s on_request: %v", p.Name, err)
-			}
-			p.mu.Unlock()
-		}(p)
-	}
+	m.runAsyncForPlugins("on_request", func(p *Plugin) []lua.LValue {
+		return []lua.LValue{pushRequest(p.L, p, f)}
+	})
 }
 
 func (m *Manager) RunSyncOnResponse(f *goproxy.Flow) intercept.Decision {
-	for _, p := range m.GetPlugins() {
-		if !p.Enabled {
-			continue
-		}
-		hc, ok := p.hooks["on_response"]
-		if !ok || !hc.Sync {
-			continue
-		}
-		p.mu.Lock()
-		result, err := callHook(p, "on_response", pushRequest(p.L, f), pushResponse(p.L, f))
-		p.mu.Unlock()
-		if err != nil {
-			log.Printf("plugin %s on_response: %v", p.Name, err)
-			continue
-		}
-		switch result {
-		case "drop":
-			return intercept.Drop
-		case "forward":
-			return intercept.Forward
-		}
-	}
-	return intercept.Intercept
+	return m.runSyncDecisionForPlugins("on_response", func(p *Plugin) []lua.LValue {
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
+	})
 }
 
 func (m *Manager) RunAsyncOnResponse(f *goproxy.Flow) {
-	for _, p := range m.GetPlugins() {
-		if !p.Enabled {
-			continue
-		}
-		hc, ok := p.hooks["on_response"]
-		if !ok || hc.Sync {
-			continue
-		}
-		go func(p *Plugin) {
-			p.mu.Lock()
-			if _, err := callHook(p, "on_response", pushRequest(p.L, f), pushResponse(p.L, f)); err != nil {
-				log.Printf("plugin %s on_response: %v", p.Name, err)
-			}
-			p.mu.Unlock()
-		}(p)
-	}
+	m.runAsyncForPlugins("on_response", func(p *Plugin) []lua.LValue {
+		return []lua.LValue{pushRequest(p.L, p, f), pushResponse(p.L, f)}
+	})
 }
 
 // RunSyncOnHistoryEntry is called before DB insert; returns false to skip saving.
@@ -377,7 +434,7 @@ func (m *Manager) RunSyncOnHistoryEntry(e db.Entry) bool {
 			log.Printf("plugin %s on_history_entry: %v", p.Name, err)
 			continue
 		}
-		if result == "skip" {
+		if s, ok := result.(lua.LString); ok && string(s) == "skip" {
 			return false
 		}
 	}
@@ -385,20 +442,7 @@ func (m *Manager) RunSyncOnHistoryEntry(e db.Entry) bool {
 }
 
 func (m *Manager) RunAsyncOnHistoryEntry(e db.Entry) {
-	for _, p := range m.GetPlugins() {
-		if !p.Enabled {
-			continue
-		}
-		hc, ok := p.hooks["on_history_entry"]
-		if !ok || hc.Sync {
-			continue
-		}
-		go func(p *Plugin) {
-			p.mu.Lock()
-			if _, err := callHook(p, "on_history_entry", pushEntry(p.L, e)); err != nil {
-				log.Printf("plugin %s on_history_entry: %v", p.Name, err)
-			}
-			p.mu.Unlock()
-		}(p)
-	}
+	m.runAsyncForPlugins("on_history_entry", func(p *Plugin) []lua.LValue {
+		return []lua.LValue{pushEntry(p.L, e)}
+	})
 }

internal/plugins/pluginsfile.go

@@ -0,0 +1,106 @@
+package plugins
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+
+	"gopkg.in/yaml.v3"
+)
+
+type pluginFileEntry struct {
+	Enable bool        `yaml:"enable"`
+	Config interface{} `yaml:"config,omitempty"`
+}
+
+type pluginsFileData struct {
+	Plugins map[string]pluginFileEntry `yaml:"plugins"`
+}
+
+type PluginsFile struct {
+	path string
+	data pluginsFileData
+}
+
+func OpenPluginsFile(dbPath string) (*PluginsFile, error) {
+	path := filepath.Join(filepath.Dir(dbPath), "plugins.yaml")
+	pf := &PluginsFile{
+		path: path,
+		data: pluginsFileData{Plugins: make(map[string]pluginFileEntry)},
+	}
+	raw, err := os.ReadFile(path) // #nosec G304 -- path is filepath.Join(dbDir, "plugins.yaml"), hardcoded filename
+	if os.IsNotExist(err) {
+		return pf, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := yaml.Unmarshal(raw, &pf.data); err != nil {
+		return nil, err
+	}
+	if pf.data.Plugins == nil {
+		pf.data.Plugins = make(map[string]pluginFileEntry)
+	}
+	return pf, nil
+}
+
+func (pf *PluginsFile) save() error {
+	raw, err := yaml.Marshal(&pf.data)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(pf.path, raw, 0o600)
+}
+
+func (pf *PluginsFile) get(id string) (enabled bool, config string, found bool) {
+	e, ok := pf.data.Plugins[id]
+	if !ok {
+		return false, "", false
+	}
+	if e.Config == nil {
+		return e.Enable, "", true
+	}
+	raw, err := yaml.Marshal(e.Config)
+	if err != nil {
+		return e.Enable, "", true
+	}
+	return e.Enable, string(raw), true
+}
+
+func (pf *PluginsFile) register(id string, defaultEnabled bool, configText string) {
+	if _, ok := pf.data.Plugins[id]; !ok {
+		entry := pluginFileEntry{Enable: defaultEnabled}
+		if configText != "" {
+			var parsed interface{}
+			if err := yaml.Unmarshal([]byte(configText), &parsed); err == nil {
+				entry.Config = parsed
+			}
+		}
+		pf.data.Plugins[id] = entry
+		if err := pf.save(); err != nil {
+			log.Printf("plugin %s: register save: %v", id, err)
+		}
+	}
+}
+
+func (pf *PluginsFile) setEnabled(id string, enabled bool) error {
+	e := pf.data.Plugins[id]
+	e.Enable = enabled
+	pf.data.Plugins[id] = e
+	return pf.save()
+}
+
+func (pf *PluginsFile) setConfig(id string, configText string) error {
+	e := pf.data.Plugins[id]
+	if configText == "" {
+		e.Config = nil
+	} else {
+		var parsed interface{}
+		if err := yaml.Unmarshal([]byte(configText), &parsed); err != nil {
+			return err
+		}
+		e.Config = parsed
+	}
+	pf.data.Plugins[id] = e
+	return pf.save()
+}

internal/plugins/types.go

@@ -11,6 +11,7 @@ type HookConfig struct {
 }
 
 type Plugin struct {
+	ID          string
 	Name        string
 	Description string
 	FilePath    string
@@ -37,6 +38,7 @@ func (p *Plugin) HookConfig(name string) (HookConfig, bool) {
 }
 
 type Info struct {
+	ID          string
 	Name        string
 	Description string
 	FilePath    string
@@ -57,6 +59,7 @@ func (p *Plugin) Info() Info {
 		hooks[k] = v
 	}
 	return Info{
+		ID:          p.ID,
 		Name:        p.Name,
 		Description: p.Description,
 		FilePath:    p.FilePath,

internal/proxy/proxy.go

@@ -1,10 +1,14 @@
 package proxy
 
 import (
+	"crypto/subtle"
+	"encoding/base64"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
 	"os"
+	"strings"
 
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/config"
@@ -43,7 +47,6 @@ func (a *interceptAddon) Request(f *goproxy.Flow) {
 		switch a.plugins.RunSyncOnRequest(f) {
 		case intercept.Drop:
 			f.Response = dropResponse()
-			go a.plugins.RunAsyncOnRequest(f)
 			return
 		case intercept.Forward:
 			go a.plugins.RunAsyncOnRequest(f)
@@ -63,7 +66,15 @@ func (a *interceptAddon) Request(f *goproxy.Flow) {
 func (a *interceptAddon) Response(f *goproxy.Flow) {
 	if f.Response != nil {
 		if len(f.Response.Body) == 0 && f.Response.BodyReader != nil {
-			body, _ := io.ReadAll(f.Response.BodyReader)
+			limit := int64(config.Global.App.MaxBodySizeMB) * 1024 * 1024
+			body, err := io.ReadAll(io.LimitReader(f.Response.BodyReader, limit))
+			if err != nil {
+				log.Printf("proxy: reading response body: %v", err)
+			}
+			if int64(len(body)) == limit {
+				log.Printf("proxy: response body truncated at %dMB for %s", config.Global.App.MaxBodySizeMB, f.Request.URL.Host)
+				body = append(body, []byte(fmt.Sprintf("\n\n[body truncated at %dMB]", config.Global.App.MaxBodySizeMB))...)
+			}
 			f.Response.Body = body
 			f.Response.BodyReader = nil
 		}
@@ -106,9 +117,10 @@ func Start(broker *intercept.Broker, mgr *plugins.Manager) error {
 
 	opts := &goproxy.Options{
 		Addr:              addr,
-		StreamLargeBodies: 1024 * 1024 * 5,
+		StreamLargeBodies: int64(cfg.MaxBodySizeMB) * 1024 * 1024,
 		CaRootPath:        caPath,
 		Upstream:          cfg.UpstreamProxy,
+		SslInsecure:       cfg.SslInsecure,
 	}
 
 	p, err := goproxy.NewProxy(opts)
@@ -116,10 +128,43 @@ func Start(broker *intercept.Broker, mgr *plugins.Manager) error {
 		return err
 	}
 
+	if cfg.ProxyAuth != "" {
+		parts := strings.SplitN(cfg.ProxyAuth, ":", 2)
+		if len(parts) == 2 {
+			wantUser, wantPass := parts[0], parts[1]
+			p.SetAuthProxy(func(res http.ResponseWriter, req *http.Request) (bool, error) {
+				user, pass, ok := parseBasicProxyAuth(req.Header.Get("Proxy-Authorization"))
+				userOK := subtle.ConstantTimeCompare([]byte(user), []byte(wantUser))
+				passOK := subtle.ConstantTimeCompare([]byte(pass), []byte(wantPass))
+				if !ok || userOK&passOK != 1 {
+					res.Header().Set("Proxy-Authenticate", `Basic realm="spilltea"`)
+					return false, fmt.Errorf("invalid credentials")
+				}
+				return true, nil
+			})
+		}
+	}
+
 	p.AddAddon(&interceptAddon{broker: broker, plugins: mgr})
 	return p.Start()
 }
 
+func parseBasicProxyAuth(header string) (user, pass string, ok bool) {
+	const prefix = "Basic "
+	if !strings.HasPrefix(header, prefix) {
+		return "", "", false
+	}
+	decoded, err := base64.StdEncoding.DecodeString(header[len(prefix):])
+	if err != nil {
+		return "", "", false
+	}
+	parts := strings.SplitN(string(decoded), ":", 2)
+	if len(parts) != 2 {
+		return "", "", false
+	}
+	return parts[0], parts[1], true
+}
+
 func dropResponse() *goproxy.Response {
 	return &goproxy.Response{
 		StatusCode: 502,

internal/style/border.go

@@ -1,43 +0,0 @@
-package style
-
-import (
-	"strings"
-
-	"charm.land/lipgloss/v2"
-)
-
-// PanelContentH returns the usable inner content height for a panel rendered by
-// RenderWithTitle. It subtracts the two border lines (top + bottom) from the
-// total panel height.
-func PanelContentH(totalH int) int {
-	h := totalH - 2
-	if h < 0 {
-		return 0
-	}
-	return h
-}
-
-// RenderWithTitle renders a lipgloss bordered box with a title embedded in the
-// top border, matching the border's own foreground color. height is the total
-// desired output height (including both border lines).
-func RenderWithTitle(border lipgloss.Style, title, content string, width, height int) string {
-	boxH := height - 1
-	if contentH := boxH - 1; contentH > 0 {
-		lines := strings.Split(content, "\n")
-		if len(lines) > contentH {
-			content = strings.Join(lines[:contentH], "\n")
-		}
-	}
-	box := border.BorderTop(false).Width(width).Height(boxH).Render(content)
-
-	boxWidth := lipgloss.Width(strings.SplitN(box, "\n", 2)[0])
-	label := " " + title + " "
-	fillW := boxWidth - lipgloss.Width(label) - 2
-	if fillW < 0 {
-		fillW = 0
-	}
-	bc := lipgloss.NewStyle().Foreground(border.GetBorderTopForeground())
-	topLine := bc.Render("╭ ") + bc.Render(title) + bc.Render(" "+strings.Repeat("─", fillW)+"╮")
-
-	return lipgloss.JoinVertical(lipgloss.Left, topLine, box)
-}

internal/style/components.go

@@ -1,89 +1,36 @@
 package style
 
 import (
-	"strings"
-
-	"charm.land/bubbles/v2/paginator"
-	"charm.land/bubbles/v2/textarea"
-	"charm.land/bubbles/v2/viewport"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
-func NewViewport() viewport.Model {
-	vp := viewport.New()
-	vp.MouseWheelEnabled = false
-	return vp
-}
-
-func NewPaginator() paginator.Model {
-	p := paginator.New()
-	p.Type = paginator.Dots
-	p.ActiveDot = S.PagerDotActive
-	p.InactiveDot = S.PagerDotInactive
-	return p
-}
-
-func NewTextarea(showLineNumbers bool) textarea.Model {
-	ta := textarea.New()
-	ta.Prompt = ""
-	ta.ShowLineNumbers = showLineNumbers
-	ta.CharLimit = 0
-	ta.EndOfBufferCharacter = '~'
-	ts := ta.Styles()
-	ts.Focused.Base = lipgloss.NewStyle()
-	ts.Blurred.Base = lipgloss.NewStyle()
-	ts.Focused.Text = lipgloss.NewStyle().Foreground(S.Text)
-	ts.Focused.CursorLine = lipgloss.NewStyle().Background(S.Selection).Foreground(S.Text)
-	ts.Focused.CursorLineNumber = lipgloss.NewStyle().Background(S.Selection).Foreground(S.Primary).Bold(true)
-	ts.Focused.LineNumber = lipgloss.NewStyle().Foreground(S.Subtle)
-	ts.Focused.Placeholder = lipgloss.NewStyle().Foreground(S.Subtle)
-	ts.Focused.EndOfBuffer = lipgloss.NewStyle().Foreground(S.SubtleBg)
-	ts.Blurred.Text = lipgloss.NewStyle().Foreground(S.MutedFg)
-	ts.Blurred.LineNumber = lipgloss.NewStyle().Foreground(S.SubtleBg)
-	ts.Blurred.Placeholder = lipgloss.NewStyle().Foreground(S.Subtle)
-	ts.Blurred.EndOfBuffer = lipgloss.NewStyle().Foreground(S.SubtleBg)
-	ta.SetStyles(ts)
-	return ta
-}
-
-// SeverityStyle returns a bold lipgloss style coloured by finding severity level.
 func SeverityStyle(sev string) lipgloss.Style {
 	base := lipgloss.NewStyle().Bold(true)
 	switch sev {
 	case "critical":
-		return base.Foreground(S.Error)
+		return base.Foreground(ilovetui.S.Error)
 	case "high":
-		return base.Foreground(S.Warning)
+		return base.Foreground(ilovetui.S.Warning)
 	case "medium":
-		return base.Foreground(S.Primary)
+		return base.Foreground(ilovetui.S.Primary)
 	case "low":
-		return base.Foreground(S.Success)
+		return base.Foreground(ilovetui.S.Success)
 	default:
-		return base.Foreground(S.Subtle)
+		return base.Foreground(ilovetui.S.Subtle)
 	}
 }
 
-// StatusStyle returns a bold lipgloss style coloured by HTTP status code.
 func StatusStyle(code, width int) lipgloss.Style {
 	base := lipgloss.NewStyle().Bold(true).Width(width)
 	switch {
 	case code >= 500:
-		return base.Foreground(S.Error)
+		return base.Foreground(ilovetui.S.Error)
 	case code >= 400:
-		return base.Foreground(S.Warning)
+		return base.Foreground(ilovetui.S.Warning)
 	case code >= 300:
-		return base.Foreground(S.Primary)
+		return base.Foreground(ilovetui.S.Primary)
 	default:
-		return base.Foreground(S.Success)
+		return base.Foreground(ilovetui.S.Success)
 	}
 }
-
-// SplitH splits totalHeight into top and bottom sections, accounting for the
-// status bar height.
-func SplitH(totalHeight int, statusBar string, ratio float64) (top, bottom int) {
-	statusH := strings.Count(statusBar, "\n") + 1
-	available := totalHeight - statusH
-	top = int(float64(available) * ratio)
-	bottom = available - top
-	return
-}

internal/style/glamour.go

@@ -1,236 +0,0 @@
-package style
-
-import (
-	"github.com/anotherhadi/spilltea/internal/config"
-
-	"charm.land/glamour/v2/ansi"
-)
-
-func GlamourStyleConfig(cfg *config.Config) ansi.StyleConfig {
-	c := cfg.TUI.Colors
-
-	str := func(s string) *string { return &s }
-	hex := func(base string) *string { return str("#" + base) }
-	boolPtr := func(b bool) *bool { return &b }
-	uintPtr := func(u uint) *uint { return &u }
-
-	return ansi.StyleConfig{
-		Document: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				BlockPrefix: "\n",
-				BlockSuffix: "\n",
-				Color:       hex(c.Base05),
-			},
-			Margin: uintPtr(2),
-		},
-		BlockQuote: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Color:  hex(c.Base03),
-				Italic: boolPtr(true),
-			},
-			Indent:      uintPtr(1),
-			IndentToken: str("│ "),
-		},
-		List: ansi.StyleList{
-			LevelIndent: 2,
-		},
-		Heading: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				BlockSuffix: "\n",
-				Color:       hex(c.Base0D),
-				Bold:        boolPtr(true),
-			},
-		},
-		H1: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix:          " ",
-				Suffix:          " ",
-				Color:           hex(c.Base07),
-				BackgroundColor: hex(c.Base0D),
-				Bold:            boolPtr(true),
-			},
-		},
-		H2: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix: "## ",
-				Color:  hex(c.Base0D),
-				Bold:   boolPtr(true),
-			},
-		},
-		H3: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix: "### ",
-				Color:  hex(c.Base0C),
-			},
-		},
-		H4: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix: "#### ",
-				Color:  hex(c.Base0B),
-			},
-		},
-		H5: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix: "##### ",
-				Color:  hex(c.Base09),
-			},
-		},
-		H6: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix: "###### ",
-				Color:  hex(c.Base08),
-				Bold:   boolPtr(false),
-			},
-		},
-		Strikethrough: ansi.StylePrimitive{
-			CrossedOut: boolPtr(true),
-		},
-		Emph: ansi.StylePrimitive{
-			Italic: boolPtr(true),
-		},
-		Strong: ansi.StylePrimitive{
-			Bold: boolPtr(true),
-		},
-		HorizontalRule: ansi.StylePrimitive{
-			Color:  hex(c.Base03),
-			Format: "\n--------\n",
-		},
-		Item: ansi.StylePrimitive{
-			BlockPrefix: "• ",
-		},
-		Enumeration: ansi.StylePrimitive{
-			BlockPrefix: ". ",
-		},
-		Task: ansi.StyleTask{
-			Ticked:   "[✓] ",
-			Unticked: "[ ] ",
-		},
-		Link: ansi.StylePrimitive{
-			Color:     hex(c.Base0C),
-			Underline: boolPtr(true),
-		},
-		LinkText: ansi.StylePrimitive{
-			Color: hex(c.Base0D),
-			Bold:  boolPtr(true),
-		},
-		Image: ansi.StylePrimitive{
-			Color:     hex(c.Base0C),
-			Underline: boolPtr(true),
-		},
-		ImageText: ansi.StylePrimitive{
-			Color:  hex(c.Base04),
-			Format: "Image: {{.text}} ->",
-		},
-		Code: ansi.StyleBlock{
-			StylePrimitive: ansi.StylePrimitive{
-				Prefix:          " ",
-				Suffix:          " ",
-				Color:           hex(c.Base0B),
-				BackgroundColor: hex(c.Base01),
-			},
-		},
-		CodeBlock: ansi.StyleCodeBlock{
-			StyleBlock: ansi.StyleBlock{
-				StylePrimitive: ansi.StylePrimitive{
-					Color: hex(c.Base04),
-				},
-				Margin: uintPtr(2),
-			},
-			Chroma: &ansi.Chroma{
-				Text: ansi.StylePrimitive{
-					Color: hex(c.Base05),
-				},
-				Error: ansi.StylePrimitive{
-					Color:           hex(c.Base07),
-					BackgroundColor: hex(c.Base08),
-				},
-				Comment: ansi.StylePrimitive{
-					Color:  hex(c.Base03),
-					Italic: boolPtr(true),
-				},
-				CommentPreproc: ansi.StylePrimitive{
-					Color: hex(c.Base09),
-				},
-				Keyword: ansi.StylePrimitive{
-					Color: hex(c.Base0E),
-				},
-				KeywordReserved: ansi.StylePrimitive{
-					Color: hex(c.Base0E),
-				},
-				KeywordNamespace: ansi.StylePrimitive{
-					Color: hex(c.Base0D),
-				},
-				KeywordType: ansi.StylePrimitive{
-					Color: hex(c.Base0A),
-				},
-				Operator: ansi.StylePrimitive{
-					Color: hex(c.Base05),
-				},
-				Punctuation: ansi.StylePrimitive{
-					Color: hex(c.Base05),
-				},
-				Name: ansi.StylePrimitive{
-					Color: hex(c.Base05),
-				},
-				NameBuiltin: ansi.StylePrimitive{
-					Color: hex(c.Base0D),
-				},
-				NameTag: ansi.StylePrimitive{
-					Color: hex(c.Base08),
-				},
-				NameAttribute: ansi.StylePrimitive{
-					Color: hex(c.Base0A),
-				},
-				NameClass: ansi.StylePrimitive{
-					Color:     hex(c.Base0A),
-					Bold:      boolPtr(true),
-					Underline: boolPtr(true),
-				},
-				NameConstant: ansi.StylePrimitive{
-					Color: hex(c.Base09),
-				},
-				NameDecorator: ansi.StylePrimitive{
-					Color: hex(c.Base0C),
-				},
-				NameFunction: ansi.StylePrimitive{
-					Color: hex(c.Base0D),
-				},
-				LiteralNumber: ansi.StylePrimitive{
-					Color: hex(c.Base09),
-				},
-				LiteralString: ansi.StylePrimitive{
-					Color: hex(c.Base0B),
-				},
-				LiteralStringEscape: ansi.StylePrimitive{
-					Color: hex(c.Base0C),
-				},
-				GenericDeleted: ansi.StylePrimitive{
-					Color: hex(c.Base08),
-				},
-				GenericEmph: ansi.StylePrimitive{
-					Italic: boolPtr(true),
-				},
-				GenericInserted: ansi.StylePrimitive{
-					Color: hex(c.Base0B),
-				},
-				GenericStrong: ansi.StylePrimitive{
-					Bold: boolPtr(true),
-				},
-				GenericSubheading: ansi.StylePrimitive{
-					Color: hex(c.Base04),
-				},
-				Background: ansi.StylePrimitive{
-					BackgroundColor: hex(c.Base01),
-				},
-			},
-		},
-		Table: ansi.StyleTable{
-			StyleBlock: ansi.StyleBlock{
-				StylePrimitive: ansi.StylePrimitive{},
-			},
-		},
-		DefinitionDescription: ansi.StylePrimitive{
-			BlockPrefix: "\n> ",
-		},
-	}
-}

internal/style/highlight.go

@@ -3,22 +3,23 @@ package style
 import (
 	"bytes"
 	"encoding/json"
-	"image/color"
 	"strings"
 
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/config"
 	"golang.org/x/net/html"
+	"image/color"
 )
 
 func Paint(c color.Color, s string) string {
 	return lipgloss.NewStyle().Foreground(c).Render(s)
 }
 
-// HighlightHTTP highlights a full raw HTTP message (headers + body).
 func HighlightHTTP(raw string) string {
 	raw = strings.ReplaceAll(raw, "\r\n", "\n")
 	raw = strings.ReplaceAll(raw, "\r", "\n")
+	raw = strings.ReplaceAll(raw, "\t", "    ")
 	idx := strings.Index(raw, "\n\n")
 	if idx == -1 {
 		return highlightHeaders(raw)
@@ -75,8 +76,8 @@ func highlightHeaders(raw string) string {
 		} else if trimmed == "" {
 			out.WriteString(line)
 		} else if idx := strings.Index(trimmed, ": "); idx != -1 {
-			out.WriteString(Paint(S.Subtle, trimmed[:idx+2]))
-			out.WriteString(Paint(S.Text, trimmed[idx+2:]))
+			out.WriteString(Paint(ilovetui.S.Subtle, trimmed[:idx+2]))
+			out.WriteString(Paint(ilovetui.S.Text, trimmed[idx+2:]))
 		} else {
 			out.WriteString(line)
 		}
@@ -95,16 +96,16 @@ func highlightStatusLine(line string) string {
 	switch parts[0] {
 	case "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "CONNECT", "TRACE":
 		result := S.Method(parts[0]).Width(0).Render(parts[0]) + " "
-		result += Paint(S.Primary, parts[1])
+		result += Paint(ilovetui.S.Primary, parts[1])
 		if len(parts) == 3 {
-			result += " " + Paint(S.Subtle, parts[2])
+			result += " " + Paint(ilovetui.S.Subtle, parts[2])
 		}
 		return result
 	}
-	result := Paint(S.Subtle, parts[0]) + " "
-	result += Paint(S.Warning, parts[1])
+	result := Paint(ilovetui.S.Subtle, parts[0]) + " "
+	result += Paint(ilovetui.S.Warning, parts[1])
 	if len(parts) == 3 {
-		result += " " + Paint(S.MutedFg, parts[2])
+		result += " " + Paint(ilovetui.S.Muted, parts[2])
 	}
 	return result
 }
@@ -134,9 +135,9 @@ func highlightJSON(s string) string {
 				k++
 			}
 			if k < n && s[k] == ':' {
-				out.WriteString(Paint(S.Primary, str))
+				out.WriteString(Paint(ilovetui.S.Primary, str))
 			} else {
-				out.WriteString(Paint(S.Success, str))
+				out.WriteString(Paint(ilovetui.S.Success, str))
 			}
 			i = j
 		case (ch >= '0' && ch <= '9') || (ch == '-' && i+1 < n && s[i+1] >= '0' && s[i+1] <= '9'):
@@ -147,19 +148,19 @@ func highlightJSON(s string) string {
 			for j < n && ((s[j] >= '0' && s[j] <= '9') || s[j] == '.' || s[j] == 'e' || s[j] == 'E' || s[j] == '+' || s[j] == '-') {
 				j++
 			}
-			out.WriteString(Paint(S.Warning, s[i:j]))
+			out.WriteString(Paint(ilovetui.S.Warning, s[i:j]))
 			i = j
 		case i+4 <= n && s[i:i+4] == "true":
-			out.WriteString(Paint(S.Error, "true"))
+			out.WriteString(Paint(ilovetui.S.Error, "true"))
 			i += 4
 		case i+5 <= n && s[i:i+5] == "false":
-			out.WriteString(Paint(S.Error, "false"))
+			out.WriteString(Paint(ilovetui.S.Error, "false"))
 			i += 5
 		case i+4 <= n && s[i:i+4] == "null":
-			out.WriteString(Paint(S.Error, "null"))
+			out.WriteString(Paint(ilovetui.S.Error, "null"))
 			i += 4
 		case ch == '{' || ch == '}' || ch == '[' || ch == ']' || ch == ':' || ch == ',':
-			out.WriteString(Paint(S.Subtle, string(ch)))
+			out.WriteString(Paint(ilovetui.S.Subtle, string(ch)))
 			i++
 		default:
 			out.WriteByte(ch)
@@ -265,11 +266,11 @@ func highlightHTML(s string) string {
 		if i+4 <= n && s[i:i+4] == "<!--" {
 			end := strings.Index(s[i:], "-->")
 			if end == -1 {
-				out.WriteString(Paint(S.Subtle, s[i:]))
+				out.WriteString(Paint(ilovetui.S.Subtle, s[i:]))
 				break
 			}
 			end = i + end + 3
-			out.WriteString(Paint(S.Subtle, s[i:end]))
+			out.WriteString(Paint(ilovetui.S.Subtle, s[i:end]))
 			i = end
 			continue
 		}
@@ -278,10 +279,10 @@ func highlightHTML(s string) string {
 			i++
 			continue
 		}
-		out.WriteString(Paint(S.Subtle, "<"))
+		out.WriteString(Paint(ilovetui.S.Subtle, "<"))
 		i++
 		if i < n && (s[i] == '/' || s[i] == '!') {
-			out.WriteString(Paint(S.Subtle, string(s[i])))
+			out.WriteString(Paint(ilovetui.S.Subtle, string(s[i])))
 			i++
 		}
 		j := i
@@ -289,7 +290,7 @@ func highlightHTML(s string) string {
 			j++
 		}
 		if j > i {
-			out.WriteString(Paint(S.Primary, s[i:j]))
+			out.WriteString(Paint(ilovetui.S.Primary, s[i:j]))
 			i = j
 		}
 		for i < n && s[i] != '>' {
@@ -299,10 +300,10 @@ func highlightHTML(s string) string {
 				out.WriteByte(ch)
 				i++
 			case ch == '/':
-				out.WriteString(Paint(S.Subtle, "/"))
+				out.WriteString(Paint(ilovetui.S.Subtle, "/"))
 				i++
 			case ch == '=':
-				out.WriteString(Paint(S.Subtle, "="))
+				out.WriteString(Paint(ilovetui.S.Subtle, "="))
 				i++
 			case ch == '"' || ch == '\'':
 				q := ch
@@ -313,19 +314,19 @@ func highlightHTML(s string) string {
 				if j < n {
 					j++
 				}
-				out.WriteString(Paint(S.Success, s[i:j]))
+				out.WriteString(Paint(ilovetui.S.Success, s[i:j]))
 				i = j
 			default:
 				j = i
 				for j < n && s[j] != '=' && s[j] != ' ' && s[j] != '>' && s[j] != '/' && s[j] != '\t' && s[j] != '\n' {
 					j++
 				}
-				out.WriteString(Paint(S.Warning, s[i:j]))
+				out.WriteString(Paint(ilovetui.S.Warning, s[i:j]))
 				i = j
 			}
 		}
 		if i < n && s[i] == '>' {
-			out.WriteString(Paint(S.Subtle, ">"))
+			out.WriteString(Paint(ilovetui.S.Subtle, ">"))
 			i++
 		}
 	}

internal/style/style.go

@@ -1,106 +1,48 @@
 package style
 
 import (
-	"image/color"
-
-	"charm.land/bubbles/v2/help"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/config"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
 type Styles struct {
-	Primary   color.Color
-	Success   color.Color
-	Error     color.Color
-	Warning   color.Color
-	SubtleBg  color.Color
-	Selection color.Color
-	Text      color.Color
-	MutedFg   color.Color
-	Subtle    color.Color
-
-	Bold  lipgloss.Style
-	Faint lipgloss.Style
-
-	Panel        lipgloss.Style
-	PanelFocused lipgloss.Style
 	PanelEditing lipgloss.Style
 
-	PagerDotActive   string
-	PagerDotInactive string
+	methodGet      lipgloss.Style
+	methodPost     lipgloss.Style
+	methodPutPatch lipgloss.Style
+	methodDelete   lipgloss.Style
+	methodDefault  lipgloss.Style
 }
 
 var S *Styles
 
-func Init(cfg *config.Config) {
-	c := cfg.TUI.Colors
-
-	subtleBg := lipgloss.Color("#" + c.Base01)  // Lighter Background (status bars)
-	selection := lipgloss.Color("#" + c.Base02) // Selection Background
-	subtle := lipgloss.Color("#" + c.Base03)    // Faint text, borders
-	mutedFg := lipgloss.Color("#" + c.Base04)   // Muted foreground
-	text := lipgloss.Color("#" + c.Base05)      // Default Foreground
-	errCol := lipgloss.Color("#" + c.Base08)    // Red: errors
-	warning := lipgloss.Color("#" + c.Base09)   // Orange: warnings
-	success := lipgloss.Color("#" + c.Base0B)   // Green: success
-	primary := lipgloss.Color("#" + c.Base0D)   // Accent: primary
-	purple := lipgloss.Color("#" + c.Base0E)    // Purple: editing
-
+func Init() {
+	methodBase := lipgloss.NewStyle().Bold(true).Width(7)
 	S = &Styles{
-		Primary:   primary,
-		Success:   success,
-		Error:     errCol,
-		Warning:   warning,
-		SubtleBg:  subtleBg,
-		Selection: selection,
-		MutedFg:   mutedFg,
-		Text:      text,
-		Subtle:    subtle,
-
-		Bold:  lipgloss.NewStyle().Bold(true),
-		Faint: lipgloss.NewStyle().Foreground(subtle).Faint(true),
-
-		Panel: lipgloss.NewStyle().
-			Border(lipgloss.RoundedBorder()).
-			BorderForeground(subtle),
-
-		PanelFocused: lipgloss.NewStyle().
-			Border(lipgloss.RoundedBorder()).
-			BorderForeground(primary),
-
 		PanelEditing: lipgloss.NewStyle().
 			Border(lipgloss.RoundedBorder()).
-			BorderForeground(purple),
+			BorderForeground(ilovetui.S.Base0E),
 
-		PagerDotActive:   lipgloss.NewStyle().Foreground(primary).SetString("•").String(),
-		PagerDotInactive: lipgloss.NewStyle().Foreground(subtle).SetString("•").String(),
+		methodGet:      methodBase.Foreground(ilovetui.S.Success),
+		methodPost:     methodBase.Foreground(ilovetui.S.Warning),
+		methodPutPatch: methodBase.Foreground(ilovetui.S.Primary),
+		methodDelete:   methodBase.Foreground(ilovetui.S.Error),
+		methodDefault:  methodBase.Foreground(ilovetui.S.Text),
 	}
 }
 
-func NewHelp() help.Model {
-	h := help.New()
-	h.Styles.ShortKey = lipgloss.NewStyle().Foreground(S.Primary)
-	h.Styles.ShortDesc = lipgloss.NewStyle().Foreground(S.MutedFg)
-	h.Styles.ShortSeparator = lipgloss.NewStyle().Foreground(S.Subtle)
-	h.Styles.FullKey = lipgloss.NewStyle().Foreground(S.Primary)
-	h.Styles.FullDesc = lipgloss.NewStyle().Foreground(S.MutedFg)
-	h.Styles.FullSeparator = lipgloss.NewStyle().Foreground(S.Subtle)
-	h.Styles.Ellipsis = lipgloss.NewStyle().Foreground(S.Subtle)
-	return h
-}
-
 func (s *Styles) Method(method string) lipgloss.Style {
-	base := lipgloss.NewStyle().Bold(true).Width(7)
 	switch method {
 	case "GET":
-		return base.Foreground(s.Success)
+		return s.methodGet
 	case "POST":
-		return base.Foreground(s.Warning)
+		return s.methodPost
 	case "PUT", "PATCH":
-		return base.Foreground(s.Primary)
+		return s.methodPutPatch
 	case "DELETE":
-		return base.Foreground(s.Error)
+		return s.methodDelete
 	default:
-		return base.Foreground(s.Text)
+		return s.methodDefault
 	}
 }

internal/ui/app/model.go

@@ -31,17 +31,14 @@ const tickInterval = 2 * time.Second
 type tickMsg struct{}
 
 func tickCmd() tea.Cmd {
-	return func() tea.Msg {
-		time.Sleep(tickInterval)
+	return tea.Tick(tickInterval, func(time.Time) tea.Msg {
 		return tickMsg{}
+	})
 }
-}
-
-var sidebarEntries = pageRegistry
 
 var pageShortcuts = func() map[string]page {
-	m := make(map[string]page, len(sidebarEntries))
-	for i, e := range sidebarEntries {
+	m := make(map[string]page, len(pageRegistry))
+	for i, e := range pageRegistry {
 		m[strconv.Itoa(i+1)] = e.id
 	}
 	return m
@@ -55,6 +52,8 @@ type Model struct {
 	database      *db.DB
 	logFile       *os.File
 	pluginManager *plugins.Manager
+	fatalErr      error
+	logFileErr    error
 
 	width         int
 	height        int
@@ -94,13 +93,30 @@ func New(broker *intercept.Broker, name, path string) Model {
 		sidebarState:  sidebarState(cfg.TUI.DefaultSidebarState),
 	}
 
-	if d, err := db.Open(path); err == nil {
+	d, err := db.Open(path)
+	if err != nil {
+		m.fatalErr = err
+		return m
+	}
 	m.database = d
 	broker.SetDB(d)
 	m.history.SetDB(d)
 	m.replay.SetDB(d)
 	m.findingsPage.SetDB(d)
 	mgr.SetDB(d)
+
+	pf, err := plugins.OpenPluginsFile(path)
+	if err != nil {
+		log.Printf("plugins file: %v", err)
+	}
+	mgr.SetPluginsFile(pf)
+
+	if len(cfg.Plugins) > 0 {
+		defaults := make(map[string]plugins.GlobalDefault, len(cfg.Plugins))
+		for id, gp := range cfg.Plugins {
+			defaults[id] = plugins.GlobalDefault{Enable: gp.Enable, Config: gp.Config}
+		}
+		mgr.SetGlobalDefaults(defaults)
 	}
 
 	pluginsDir := config.ExpandPath(cfg.App.PluginsDir)
@@ -113,14 +129,18 @@ func New(broker *intercept.Broker, name, path string) Model {
 		m.logFile = lf
 		log.SetOutput(lf)
 		logrus.SetOutput(lf)
+	} else {
+		m.logFileErr = err
 	}
 
 	return m
 }
 
+func (m Model) FatalErr() error { return m.fatalErr }
+
 func (m Model) Init() tea.Cmd {
 	mgr := m.pluginManager
-	return tea.Batch(
+	cmds := []tea.Cmd{
 		intercept.WaitForRequest(m.broker),
 		intercept.WaitForResponse(m.broker),
 		tickCmd(),
@@ -129,5 +149,16 @@ func (m Model) Init() tea.Cmd {
 		plugins.WaitForQuit(mgr),
 		findingsUI.RefreshCmd(m.database),
 		func() tea.Msg { mgr.RunOnStart(); return nil },
-	)
+	}
+	if m.logFileErr != nil {
+		err := m.logFileErr
+		cmds = append(cmds, func() tea.Msg {
+			return notificationsUI.NotificationMsg{
+				Title: "Warning",
+				Body:  "Could not open log file: " + err.Error(),
+				Kind:  notificationsUI.KindWarning,
+			}
+		})
+	}
+	return tea.Batch(cmds...)
 }

internal/ui/app/pages.go

@@ -37,6 +37,8 @@ type pageEntry struct {
 	isEditing func(m *Model) bool
 	// resize propagates a new (w, h) to the page model.
 	resize func(m *Model, w, h int)
+	// hasUpdate reports whether the page has unseen updates.
+	hasUpdate func(m *Model) bool
 }
 
 var pageRegistry = []pageEntry{
@@ -52,6 +54,7 @@ var pageRegistry = []pageEntry{
 		},
 		isEditing: func(m *Model) bool { return m.intercept.IsEditing() },
 		resize:    func(m *Model, w, h int) { m.intercept.SetSize(w, h) },
+		hasUpdate: func(m *Model) bool { return m.intercept.HasUnread() },
 	},
 	{
 		id:   pageHistory,
@@ -115,6 +118,7 @@ var pageRegistry = []pageEntry{
 			return cmd
 		},
 		resize:    func(m *Model, w, h int) { m.findingsPage.SetSize(w, h) },
+		hasUpdate: func(m *Model) bool { return m.findingsPage.HasUnread() },
 	},
 	{
 		id:   pageDocs,

internal/ui/app/sidebar.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
 type sidebarState string
@@ -42,7 +42,6 @@ func (m *Model) renderSidebar() string {
 	if m.sidebarState == sidebarHidden {
 		return ""
 	}
-	s := style.S
 	// content width inside bordered panel
 	inner := m.getSidebarWidth() - 2
 
@@ -50,22 +49,26 @@ func (m *Model) renderSidebar() string {
 	if m.sidebarState == sidebarCollapsed {
 		titleText = "SPLT"
 	}
-	title := lipgloss.NewStyle().Width(inner).Bold(true).Foreground(s.Primary).Padding(0, 1).Render(titleText)
+	title := lipgloss.NewStyle().Width(inner).Bold(true).Foreground(ilovetui.S.Primary).Padding(0, 1).Render(titleText)
 
 	divider := strings.Repeat("─", inner)
 
-	badgeSelected := lipgloss.NewStyle().Foreground(s.Primary).Bold(true)
-	badgeNormal := lipgloss.NewStyle().Foreground(s.Subtle)
-	textSelected := lipgloss.NewStyle().Foreground(s.Primary)
-	textNormal := lipgloss.NewStyle().Foreground(s.Text)
+	badgeSelected := lipgloss.NewStyle().Foreground(ilovetui.S.Primary).Bold(true)
+	badgeNormal := lipgloss.NewStyle().Foreground(ilovetui.S.Subtle)
+	textSelected := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+	textNormal := lipgloss.NewStyle().Foreground(ilovetui.S.Text)
 	lineStyle := lipgloss.NewStyle().Width(inner).Padding(0, 1)
 
 	var items strings.Builder
-	for i, entry := range sidebarEntries {
+	badgeUnread := lipgloss.NewStyle().Foreground(ilovetui.S.Warning).Bold(true)
+
+	for i, entry := range pageRegistry {
 		selected := entry.id == m.page
 		badgeStyle, textStyle := badgeNormal, textNormal
 		if selected {
 			badgeStyle, textStyle = badgeSelected, textSelected
+		} else if entry.hasUpdate != nil && entry.hasUpdate(m) {
+			badgeStyle = badgeUnread
 		}
 		icon := ""
 		if entry.icon != nil {
@@ -91,13 +94,13 @@ func (m *Model) renderSidebar() string {
 	}
 	parts := []string{
 		title,
-		lipgloss.NewStyle().Width(inner).Foreground(s.Subtle).Padding(0, 1).Render(name),
+		lipgloss.NewStyle().Width(inner).Foreground(ilovetui.S.Subtle).Padding(0, 1).Render(name),
 	}
 	parts = append(parts,
-		lipgloss.NewStyle().Foreground(s.Subtle).Render(divider),
+		lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).Render(divider),
 		items.String(),
 	)
 	body := lipgloss.JoinVertical(lipgloss.Left, parts...)
 
-	return s.Panel.Width(m.getSidebarWidth()).Height(m.height).Render(body)
+	return ilovetui.S.Panel.Width(m.getSidebarWidth()).Height(m.height).Render(body)
 }

internal/ui/app/update.go

@@ -2,7 +2,6 @@ package app
 
 import (
 	"log"
-	"os"
 	"os/exec"
 	"path/filepath"
 
@@ -21,6 +20,7 @@ import (
 	historyUI "github.com/anotherhadi/spilltea/internal/ui/history"
 	interceptUI "github.com/anotherhadi/spilltea/internal/ui/intercept"
 	replayUI "github.com/anotherhadi/spilltea/internal/ui/replay"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -37,6 +37,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case intercept.RequestArrivedMsg:
 		updated, cmd := m.intercept.Update(msg)
 		m.intercept = updated.(interceptUI.Model)
+		if m.page == pageIntercept {
+			m.intercept.ClearUnread()
+		}
 		return m, tea.Batch(cmd, intercept.WaitForRequest(m.broker))
 	case intercept.ResponseArrivedMsg:
 		updated, cmd := m.intercept.Update(msg)
@@ -104,6 +107,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case proxyPkg.ErrMsg:
 		if msg.Err != nil {
 			log.Printf("proxy error: %v", msg.Err)
+			m.fatalErr = msg.Err
+			return m, tea.Quit
 		}
 		return m, nil
 
@@ -119,6 +124,9 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case findingsUI.FindingsLoadedMsg:
 		updated, cmd := m.findingsPage.Update(msg)
 		m.findingsPage = updated.(findingsUI.Model)
+		if m.page == pageFindings {
+			m.findingsPage.ClearUnread()
+		}
 		return m, cmd
 
 	case replayUI.SendToReplayMsg:
@@ -154,68 +162,76 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, cmd
 
 	case tea.KeyPressMsg:
-		// ctrl+c always quits, even when a textarea is focused.
-		if msg.String() == "ctrl+c" {
-			m.pluginManager.RunOnQuit()
-			return m, tea.Quit
-		}
 		if key.Matches(msg, keys.Keys.Global.Quit) && !m.activeIsEditing() {
 			m.pluginManager.RunOnQuit()
 			return m, tea.Quit
 		}
 
 		if key.Matches(msg, keys.Keys.Global.OpenLogs) {
-			editor := os.Getenv("EDITOR")
-			if editor == "" {
-				editor = "vi"
-			}
 			logPath := filepath.Join(filepath.Dir(m.projectPath), "logs.log")
-			return m, tea.ExecProcess(exec.Command(editor, logPath), nil)
+			return m, tea.ExecProcess(exec.Command(util.ResolveEditor(), logPath), nil) // #nosec G204 G702 -- editor from trusted config/$EDITOR, logPath is a fixed path
 		}
 
 		if !m.activeIsEditing() {
 			switch {
 			case key.Matches(msg, keys.Keys.Global.CopyAs):
 				var raw, scheme string
+				var responseFocused bool
 				switch m.page {
-				case pageDiff:
-					raw = m.diff.CurrentRaw()
-					scheme = "https"
 				case pageIntercept:
 					raw = m.intercept.CurrentRaw()
 					scheme = m.intercept.CurrentScheme()
+					responseFocused = m.intercept.IsResponseFocused()
 				case pageHistory:
 					raw = m.history.CurrentRaw()
 					scheme = m.history.CurrentScheme()
+					responseFocused = m.history.IsResponseFocused()
 				case pageReplay:
 					raw = m.replay.CurrentRaw()
 					scheme = m.replay.CurrentScheme()
+					responseFocused = m.replay.IsResponseFocused()
 				}
-				if raw != "" {
+				if raw != "" && !responseFocused {
 					m.copyAs.SetSize(m.width, m.height)
 					m.copyAs.Open(copyasUI.OpenMsg{RawRequest: raw, Scheme: scheme})
 				}
 				return m, nil
 
 			case key.Matches(msg, keys.Keys.Global.Copy):
+				if m.page == pageFindings {
+					if md := m.findingsPage.CurrentMarkdown(); md != "" {
+						return m, tea.Batch(
+							tea.SetClipboard(md),
+							func() tea.Msg {
+								return notificationsUI.NotificationMsg{
+									Title: "Copied",
+									Body:  "Finding copied to clipboard",
+									Kind:  notificationsUI.KindSuccess,
+								}
+							},
+						)
+					}
+					return m, nil
+				}
 				var raw, scheme string
+				var responseFocused bool
 				switch m.page {
 				case pageIntercept:
 					raw = m.intercept.CurrentRaw()
 					scheme = m.intercept.CurrentScheme()
-				case pageDiff:
-					raw = m.diff.CurrentRaw()
-					scheme = "https"
+					responseFocused = m.intercept.IsResponseFocused()
 				case pageHistory:
 					raw = m.history.CurrentRaw()
 					scheme = m.history.CurrentScheme()
+					responseFocused = m.history.IsResponseFocused()
 				case pageReplay:
 					raw = m.replay.CurrentRaw()
 					scheme = m.replay.CurrentScheme()
+					responseFocused = m.replay.IsResponseFocused()
 				}
 				if raw != "" {
 					m.copy.SetSize(m.width, m.height)
-					m.copy.Open(copyUI.OpenMsg{RawRequest: raw, Scheme: scheme})
+					m.copy.Open(copyUI.OpenMsg{RawRequest: raw, Scheme: scheme, ShowURL: !responseFocused})
 				}
 				return m, nil
 
@@ -231,8 +247,12 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 						return m, m.history.RefreshCmd()
 					}
 					if p == pageFindings {
+						m.findingsPage.ClearUnread()
 						return m, findingsUI.RefreshCmd(m.database)
 					}
+					if p == pageIntercept {
+						m.intercept.ClearUnread()
+					}
 				}
 			}
 		}

internal/ui/app/view.go

@@ -3,28 +3,31 @@ package app
 import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
+func (m Model) newView(content string) tea.View {
+	v := tea.NewView(content)
+	v.AltScreen = true
+	v.WindowTitle = "Spilltea: " + m.projectName
+	return v
+}
+
 func (m Model) View() tea.View {
 	if m.width == 0 {
-		v := tea.NewView("")
-		v.AltScreen = true
-		return v
+		return m.newView("")
 	}
 
 	normal := m.renderNormal()
 
 	if m.copyAs.IsOpen() {
-		v := tea.NewView(m.copyAs.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copyAs.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
 
 	if m.copy.IsOpen() {
-		v := tea.NewView(m.copy.View(normal))
-		v.AltScreen = true
+		v := m.newView(m.copy.View(normal))
 		v.MouseMode = tea.MouseModeCellMotion
 		return v
 	}
@@ -34,8 +37,7 @@ func (m Model) View() tea.View {
 		rendered = m.notifications.View(normal)
 	}
 
-	v := tea.NewView(rendered)
-	v.AltScreen = true
+	v := m.newView(rendered)
 	v.MouseMode = tea.MouseModeCellMotion
 	return v
 }
@@ -52,5 +54,5 @@ func (m *Model) renderActivePage() string {
 			return e.render(m)
 		}
 	}
-	return style.S.Faint.Render("Work in progress")
+	return ilovetui.S.Faint.Render("Work in progress")
 }

internal/ui/components/copy/model.go

@@ -1,15 +1,12 @@
 package copy
 
 import (
-	"encoding/base64"
-	"fmt"
-	"os"
 	"strings"
 
 	"charm.land/bubbles/v2/list"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
 const (
@@ -17,14 +14,10 @@ const (
 	popupH = 20
 )
 
-func writeClipboard(text string) {
-	encoded := base64.StdEncoding.EncodeToString([]byte(text))
-	fmt.Fprintf(os.Stderr, "\033]52;c;%s\a", encoded)
-}
-
 type OpenMsg struct {
 	RawRequest string
 	Scheme     string
+	ShowURL    bool
 }
 
 type copyItem struct {
@@ -54,20 +47,18 @@ type Model struct {
 }
 
 func New() Model {
-	s := style.S
-
 	delegate := list.NewDefaultDelegate()
 	delegate.SetSpacing(0)
-	delegate.Styles.NormalTitle = lipgloss.NewStyle().Foreground(s.Text).PaddingLeft(2)
-	delegate.Styles.NormalDesc = lipgloss.NewStyle().Foreground(s.Subtle).PaddingLeft(2)
+	delegate.Styles.NormalTitle = lipgloss.NewStyle().Foreground(ilovetui.S.Text).PaddingLeft(2)
+	delegate.Styles.NormalDesc = lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).PaddingLeft(2)
 	delegate.Styles.SelectedTitle = lipgloss.NewStyle().
 		Border(lipgloss.NormalBorder(), false, false, false, true).
-		BorderForeground(s.Primary).
-		Foreground(s.Primary).Bold(true).PaddingLeft(1)
+		BorderForeground(ilovetui.S.Primary).
+		Foreground(ilovetui.S.Primary).Bold(true).PaddingLeft(1)
 	delegate.Styles.SelectedDesc = lipgloss.NewStyle().
 		Border(lipgloss.NormalBorder(), false, false, false, true).
-		BorderForeground(s.Primary).
-		Foreground(s.MutedFg).PaddingLeft(1)
+		BorderForeground(ilovetui.S.Primary).
+		Foreground(ilovetui.S.Muted).PaddingLeft(1)
 
 	l := list.New(allItems, delegate, popupW, 8)
 	l.SetShowTitle(false)
@@ -90,6 +81,17 @@ func (m *Model) Open(msg OpenMsg) {
 	m.rawRequest = msg.RawRequest
 	m.scheme = msg.Scheme
 	m.open = true
+	items := allItems
+	if !msg.ShowURL {
+		filtered := make([]list.Item, 0, len(allItems))
+		for _, it := range allItems {
+			if it.(copyItem).id != "url" {
+				filtered = append(filtered, it)
+			}
+		}
+		items = filtered
+	}
+	m.list.SetItems(items)
 	m.list.ResetFilter()
 	m.list.Select(0)
 	m.list.SetSize(m.popupInnerWidth(), m.listHeight())
@@ -121,7 +123,7 @@ func (m Model) popupHeight() int {
 }
 
 func (m Model) listHeight() int {
-	return style.PanelContentH(m.popupHeight()) - 1
+	return ilovetui.ContentHeight(m.popupHeight()) - 1
 }
 
 func (m Model) extract(id string) string {

internal/ui/components/copy/update.go

@@ -4,16 +4,26 @@ import (
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/keys"
+	notificationsUI "github.com/anotherhadi/spilltea/internal/ui/components/notifications"
 )
 
 func (m Model) Update(msg tea.Msg) (Model, tea.Cmd) {
 	if kp, ok := msg.(tea.KeyPressMsg); ok {
 		switch {
 		case kp.String() == "enter":
-			if item, ok := m.list.SelectedItem().(copyItem); ok {
-				writeClipboard(m.extract(item.id))
-			}
 			m.open = false
+			if item, ok := m.list.SelectedItem().(copyItem); ok {
+				return m, tea.Batch(
+					tea.SetClipboard(m.extract(item.id)),
+					func() tea.Msg {
+						return notificationsUI.NotificationMsg{
+							Title: "Copied",
+							Body:  "Request copied to clipboard",
+							Kind:  notificationsUI.KindSuccess,
+						}
+					},
+				)
+			}
 			return m, nil
 		case key.Matches(kp, keys.Keys.Global.Escape):
 			if m.list.SettingFilter() {

internal/ui/components/copy/view.go

@@ -2,14 +2,12 @@ package copy
 
 import (
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	copyasUI "github.com/anotherhadi/spilltea/internal/ui/components/copyas"
 )
 
 func (m *Model) View(background string) string {
-	s := style.S
-
-	hint := lipgloss.NewStyle().Foreground(s.Subtle).
+	hint := lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).
 		Render("  enter: copy  •  /: filter  •  esc: cancel")
 
 	inner := lipgloss.JoinVertical(lipgloss.Left,
@@ -19,10 +17,10 @@ func (m *Model) View(background string) string {
 
 	border := lipgloss.NewStyle().
 		Border(lipgloss.RoundedBorder()).
-		BorderForeground(s.Primary)
+		BorderForeground(ilovetui.S.Primary)
 
 	popupH := m.popupHeight()
-	popup := style.RenderWithTitle(border, "Copy", inner, m.popupInnerWidth()+2, popupH)
+	popup := ilovetui.RenderWithTitle(border, "Copy", inner, m.popupInnerWidth()+2, popupH)
 
 	return copyasUI.OverlayCenter(background, popup, m.width, m.height)
 }

internal/ui/components/copyas/formats.go

@@ -1,8 +1,12 @@
 package copyas
 
 import (
+	"encoding/json"
 	"fmt"
+	"net/url"
 	"strings"
+
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 type header struct{ key, value string }
@@ -17,41 +21,17 @@ type parsedRequest struct {
 }
 
 func parseRaw(raw, scheme string) parsedRequest {
-	lines := strings.Split(strings.ReplaceAll(raw, "\r\n", "\n"), "\n")
-	pr := parsedRequest{scheme: scheme}
-	if len(lines) == 0 {
-		return pr
+	r := util.ParseRawRequest(raw)
+	pr := parsedRequest{
+		method: r.Method,
+		path:   r.Path,
+		host:   r.Host,
+		scheme: scheme,
 	}
-
-	parts := strings.SplitN(lines[0], " ", 3)
-	if len(parts) >= 1 {
-		pr.method = strings.TrimSpace(parts[0])
-	}
-	if len(parts) >= 2 {
-		pr.path = strings.TrimSpace(parts[1])
-	}
-
-	i := 1
-	for i < len(lines) {
-		line := strings.TrimRight(lines[i], "\r")
-		if line == "" {
-			i++
-			break
-		}
-		if kv := strings.SplitN(line, ": ", 2); len(kv) == 2 {
-			k := strings.TrimSpace(kv[0])
-			v := strings.TrimSpace(kv[1])
-			pr.headers = append(pr.headers, header{k, v})
-			if strings.EqualFold(k, "host") {
-				pr.host = v
-			}
-		}
-		i++
-	}
-
-	if i < len(lines) {
-		pr.body = strings.TrimRight(strings.Join(lines[i:], "\n"), "\n")
+	for _, h := range r.Headers {
+		pr.headers = append(pr.headers, header{h.Key, h.Value})
 	}
+	pr.body = r.Body
 	return pr
 }
 
@@ -78,10 +58,31 @@ func formatAs(id, raw, scheme string) string {
 		return toFFUF(pr)
 	case "markdown":
 		return toMarkdown(pr)
+	case "har":
+		return toHAR(pr)
+	case "httpie":
+		return toHTTPie(pr)
 	}
 	return raw
 }
 
+func toHTTPie(pr parsedRequest) string {
+	var sb strings.Builder
+	method := strings.ToUpper(pr.method)
+	fmt.Fprintf(&sb, "http %s '%s'", method, pr.fullURL())
+	for _, h := range pr.headers {
+		if strings.EqualFold(h.key, "content-length") {
+			continue
+		}
+		fmt.Fprintf(&sb, " \\\n  '%s:%s'", h.key, h.value)
+	}
+	if pr.body != "" {
+		// Pass body via stdin hint
+		fmt.Fprintf(&sb, " \\\n  <<< %q", pr.body)
+	}
+	return sb.String()
+}
+
 func toMarkdown(pr parsedRequest) string {
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "### %s %s\n\n", pr.method, pr.fullURL())
@@ -200,3 +201,104 @@ func toFFUF(pr parsedRequest) string {
 	}
 	return sb.String()
 }
+
+func toHAR(pr parsedRequest) string {
+	type harNameValue struct {
+		Name  string `json:"name"`
+		Value string `json:"value"`
+	}
+	type harPostData struct {
+		MimeType string `json:"mimeType"`
+		Text     string `json:"text"`
+	}
+	type harRequest struct {
+		Method      string         `json:"method"`
+		URL         string         `json:"url"`
+		HTTPVersion string         `json:"httpVersion"`
+		Headers     []harNameValue `json:"headers"`
+		QueryString []harNameValue `json:"queryString"`
+		Cookies     []harNameValue `json:"cookies"`
+		HeadersSize int            `json:"headersSize"`
+		BodySize    int            `json:"bodySize"`
+		PostData    *harPostData   `json:"postData,omitempty"`
+	}
+	type harEntry struct {
+		StartedDateTime string     `json:"startedDateTime"`
+		Time            int        `json:"time"`
+		Request         harRequest `json:"request"`
+		Cache           struct{}   `json:"cache"`
+		Timings         struct {
+			Send    int `json:"send"`
+			Wait    int `json:"wait"`
+			Receive int `json:"receive"`
+		} `json:"timings"`
+	}
+	type harLog struct {
+		Version string `json:"version"`
+		Creator struct {
+			Name    string `json:"name"`
+			Version string `json:"version"`
+		} `json:"creator"`
+		Entries []harEntry `json:"entries"`
+	}
+	type harRoot struct {
+		Log harLog `json:"log"`
+	}
+
+	headers := make([]harNameValue, 0, len(pr.headers))
+	for _, h := range pr.headers {
+		headers = append(headers, harNameValue{h.key, h.value})
+	}
+
+	var qs []harNameValue
+	if idx := strings.Index(pr.path, "?"); idx != -1 {
+		vals, err := url.ParseQuery(pr.path[idx+1:])
+		if err == nil {
+			for k, vs := range vals {
+				for _, v := range vs {
+					qs = append(qs, harNameValue{k, v})
+				}
+			}
+		}
+	}
+	if qs == nil {
+		qs = []harNameValue{}
+	}
+
+	req := harRequest{
+		Method:      pr.method,
+		URL:         pr.fullURL(),
+		HTTPVersion: "HTTP/1.1",
+		Headers:     headers,
+		QueryString: qs,
+		Cookies:     []harNameValue{},
+		HeadersSize: -1,
+		BodySize:    len(pr.body),
+	}
+	if pr.body != "" {
+		mimeType := "application/octet-stream"
+		for _, h := range pr.headers {
+			if strings.EqualFold(h.key, "content-type") {
+				mimeType = h.value
+				break
+			}
+		}
+		req.PostData = &harPostData{MimeType: mimeType, Text: pr.body}
+	}
+
+	root := harRoot{Log: harLog{
+		Version: "1.2",
+		Entries: []harEntry{{
+			StartedDateTime: "1970-01-01T00:00:00.000Z",
+			Time:            -1,
+			Request:         req,
+		}},
+	}}
+	root.Log.Creator.Name = "spilltea"
+
+	b, err := json.MarshalIndent(root, "", "  ")
+	if err != nil {
+		return ""
+	}
+	return string(b)
+}

internal/ui/components/copyas/model.go

@@ -1,14 +1,10 @@
 package copyas
 
 import (
-	"encoding/base64"
-	"fmt"
-	"os"
-
 	"charm.land/bubbles/v2/list"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 )
 
 const (
@@ -16,13 +12,6 @@ const (
 	popupH = 20
 )
 
-// writeClipboard uses the OSC 52 terminal escape sequence to set the clipboard.
-// Supported by most modern terminals (foot, kitty, wezterm, alacritty, xterm…).
-func writeClipboard(text string) {
-	encoded := base64.StdEncoding.EncodeToString([]byte(text))
-	fmt.Fprintf(os.Stderr, "\033]52;c;%s\a", encoded)
-}
-
 type OpenMsg struct {
 	RawRequest string
 	Scheme     string
@@ -45,6 +34,8 @@ var allFormats = []list.Item{
 	formatItem{"go", "Go", "net/http package"},
 	formatItem{"ffuf", "FFUF", "web fuzzer: FUZZ in query string"},
 	formatItem{"markdown", "Markdown", "formatted for documentation"},
+	formatItem{"har", "HAR", "HTTP Archive (JSON)"},
+	formatItem{"httpie", "HTTPie", "HTTPie command line client"},
 }
 
 type Model struct {
@@ -57,20 +48,18 @@ type Model struct {
 }
 
 func New() Model {
-	s := style.S
-
 	delegate := list.NewDefaultDelegate()
 	delegate.SetSpacing(0)
-	delegate.Styles.NormalTitle = lipgloss.NewStyle().Foreground(s.Text).PaddingLeft(2)
-	delegate.Styles.NormalDesc = lipgloss.NewStyle().Foreground(s.Subtle).PaddingLeft(2)
+	delegate.Styles.NormalTitle = lipgloss.NewStyle().Foreground(ilovetui.S.Text).PaddingLeft(2)
+	delegate.Styles.NormalDesc = lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).PaddingLeft(2)
 	delegate.Styles.SelectedTitle = lipgloss.NewStyle().
 		Border(lipgloss.NormalBorder(), false, false, false, true).
-		BorderForeground(s.Primary).
-		Foreground(s.Primary).Bold(true).PaddingLeft(1)
+		BorderForeground(ilovetui.S.Primary).
+		Foreground(ilovetui.S.Primary).Bold(true).PaddingLeft(1)
 	delegate.Styles.SelectedDesc = lipgloss.NewStyle().
 		Border(lipgloss.NormalBorder(), false, false, false, true).
-		BorderForeground(s.Primary).
-		Foreground(s.MutedFg).PaddingLeft(1)
+		BorderForeground(ilovetui.S.Primary).
+		Foreground(ilovetui.S.Muted).PaddingLeft(1)
 
 	l := list.New(allFormats, delegate, popupW, 8)
 	l.SetShowTitle(false)
@@ -125,5 +114,5 @@ func (m Model) popupHeight() int {
 
 // listHeight = panel content area - hint line (1)
 func (m Model) listHeight() int {
-	return style.PanelContentH(m.popupHeight()) - 1
+	return ilovetui.ContentHeight(m.popupHeight()) - 1
 }

internal/ui/components/copyas/update.go

@@ -4,16 +4,26 @@ import (
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/keys"
+	notificationsUI "github.com/anotherhadi/spilltea/internal/ui/components/notifications"
 )
 
 func (m Model) Update(msg tea.Msg) (Model, tea.Cmd) {
 	if kp, ok := msg.(tea.KeyPressMsg); ok {
 		switch {
 		case kp.String() == "enter":
-			if item, ok := m.list.SelectedItem().(formatItem); ok {
-				writeClipboard(formatAs(item.id, m.rawRequest, m.scheme))
-			}
 			m.open = false
+			if item, ok := m.list.SelectedItem().(formatItem); ok {
+				return m, tea.Batch(
+					tea.SetClipboard(formatAs(item.id, m.rawRequest, m.scheme)),
+					func() tea.Msg {
+						return notificationsUI.NotificationMsg{
+							Title: "Copied",
+							Body:  "Request copied to clipboard",
+							Kind:  notificationsUI.KindSuccess,
+						}
+					},
+				)
+			}
 			return m, nil
 		case key.Matches(kp, keys.Keys.Global.Escape):
 			if m.list.SettingFilter() {

internal/ui/components/copyas/view.go

@@ -4,14 +4,12 @@ import (
 	"strings"
 
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/charmbracelet/x/ansi"
 )
 
 func (m *Model) View(background string) string {
-	s := style.S
-
-	hint := lipgloss.NewStyle().Foreground(s.Subtle).
+	hint := lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).
 		Render("  enter: copy  •  /: filter  •  esc: cancel")
 
 	inner := lipgloss.JoinVertical(lipgloss.Left,
@@ -21,17 +19,15 @@ func (m *Model) View(background string) string {
 
 	border := lipgloss.NewStyle().
 		Border(lipgloss.RoundedBorder()).
-		BorderForeground(s.Primary)
+		BorderForeground(ilovetui.S.Primary)
 
 	popupH := m.popupHeight()
-	popup := style.RenderWithTitle(border, "Copy as", inner, m.popupInnerWidth()+2, popupH)
+	popup := ilovetui.RenderWithTitle(border, "Copy as", inner, m.popupInnerWidth()+2, popupH)
 
 	return OverlayCenter(background, popup, m.width, m.height)
 }
 
 func OverlayCenter(bg, popup string, w, h int) string {
-	s := style.S
-
 	stripped := ansi.Strip(bg)
 	rawLines := strings.Split(stripped, "\n")
 	bgRunes := make([][]rune, h)
@@ -67,7 +63,7 @@ func OverlayCenter(bg, popup string, w, h int) string {
 		startX = 0
 	}
 
-	dim := lipgloss.NewStyle().Foreground(s.Subtle).Faint(true)
+	dim := lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).Faint(true)
 
 	result := make([]string, h)
 	for y := 0; y < h; y++ {

internal/ui/components/notifications/model.go

@@ -7,7 +7,7 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/charmbracelet/x/ansi"
 )
 
@@ -76,7 +76,6 @@ func (m Model) View(background string) string {
 		return background
 	}
 
-	s := style.S
 	const popupW = 34
 
 	var popups []string
@@ -89,17 +88,17 @@ func (m Model) View(background string) string {
 		var accent color.Color
 		switch n.kind {
 		case KindSuccess:
-			accent = s.Success
+			accent = ilovetui.S.Success
 		case KindWarning:
-			accent = s.Warning
+			accent = ilovetui.S.Warning
 		case KindError:
-			accent = s.Error
+			accent = ilovetui.S.Error
 		default:
-			accent = s.Primary
+			accent = ilovetui.S.Primary
 		}
 
 		titleStr := lipgloss.NewStyle().Foreground(accent).Bold(true).Render(n.title)
-		bodyStr := lipgloss.NewStyle().Foreground(s.Text).Width(popupW).Render(n.body)
+		bodyStr := lipgloss.NewStyle().Foreground(ilovetui.S.Text).Width(popupW).Render(n.body)
 
 		inner := lipgloss.JoinVertical(lipgloss.Left, titleStr, bodyStr)
 		box := lipgloss.NewStyle().

internal/ui/diff/model.go

@@ -8,10 +8,161 @@ import (
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
+// isWordChar reports whether c belongs to a "word" token (letter, digit, underscore).
+func isWordChar(c byte) bool {
+	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_'
+}
+
+// tokenize splits s into runs of word characters and individual non-word bytes.
+func tokenize(s string) []string {
+	var out []string
+	i := 0
+	for i < len(s) {
+		if isWordChar(s[i]) {
+			j := i
+			for j < len(s) && isWordChar(s[j]) {
+				j++
+			}
+			out = append(out, s[i:j])
+			i = j
+		} else {
+			out = append(out, s[i:i+1])
+			i++
+		}
+	}
+	return out
+}
+
+// wordDiff computes a token-level diff between leftLine and rightLine and
+// returns the two rendered strings with changed tokens highlighted.
+func wordDiff(leftLine, rightLine string) (leftRendered, rightRendered string) {
+	lToks := tokenize(leftLine)
+	rToks := tokenize(rightLine)
+
+	n, m := len(lToks), len(rToks)
+	dp := make([][]int, n+1)
+	for i := range dp {
+		dp[i] = make([]int, m+1)
+	}
+	for i := 1; i <= n; i++ {
+		for j := 1; j <= m; j++ {
+			if lToks[i-1] == rToks[j-1] {
+				dp[i][j] = dp[i-1][j-1] + 1
+			} else if dp[i-1][j] >= dp[i][j-1] {
+				dp[i][j] = dp[i-1][j]
+			} else {
+				dp[i][j] = dp[i][j-1]
+			}
+		}
+	}
+
+	type segment struct {
+		kind int // 0=same, 1=left-only, 2=right-only
+		tok  string
+	}
+	segs := make([]segment, 0, n+m)
+	i, j := n, m
+	for i > 0 || j > 0 {
+		switch {
+		case i > 0 && j > 0 && lToks[i-1] == rToks[j-1]:
+			segs = append(segs, segment{0, lToks[i-1]})
+			i--
+			j--
+		case j > 0 && (i == 0 || dp[i][j-1] >= dp[i-1][j]):
+			segs = append(segs, segment{2, rToks[j-1]})
+			j--
+		default:
+			segs = append(segs, segment{1, lToks[i-1]})
+			i--
+		}
+	}
+	for lo, hi := 0, len(segs)-1; lo < hi; lo, hi = lo+1, hi-1 {
+		segs[lo], segs[hi] = segs[hi], segs[lo]
+	}
+
+	boldErr := lipgloss.NewStyle().Foreground(ilovetui.S.Error).Bold(true)
+	boldOk := lipgloss.NewStyle().Foreground(ilovetui.S.Success).Bold(true)
+	dim := lipgloss.NewStyle().Foreground(ilovetui.S.Subtle)
+
+	var lb, rb strings.Builder
+	for _, seg := range segs {
+		switch seg.kind {
+		case 0:
+			lb.WriteString(dim.Render(seg.tok))
+			rb.WriteString(dim.Render(seg.tok))
+		case 1:
+			lb.WriteString(boldErr.Render(seg.tok))
+		case 2:
+			rb.WriteString(boldOk.Render(seg.tok))
+		}
+	}
+	return lb.String(), rb.String()
+}
+
+// pairAndHighlight collapses adjacent removed/added blocks onto the same rows
+// (eliminating the interleaved padding lines) and applies word-level diff
+// highlighting to each paired line. Unpaired excess removals/additions keep
+// their original single-sided padding row.
+func pairAndHighlight(left, right []diffLine) ([]diffLine, []diffLine) {
+	newLeft := make([]diffLine, 0, len(left))
+	newRight := make([]diffLine, 0, len(right))
+
+	i := 0
+	for i < len(left) {
+		if left[i].kind != lineRemoved {
+			newLeft = append(newLeft, left[i])
+			newRight = append(newRight, right[i])
+			i++
+			continue
+		}
+
+		rStart := i
+		for i < len(left) && left[i].kind == lineRemoved {
+			i++
+		}
+		rEnd := i
+
+		aStart := i
+		for i < len(left) && left[i].kind == lineAdded {
+			i++
+		}
+		aEnd := i
+
+		nRemoved := rEnd - rStart
+		nAdded := aEnd - aStart
+		pairs := nRemoved
+		if nAdded < pairs {
+			pairs = nAdded
+		}
+
+		for k := 0; k < pairs; k++ {
+			lLine := left[rStart+k]
+			rLine := right[aStart+k]
+			lLine.text, rLine.text = wordDiff(lLine.plainText, rLine.plainText)
+			newLeft = append(newLeft, lLine)
+			newRight = append(newRight, rLine)
+		}
+
+		for k := pairs; k < nRemoved; k++ {
+			newLeft = append(newLeft, left[rStart+k])
+			newRight = append(newRight, diffLine{kind: lineRemoved})
+		}
+
+		for k := pairs; k < nAdded; k++ {
+			newLeft = append(newLeft, diffLine{kind: lineAdded})
+			newRight = append(newRight, right[aStart+k])
+		}
+	}
+
+	return newLeft, newRight
+}
+
 type slot struct {
 	label string
 	raw   string
@@ -38,7 +189,8 @@ const (
 )
 
 type diffLine struct {
-	text string
+	text      string // displayed text (highlighted, possibly word-diff decorated)
+	plainText string // plain text for word-diff pairing (empty for padding lines)
 	kind      lineKind
 }
 
@@ -60,9 +212,9 @@ type Model struct {
 
 func New() Model {
 	return Model{
-		leftViewport:  style.NewViewport(),
-		rightViewport: style.NewViewport(),
-		help:          style.NewHelp(),
+		leftViewport:  ilovetui.NewViewport(),
+		rightViewport: ilovetui.NewViewport(),
+		help:          ilovetui.NewHelp(),
 	}
 }
 
@@ -103,7 +255,7 @@ func (m *Model) recalcSizes() {
 		rightInner = 0
 	}
 
-	viewportH := style.PanelContentH(panelH)
+	viewportH := ilovetui.ContentHeight(panelH)
 
 	m.leftViewport.SetWidth(leftInner)
 	m.leftViewport.SetHeight(viewportH)
@@ -126,6 +278,7 @@ func (m *Model) computeDiff() {
 	leftHL := hlLines(leftNorm)
 	rightHL := hlLines(rightNorm)
 	m.leftLines, m.rightLines = lcsAlignedDiff(leftPlain, rightPlain, leftHL, rightHL)
+	m.leftLines, m.rightLines = pairAndHighlight(m.leftLines, m.rightLines)
 }
 
 func normRaw(s string) string {
@@ -143,13 +296,11 @@ func hlLines(raw string) []string {
 }
 
 func (m *Model) refreshViewports() {
-	s := style.S
-
 	if m.left.raw == "" {
 		placeholder := lipgloss.Place(
 			m.leftViewport.Width(), m.leftViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			s.Faint.Render("             <(^_^)>\nsend two entries here to compare"),
+			ilovetui.S.Faint.Render(util.EmptyState(m.leftViewport.Width(), "<(^_^)>", "send two entries here to compare")),
 		)
 		m.leftViewport.SetContent(placeholder)
 		m.rightViewport.SetContent("")
@@ -161,7 +312,7 @@ func (m *Model) refreshViewports() {
 		placeholder := lipgloss.Place(
 			m.rightViewport.Width(), m.rightViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			s.Faint.Render("          (・3・)\nwaiting for second entry…"),
+			ilovetui.S.Faint.Render(util.EmptyState(m.rightViewport.Width(), "(・3・)", "waiting for second entry…")),
 		)
 		m.rightViewport.SetContent(placeholder)
 		return
@@ -227,10 +378,10 @@ func lcsAlignedDiff(a, b, aHL, bHL []string) (left, right []diffLine) {
 			j--
 		case j > 0 && (i == 0 || dp[i][j-1] >= dp[i-1][j]):
 			left = append(left, diffLine{kind: lineAdded})
-			right = append(right, diffLine{text: hlB(j - 1), kind: lineAdded})
+			right = append(right, diffLine{text: hlB(j - 1), plainText: b[j-1], kind: lineAdded})
 			j--
 		default:
-			left = append(left, diffLine{text: hlA(i - 1), kind: lineRemoved})
+			left = append(left, diffLine{text: hlA(i - 1), plainText: a[i-1], kind: lineRemoved})
 			right = append(right, diffLine{kind: lineRemoved})
 			i--
 		}
@@ -252,7 +403,7 @@ func (diffKeyMap) ShortHelp() []key.Binding {
 
 func (m diffKeyMap) FullHelp() [][]key.Binding {
 	g := keys.Keys.Global
-	pageGlobals := []key.Binding{g.Up, g.Down, g.CycleFocus, g.ScrollUp, g.ScrollDown, g.Left, g.Right, g.Copy, g.CopyAs}
+	pageGlobals := []key.Binding{g.Up, g.Down, g.CycleFocus, g.ScrollUp, g.ScrollDown, g.Left, g.Right}
 	all := append(keys.Keys.Diff.Bindings(), pageGlobals...)
 	all = append(all, g.CommonBindings()...)
 	return keys.ChunkByWidth(all, m.width)

internal/ui/diff/view.go

@@ -5,8 +5,10 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/charmbracelet/x/ansi"
 )
 
 func (m Model) View() tea.View {
@@ -25,8 +27,6 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderPanels(panelH int) string {
-	s := style.S
-
 	leftW := m.width / 2
 	rightW := m.width - leftW
 
@@ -38,21 +38,27 @@ func (m *Model) renderPanels(panelH int) string {
 	if m.right.label != "" {
 		rightTitle = icons.I.Diff + "Second: " + m.right.label
 	}
-
-	leftBorder := s.Panel
-	rightBorder := s.Panel
-	switch m.focus {
-	case bothSlots:
-		leftBorder = s.PanelFocused
-		rightBorder = s.PanelFocused
-	case leftSlot:
-		leftBorder = s.PanelFocused
-	case rightSlot:
-		rightBorder = s.PanelFocused
+	if maxW := leftW - 4; maxW > 0 {
+		leftTitle = ansi.Truncate(leftTitle, maxW, "…")
+	}
+	if maxW := rightW - 4; maxW > 0 {
+		rightTitle = ansi.Truncate(rightTitle, maxW, "…")
 	}
 
-	left := style.RenderWithTitle(leftBorder, leftTitle, m.leftViewport.View(), leftW, panelH)
-	right := style.RenderWithTitle(rightBorder, rightTitle, m.rightViewport.View(), rightW, panelH)
+	leftBorder := ilovetui.S.Panel
+	rightBorder := ilovetui.S.Panel
+	switch m.focus {
+	case bothSlots:
+		leftBorder = ilovetui.S.PanelFocused
+		rightBorder = ilovetui.S.PanelFocused
+	case leftSlot:
+		leftBorder = ilovetui.S.PanelFocused
+	case rightSlot:
+		rightBorder = ilovetui.S.PanelFocused
+	}
+
+	left := ilovetui.RenderWithTitle(leftBorder, leftTitle, ilovetui.ViewportView(&m.leftViewport), leftW, panelH)
+	right := ilovetui.RenderWithTitle(rightBorder, rightTitle, ilovetui.ViewportView(&m.rightViewport), rightW, panelH)
 
 	return lipgloss.JoinHorizontal(lipgloss.Top, left, right)
 }
@@ -62,12 +68,11 @@ func (m *Model) renderStatusBar() string {
 }
 
 func renderLeftLines(lines []diffLine) string {
-	s := style.S
 	var sb strings.Builder
 	for _, l := range lines {
 		switch l.kind {
 		case lineRemoved:
-			sb.WriteString(style.Paint(s.Error, "- ") + l.text + "\n")
+			sb.WriteString(style.Paint(ilovetui.S.Error, "- ") + l.text + "\n")
 		case lineAdded:
 			sb.WriteString("\n")
 		default:
@@ -78,12 +83,11 @@ func renderLeftLines(lines []diffLine) string {
 }
 
 func renderRightLines(lines []diffLine) string {
-	s := style.S
 	var sb strings.Builder
 	for _, l := range lines {
 		switch l.kind {
 		case lineAdded:
-			sb.WriteString(style.Paint(s.Success, "+ ") + l.text + "\n")
+			sb.WriteString(style.Paint(ilovetui.S.Success, "+ ") + l.text + "\n")
 		case lineRemoved:
 			sb.WriteString("\n")
 		default:

internal/ui/docs/model.go

@@ -14,8 +14,8 @@ import (
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
 )
 
 func readDoc(name string) string {
@@ -25,10 +25,10 @@ func readDoc(name string) string {
 
 var contentMarkdown = strings.Join([]string{
 	readDoc("main.md"),
-	readDoc("legal-disclaimer.md"),
-	readDoc("basics.md"),
 	readDoc("proxy.md"),
 	readDoc("certificate.md"),
+	readDoc("legal-disclaimer.md"),
+	readDoc("basics.md"),
 	readDoc("history.md"),
 }, "\n")
 
@@ -58,12 +58,12 @@ func New() Model {
 	ti := textinput.New()
 	ti.Prompt = "/"
 	s := ti.Styles()
-	s.Focused.Prompt = lipgloss.NewStyle().Foreground(style.S.Primary)
+	s.Focused.Prompt = lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 	ti.SetStyles(s)
 
 	return Model{
 		viewport:    viewport.New(),
-		help:        style.NewHelp(),
+		help:        ilovetui.NewHelp(),
 		searchInput: ti,
 	}
 }
@@ -182,8 +182,8 @@ func injectHighlightsInLine(ansiLine string, intervals [][]int, currentIdx int)
 		return ansiLine
 	}
 
-	normalOpen, normalClose := lipglossAnsiCodes(lipgloss.NewStyle().Background(style.S.SubtleBg))
-	currentOpen, currentClose := lipglossAnsiCodes(lipgloss.NewStyle().Background(style.S.Primary).Foreground(style.S.Text))
+	normalOpen, normalClose := lipglossAnsiCodes(lipgloss.NewStyle().Background(ilovetui.S.SubtleBg))
+	currentOpen, currentClose := lipglossAnsiCodes(lipgloss.NewStyle().Background(ilovetui.S.Primary).Foreground(ilovetui.S.Text))
 
 	type injection struct {
 		visPos   int

internal/ui/docs/update.go

@@ -4,6 +4,7 @@ import (
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/keys"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (e Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -12,22 +13,14 @@ func (e Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	switch msg := msg.(type) {
 	case tea.MouseWheelMsg:
-		switch msg.Button {
-		case tea.MouseWheelUp:
-			e.viewport.SetYOffset(e.viewport.YOffset() - 1)
-		case tea.MouseWheelDown:
-			e.viewport.SetYOffset(e.viewport.YOffset() + 1)
-		}
+		util.HandleMouseWheel(msg, &e.viewport)
 
 	case tea.KeyPressMsg:
 		if e.searching {
 			switch {
-			case key.Matches(msg, d.SearchReset):
+			case key.Matches(msg, g.Escape):
 				e.searching = false
 				e.searchInput.Blur()
-				e.searchInput.SetValue("")
-				e.matches = nil
-				e.matchIndex = 0
 				e.SetSize(e.width, e.height)
 			case msg.String() == "enter":
 				e.searching = false
@@ -61,17 +54,9 @@ func (e Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		case key.Matches(msg, g.Down):
 			e.viewport.SetYOffset(e.viewport.YOffset() + 1)
 		case key.Matches(msg, g.ScrollUp):
-			step := e.viewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			e.viewport.SetYOffset(e.viewport.YOffset() - step)
+			util.ScrollViewport(&e.viewport, -1)
 		case key.Matches(msg, g.ScrollDown):
-			step := e.viewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			e.viewport.SetYOffset(e.viewport.YOffset() + step)
+			util.ScrollViewport(&e.viewport, 1)
 		case key.Matches(msg, g.Help):
 			e.help.ShowAll = !e.help.ShowAll
 			e.SetSize(e.width, e.height)

internal/ui/docs/view.go

@@ -9,15 +9,15 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/glamour/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/config"
-	"github.com/anotherhadi/spilltea/internal/style"
 	"github.com/charmbracelet/x/ansi"
 )
 
 func windowStyle() lipgloss.Style {
 	return lipgloss.NewStyle().
 		Border(lipgloss.RoundedBorder()).
-		BorderForeground(style.S.Subtle).
+		BorderForeground(ilovetui.S.Subtle).
 		Padding(0, 0)
 }
 
@@ -31,7 +31,7 @@ func (e Model) View() tea.View {
 			countText = fmt.Sprintf("%d/%d", e.matchIndex+1, len(e.matches))
 		}
 		count := lipgloss.NewStyle().Padding(0, 1).
-			Foreground(style.S.MutedFg).
+			Foreground(ilovetui.S.Muted).
 			Render(countText)
 		statusBar = lipgloss.JoinHorizontal(lipgloss.Top, statusBar, count)
 	}
@@ -61,7 +61,7 @@ func (m *Model) renderMarkdown() {
 
 	width := m.viewport.Width() - 2
 	renderer, _ := glamour.NewTermRenderer(
-		glamour.WithStyles(style.GlamourStyleConfig(cfg)),
+		glamour.WithStyles(ilovetui.GlamourStyleConfig()),
 		glamour.WithWordWrap(width),
 	)
 

internal/ui/findings/model.go

@@ -11,37 +11,53 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/glamour/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/config"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 type Model struct {
 	database   *db.DB
 	findings   []db.Finding
 	cursor     int
+	hasUnread  bool
+	knownCount int
 
 	listViewport viewport.Model
 	bodyViewport viewport.Model
 	pager        paginator.Model
 	help         help.Model
 
+	renderer      *glamour.TermRenderer
+	rendererWidth int
+
 	width  int
 	height int
 }
 
 func New() Model {
 	return Model{
-		listViewport: style.NewViewport(),
-		bodyViewport: style.NewViewport(),
-		pager:        style.NewPaginator(),
-		help:         style.NewHelp(),
+		listViewport: ilovetui.NewViewport(),
+		bodyViewport: ilovetui.NewViewport(),
+		pager:        ilovetui.NewPaginator(),
+		help:         ilovetui.NewHelp(),
 	}
 }
 
 func (m Model) Init() tea.Cmd { return nil }
 
+func (m Model) HasUnread() bool { return m.hasUnread }
+func (m *Model) ClearUnread()   { m.hasUnread = false; m.knownCount = len(m.findings) }
+
+func (m *Model) CurrentMarkdown() string {
+	if len(m.findings) == 0 {
+		return ""
+	}
+	f := m.findings[m.cursor]
+	return "# " + f.Title + "\n\n" + f.Description
+}
+
 func (m *Model) SetDB(d *db.DB) {
 	m.database = d
 }
@@ -59,9 +75,9 @@ func (m *Model) recalcSizes() {
 	m.help.SetWidth(m.width - 2)
 	inner := m.width - 2
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
-	listVH := style.PanelContentH(listH) - 1 // -1 for the pager dots row
+	listVH := ilovetui.ContentHeight(listH) - 1 // -1 for the pager dots row
 	if listVH < 0 {
 		listVH = 0
 	}
@@ -72,10 +88,15 @@ func (m *Model) recalcSizes() {
 		m.pager.PerPage = 1
 	}
 
-	bodyVH := style.PanelContentH(bodyH)
+	bodyVH := ilovetui.ContentHeight(bodyH)
 	m.bodyViewport.SetWidth(inner)
 	m.bodyViewport.SetHeight(bodyVH)
 
+	if m.rendererWidth != inner {
+		m.renderer = nil
+		m.rendererWidth = 0
+	}
+
 	m.refreshListViewport()
 	m.refreshBody()
 }
@@ -104,19 +125,29 @@ type FindingsLoadedMsg struct {
 }
 
 func (m *Model) refreshBody() {
+	m.refreshBodyScroll(true)
+}
+
+func (m *Model) refreshBodyKeepScroll() {
+	m.refreshBodyScroll(false)
+}
+
+func (m *Model) refreshBodyScroll(reset bool) {
 	if len(m.findings) == 0 {
 		m.bodyViewport.SetContent("")
 		return
 	}
 	f := m.findings[m.cursor]
-	rendered := renderMarkdown(f.Description, m.bodyViewport.Width())
+	rendered := m.renderMarkdownCached(f.Description, m.bodyViewport.Width())
 	m.bodyViewport.SetContent(rendered)
+	if reset {
 		m.bodyViewport.GotoTop()
 	}
+}
 
-func renderMarkdown(src string, width int) string {
+func (m *Model) renderMarkdownCached(src string, width int) string {
 	if src == "" {
-		return style.S.Faint.Render(" (ㆆ _ ㆆ)\nno description")
+		return ilovetui.S.Faint.Render(util.CenterLines("(ㆆ _ ㆆ)", "no description"))
 	}
 	tmpl, err := template.New("").Parse(src)
 	if err != nil {
@@ -129,14 +160,21 @@ func renderMarkdown(src string, width int) string {
 	if width < 10 {
 		width = 80
 	}
+	// Rebuild renderer if width changed or not yet built.
+	if m.renderer == nil || m.rendererWidth != width {
 		r, err := glamour.NewTermRenderer(
-		glamour.WithStyles(style.GlamourStyleConfig(config.Global)),
+			glamour.WithStyles(ilovetui.GlamourStyleConfig()),
 			glamour.WithWordWrap(width),
 		)
-	if err != nil {
+		if err == nil {
+			m.renderer = r
+			m.rendererWidth = width
+		}
+	}
+	if m.renderer == nil {
 		return buf.String()
 	}
-	out, err := r.Render(buf.String())
+	out, err := m.renderer.Render(buf.String())
 	if err != nil {
 		return buf.String()
 	}
@@ -148,12 +186,12 @@ type findingsKeyMap struct{ width int }
 func (findingsKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	f := keys.Keys.Findings
-	return []key.Binding{g.Up, g.Down, f.Dismiss, g.Help}
+	return []key.Binding{g.Up, g.Down, f.Flag, f.Dismiss, f.DismissAll, g.Copy, g.Help}
 }
 
 func (m findingsKeyMap) FullHelp() [][]key.Binding {
 	g := keys.Keys.Global
-	pageGlobals := []key.Binding{g.Up, g.Down, g.ScrollUp, g.ScrollDown}
+	pageGlobals := []key.Binding{g.Up, g.Down, g.ScrollUp, g.ScrollDown, g.Copy}
 	all := append(keys.Keys.Findings.Bindings(), pageGlobals...)
 	all = append(all, g.CommonBindings()...)
 	return keys.ChunkByWidth(all, m.width)

internal/ui/findings/update.go

@@ -6,6 +6,7 @@ import (
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/keys"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -15,7 +16,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			log.Printf("findings load error: %v", msg.Err)
 			return m, nil
 		}
+		var prevID int64
+		if len(m.findings) > 0 && m.cursor < len(m.findings) {
+			prevID = m.findings[m.cursor].ID
+		}
 		m.findings = msg.Findings
+		if len(m.findings) > m.knownCount {
+			m.hasUnread = true
+		}
 		if m.cursor >= len(m.findings) {
 			m.cursor = max(0, len(m.findings)-1)
 		}
@@ -26,16 +34,19 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.pager.SetTotalPages(len(m.findings))
 		}
 		m.refreshListViewport()
+		var newID int64
+		if len(m.findings) > 0 && m.cursor < len(m.findings) {
+			newID = m.findings[m.cursor].ID
+		}
+		if newID != prevID {
 			m.refreshBody()
+		} else {
+			m.refreshBodyKeepScroll()
+		}
 		return m, nil
 
 	case tea.MouseWheelMsg:
-		switch msg.Button {
-		case tea.MouseWheelUp:
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - 1)
-		case tea.MouseWheelDown:
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + 1)
-		}
+		util.HandleMouseWheel(msg, &m.bodyViewport)
 		return m, nil
 
 	case tea.KeyPressMsg:
@@ -61,6 +72,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.refreshListViewport()
 				m.refreshBody()
 			}
+		case key.Matches(msg, f.Flag):
+			if len(m.findings) > 0 && m.database != nil {
+				if err := m.database.ToggleFindingFlag(m.findings[m.cursor].ID); err != nil {
+					log.Printf("findings: toggle flag: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, f.Dismiss):
 			if len(m.findings) > 0 && m.database != nil {
 				if err := m.database.DismissFinding(m.findings[m.cursor].ID); err != nil {
@@ -69,18 +88,42 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				return m, RefreshCmd(m.database)
 			}
+		case key.Matches(msg, f.DismissAll):
+			if m.database != nil {
+				if err := m.database.DismissAllFindings(); err != nil {
+					log.Printf("findings: dismiss all: %v", err)
+					return m, nil
+				}
+				return m, RefreshCmd(m.database)
+			}
 		case key.Matches(msg, g.ScrollUp):
-			step := m.bodyViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - step)
+			util.ScrollViewport(&m.bodyViewport, -1)
 		case key.Matches(msg, g.ScrollDown):
-			step := m.bodyViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + step)
+			util.ScrollViewport(&m.bodyViewport, 1)
+		case key.Matches(msg, g.GotoTop):
+			m.cursor = 0
+			m.pager.Page = 0
+			m.refreshListViewport()
+			m.refreshBody()
+
+		case key.Matches(msg, g.GotoBottom):
+			m.cursor = util.CursorGotoBottom(len(m.findings))
+			m.pager.Page = util.CursorGotoBottom(m.pager.TotalPages)
+			m.refreshListViewport()
+			m.refreshBody()
+
+		case key.Matches(msg, g.PrevPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.findings), m.pager.PerPage, false)
+			m.pager.Page = m.cursor / m.pager.PerPage
+			m.refreshListViewport()
+			m.refreshBody()
+
+		case key.Matches(msg, g.NextPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.findings), m.pager.PerPage, true)
+			m.pager.Page = m.cursor / m.pager.PerPage
+			m.refreshListViewport()
+			m.refreshBody()
+
 		case key.Matches(msg, g.Help):
 			m.help.ShowAll = !m.help.ShowAll
 			m.recalcSizes()

internal/ui/findings/view.go

@@ -6,6 +6,7 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/style"
 	"github.com/anotherhadi/spilltea/internal/util"
@@ -16,7 +17,7 @@ func (m Model) View() tea.View {
 		return tea.NewView("Loading...")
 	}
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	content := lipgloss.JoinVertical(lipgloss.Left,
 		m.renderListPanel(m.width, listH),
@@ -27,44 +28,35 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderListPanel(w, h int) string {
-	s := style.S
 	var dots string
 	if len(m.findings) > 0 {
-		dots = s.Faint.Render(m.pager.View())
+		dots = ilovetui.S.Faint.Render(m.pager.View())
 	}
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.listViewport.View(),
 		lipgloss.PlaceHorizontal(m.listViewport.Width(), lipgloss.Center, dots),
 	)
-	return style.RenderWithTitle(s.PanelFocused, icons.I.Findings+"Findings", inner, w, h)
+	return ilovetui.RenderWithTitle(ilovetui.S.PanelFocused, icons.I.Findings+"Findings", inner, w, h)
 }
 
 func (m *Model) renderBodyPanel(h int) string {
-	s := style.S
 	title := "Description"
 	if len(m.findings) > 0 {
 		title = m.findings[m.cursor].Title
 	}
-	return style.RenderWithTitle(s.Panel, title, m.bodyViewport.View(), m.width, h)
+	return ilovetui.RenderWithTitle(ilovetui.S.Panel, title, ilovetui.ViewportView(&m.bodyViewport), m.width, h)
 }
 
 func (m *Model) renderList() string {
-	s := style.S
 	if len(m.findings) == 0 {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			s.Faint.Render("  (҂◡_◡) ᕤ\nno findings"),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(҂◡_◡) ᕤ", "no findings")),
 		)
 	}
 
-	start, end := m.pager.GetSliceBounds(len(m.findings))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.pager, len(m.findings))
 
 	var sb strings.Builder
 	for i, f := range m.findings[start:end] {
@@ -74,39 +66,50 @@ func (m *Model) renderList() string {
 		sevStyle := style.SeverityStyle(f.Severity)
 		sevLabel := sevStyle.Width(8).Render(f.Severity)
 		ts := f.CreatedAt.Format("15:04:05")
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 8 + 1 + 8 + 1 + 10 + 1
+		const fixedW = 2 + 2 + 8 + 1 + 8 + 1 + 10 + 1
 		titleW := w - fixedW
 		if titleW < 0 {
 			titleW = 0
 		}
 
-		pluginStr := s.Faint.Width(8).Render(util.Truncate(f.PluginName, 8))
+		pluginStr := ilovetui.S.Faint.Width(8).Render(util.Truncate(f.PluginName, 8))
 
 		var line string
 		if selected {
-			bg := lipgloss.NewStyle().Background(s.Selection)
+			bg := lipgloss.NewStyle().Background(ilovetui.S.Selection)
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
-				sevStyle.Background(s.Selection).Width(8).Render(f.Severity),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
+				sevStyle.Background(ilovetui.S.Selection).Width(8).Render(f.Severity),
 				bg.Width(1).Render(""),
-				bg.Foreground(s.Subtle).Width(8).Render(util.Truncate(f.PluginName, 8)),
+				bg.Foreground(ilovetui.S.Subtle).Width(8).Render(util.Truncate(f.PluginName, 8)),
 				bg.Width(1).Render(""),
-				bg.Foreground(s.Subtle).Width(10).Render(ts),
+				bg.Foreground(ilovetui.S.Subtle).Width(10).Render(ts),
 				bg.Width(1).Render(""),
 				bg.Bold(true).Width(titleW).Render(f.Title),
 			)
 		} else {
+			flagStr := "  "
+			if f.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
+				flagSt.Width(2).Render(flagStr),
 				sevLabel,
 				" ",
 				pluginStr,
 				" ",
-				s.Faint.Width(10).Render(ts),
+				ilovetui.S.Faint.Width(10).Render(ts),
 				" ",
-				s.Bold.Render(f.Title),
+				ilovetui.S.Bold.Render(f.Title),
 			)
 		}
 		sb.WriteString(fmt.Sprintf("%s\n", line))

internal/ui/history/model.go

@@ -7,9 +7,10 @@ import (
 	"charm.land/bubbles/v2/textinput"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 type panel int
@@ -43,10 +44,10 @@ func New() Model {
 	ti := textinput.New()
 	ti.Prompt = ""
 	return Model{
-		listViewport: style.NewViewport(),
-		bodyViewport: style.NewViewport(),
-		pager:        style.NewPaginator(),
-		help:         style.NewHelp(),
+		listViewport: ilovetui.NewViewport(),
+		bodyViewport: ilovetui.NewViewport(),
+		pager:        ilovetui.NewPaginator(),
+		help:         ilovetui.NewHelp(),
 		searchInput:  ti,
 	}
 }
@@ -59,10 +60,22 @@ func (m Model) CurrentRaw() string {
 	if len(m.entries) == 0 || m.cursor >= len(m.entries) {
 		return ""
 	}
+	if m.focusedPanel == panelResponse {
+		return m.entries[m.cursor].ResponseRaw
+	}
 	return m.entries[m.cursor].RequestRaw
 }
 
-func (m Model) CurrentScheme() string { return "https" }
+func (m Model) IsResponseFocused() bool {
+	return m.focusedPanel == panelResponse
+}
+
+func (m Model) CurrentScheme() string {
+	if len(m.entries) == 0 || m.cursor >= len(m.entries) {
+		return "https"
+	}
+	return util.InferScheme(m.entries[m.cursor].Host)
+}
 
 // RefreshCmd returns the appropriate load command given the current search state.
 // The app model should call this instead of LoadEntriesCmd directly so that
@@ -111,14 +124,14 @@ func (m *Model) recalcSizes() {
 	// 2 (padding) + 2 (prefix char + space)
 	m.searchInput.SetWidth(m.width - 4)
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	inner := m.width - 2
 	if inner < 0 {
 		inner = 0
 	}
 
-	listVH := style.PanelContentH(listH) - 1 // -1 for the pager dots row
+	listVH := ilovetui.ContentHeight(listH) - 1 // -1 for the pager dots row
 	if listVH < 0 {
 		listVH = 0
 	}
@@ -129,7 +142,7 @@ func (m *Model) recalcSizes() {
 		m.pager.PerPage = 1
 	}
 
-	bodyVH := style.PanelContentH(bodyH)
+	bodyVH := ilovetui.ContentHeight(bodyH)
 	m.bodyViewport.SetWidth(inner)
 	m.bodyViewport.SetHeight(bodyVH)
 
@@ -153,7 +166,7 @@ func (m historyKeyMap) FullHelp() [][]key.Binding {
 	h := keys.Keys.History
 	g := keys.Keys.Global
 	pageGlobals := []key.Binding{g.Up, g.Down, g.CycleFocus, g.ScrollUp, g.ScrollDown, g.Left, g.Right, g.Escape, g.SendToReplay, g.SendToDiff, g.Copy, g.CopyAs}
-	all := []key.Binding{h.DeleteEntry, h.DeleteAll, h.Filter, h.SqlQuery}
+	all := []key.Binding{h.Flag, h.DeleteEntry, h.DeleteAll, h.Filter, h.SqlQuery}
 	all = append(all, pageGlobals...)
 	all = append(all, g.CommonBindings()...)
 	return keys.ChunkByWidth(all, m.width)

internal/ui/history/update.go

@@ -2,11 +2,13 @@ package history
 
 import (
 	"fmt"
+	"log"
 	"net/http"
 
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
@@ -24,7 +26,10 @@ func LoadEntriesCmd(database *db.DB) tea.Cmd {
 		if database == nil {
 			return EntriesLoadedMsg{}
 		}
-		entries, _ := database.ListEntries()
+		entries, err := database.ListEntries()
+		if err != nil {
+			log.Printf("history: load entries: %v", err)
+		}
 		return EntriesLoadedMsg{Entries: entries}
 	}
 }
@@ -36,31 +41,63 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if m.searchKind != searchKindOff && (m.searchAccepted || m.searchInput.Value() != "") {
 			return m, nil
 		}
-		prevCursor := m.cursor
+		// Remember the selected entry's ID so we can re-anchor after the list is
+		// reloaded (new entries are prepended; a pure index-based cursor would
+		// silently jump to a different entry).
+		var selectedID int64
+		if m.cursor >= 0 && m.cursor < len(m.entries) {
+			selectedID = m.entries[m.cursor].ID
+		}
 		m.entries = msg.Entries
+		entryChanged := true
+		if selectedID != 0 {
+			for i, e := range m.entries {
+				if e.ID == selectedID {
+					m.cursor = i
+					entryChanged = false
+					break
+				}
+			}
+		}
 		if m.cursor >= len(m.entries) {
 			m.cursor = len(m.entries) - 1
+			entryChanged = true
 		}
 		if m.cursor < 0 {
 			m.cursor = 0
+			entryChanged = true
 		}
 		m.pager.SetTotalPages(len(m.entries))
 		m.refreshListViewport()
 		m.refreshBody()
-		if m.cursor != prevCursor {
+		if entryChanged {
 			m.bodyViewport.SetYOffset(0)
 			m.bodyViewport.SetXOffset(0)
 		}
 
 	case SearchResultMsg:
+		var selectedID int64
+		if m.cursor >= 0 && m.cursor < len(m.entries) {
+			selectedID = m.entries[m.cursor].ID
+		}
 		m.entries = msg.Entries
 		m.cursor = 0
+		if selectedID != 0 {
+			for i, e := range m.entries {
+				if e.ID == selectedID {
+					m.cursor = i
+					break
+				}
+			}
+		}
 		m.searchErr = ""
 		m.pager.SetTotalPages(len(m.entries))
 		m.refreshListViewport()
 		m.refreshBody()
+		if selectedID == 0 {
 			m.bodyViewport.SetYOffset(0)
 			m.bodyViewport.SetXOffset(0)
+		}
 		if m.searchKind == searchKindSQL {
 			m.acceptSearch()
 		}
@@ -75,31 +112,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.bodyViewport.SetXOffset(0)
 
 	case tea.MouseWheelMsg:
-		switch msg.Button {
-		case tea.MouseWheelUp:
-			if msg.Mod.Contains(tea.ModShift) {
-				m.bodyViewport.ScrollLeft(6)
-			} else {
-				m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - 1)
-			}
-		case tea.MouseWheelDown:
-			if msg.Mod.Contains(tea.ModShift) {
-				m.bodyViewport.ScrollRight(6)
-			} else {
-				m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + 1)
-			}
-		case tea.MouseWheelLeft:
-			m.bodyViewport.ScrollLeft(6)
-		case tea.MouseWheelRight:
-			m.bodyViewport.ScrollRight(6)
-		}
+		util.HandleMouseWheel(msg, &m.bodyViewport)
 
 	case tea.KeyPressMsg:
 		h := keys.Keys.History
 		g := keys.Keys.Global
 
 		if m.searchKind != searchKindOff && !m.searchAccepted {
-			// Actively typing: only search navigation + accept/cancel.
 			switch {
 			case key.Matches(msg, g.Escape):
 				return m, m.clearSearch()
@@ -110,24 +129,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 				m.acceptSearch()
 
-			case key.Matches(msg, g.Up):
-				if m.cursor > 0 {
-					m.cursor--
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
-			case key.Matches(msg, g.Down):
-				if m.cursor < len(m.entries)-1 {
-					m.cursor++
-					m.refreshListViewport()
-					m.refreshBody()
-					m.bodyViewport.SetYOffset(0)
-					m.bodyViewport.SetXOffset(0)
-				}
-
 			default:
 				var cmd tea.Cmd
 				m.searchInput, cmd = m.searchInput.Update(msg)
@@ -230,11 +231,21 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				}
 			}
 
+		case key.Matches(msg, h.Flag):
+			if len(m.entries) > 0 && m.database != nil {
+				if err := m.database.ToggleFlag(m.entries[m.cursor].ID); err != nil {
+					log.Printf("history: toggle flag: %v", err)
+				}
+				return m, m.RefreshCmd()
+			}
+
 		case key.Matches(msg, h.DeleteEntry):
 			if len(m.entries) > 0 {
 				id := m.entries[m.cursor].ID
 				if m.database != nil {
-					m.database.DeleteEntry(id)
+					if err := m.database.DeleteEntry(id); err != nil {
+						log.Printf("history: delete entry: %v", err)
+					}
 				}
 				return m, LoadEntriesCmd(m.database)
 			}
@@ -242,28 +253,34 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		case key.Matches(msg, h.DeleteAll):
 			if m.database != nil {
 				if m.searchKind != searchKindOff {
+					hasUnflagged := false
 					for _, e := range m.entries {
-						m.database.DeleteEntry(e.ID)
+						if !e.Flagged {
+							hasUnflagged = true
+							break
+						}
+					}
+					for _, e := range m.entries {
+						if hasUnflagged && e.Flagged {
+							continue
+						}
+						if err := m.database.DeleteEntry(e.ID); err != nil {
+							log.Printf("history: delete entry: %v", err)
+						}
 					}
 				} else {
-					m.database.DeleteAllEntries()
+					if err := m.database.DeleteAllExceptFlagged(); err != nil {
+						log.Printf("history: delete all unflagged: %v", err)
+					}
 				}
 			}
 			return m, m.clearSearch()
 
 		case key.Matches(msg, g.ScrollUp):
-			step := m.bodyViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - step)
+			util.ScrollViewport(&m.bodyViewport, -1)
 
 		case key.Matches(msg, g.ScrollDown):
-			step := m.bodyViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + step)
+			util.ScrollViewport(&m.bodyViewport, 1)
 
 		case key.Matches(msg, g.Left):
 			m.bodyViewport.ScrollLeft(6)
@@ -271,6 +288,35 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		case key.Matches(msg, g.Right):
 			m.bodyViewport.ScrollRight(6)
 
+		case key.Matches(msg, g.GotoTop):
+			m.cursor = 0
+			m.pager.Page = 0
+			m.refreshListViewport()
+			m.refreshBody()
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+
+		case key.Matches(msg, g.GotoBottom):
+			m.cursor = util.CursorGotoBottom(len(m.entries))
+			m.refreshListViewport()
+			m.refreshBody()
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+
+		case key.Matches(msg, g.PrevPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.entries), m.pager.PerPage, false)
+			m.refreshListViewport()
+			m.refreshBody()
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+
+		case key.Matches(msg, g.NextPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.entries), m.pager.PerPage, true)
+			m.refreshListViewport()
+			m.refreshBody()
+			m.bodyViewport.SetYOffset(0)
+			m.bodyViewport.SetXOffset(0)
+
 		case key.Matches(msg, keys.Keys.Global.Help):
 			m.help.ShowAll = !m.help.ShowAll
 			m.recalcSizes()
@@ -307,7 +353,7 @@ func (m *Model) refreshBody() {
 	}
 	if raw == "" {
 		w, h := m.bodyViewport.Width(), m.bodyViewport.Height()
-		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, style.S.Faint.Render("      (˘･_･˘)\nno response stored")))
+		m.bodyViewport.SetContent(lipgloss.Place(w, h, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(w, "(˘･_･˘)", "no response stored"))))
 		return
 	}
 	m.bodyViewport.SetContent(style.HighlightHTTP(raw))

internal/ui/history/view.go

@@ -6,9 +6,11 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) View() tea.View {
@@ -16,7 +18,7 @@ func (m Model) View() tea.View {
 		return tea.NewView("Loading...")
 	}
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	content := lipgloss.JoinVertical(lipgloss.Left,
 		m.renderListPanel(m.width, listH),
@@ -27,92 +29,82 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderListPanel(w, h int) string {
-	s := style.S
 	var dots string
 	if len(m.entries) > 0 {
-		dots = s.Faint.Render(m.pager.View())
+		dots = ilovetui.S.Faint.Render(m.pager.View())
 	}
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.listViewport.View(),
 		lipgloss.PlaceHorizontal(m.listViewport.Width(), lipgloss.Center, dots),
 	)
-	return style.RenderWithTitle(s.PanelFocused, icons.I.History+"History", inner, w, h)
+	return ilovetui.RenderWithTitle(ilovetui.S.PanelFocused, icons.I.History+"History", inner, w, h)
 }
 
 func (m *Model) renderBodyPanel(h int) string {
-	s := style.S
 	title := icons.I.Request + "Request"
 	if m.focusedPanel == panelResponse {
 		title = icons.I.Response + "Response"
 	}
-	return style.RenderWithTitle(s.Panel, title, m.bodyViewport.View(), m.width, h)
+	return ilovetui.RenderWithTitle(ilovetui.S.Panel, title, ilovetui.ViewportView(&m.bodyViewport), m.width, h)
 }
 
 func (m *Model) renderStatusBar() string {
-	s := style.S
 	pad := lipgloss.NewStyle().Padding(0, 1)
 	escKey := keys.Keys.Global.Escape.Help().Key
 	switch m.searchKind {
 	case searchKindFulltext:
 		filterKey := keys.Keys.History.Filter.Help().Key
 		if m.searchAccepted {
-			accent := lipgloss.NewStyle().Foreground(s.Primary)
-			filterLine := pad.Render(accent.Render(filterKey) + " " + s.Bold.Render(m.searchInput.Value()) + s.Faint.Render("  "+escKey+" to clear"))
+			accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+			filterLine := pad.Render(accent.Render(filterKey) + " " + ilovetui.S.Bold.Render(m.searchInput.Value()) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
 			return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(historyKeyMap{width: m.width})))
 		}
-		return pad.Render(s.Faint.Render(filterKey) + " " + m.searchInput.View())
+		return pad.Render(ilovetui.S.Faint.Render(filterKey) + " " + m.searchInput.View())
 	case searchKindSQL:
 		sqlKey := keys.Keys.History.SqlQuery.Help().Key
 		if m.searchAccepted {
-			accent := lipgloss.NewStyle().Foreground(s.Primary)
-			filterLine := pad.Render(accent.Render(sqlKey) + " " + s.Bold.Render(m.searchInput.Value()) + s.Faint.Render("  "+escKey+" to clear"))
+			accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+			filterLine := pad.Render(accent.Render(sqlKey) + " " + ilovetui.S.Bold.Render(m.searchInput.Value()) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
 			return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(historyKeyMap{width: m.width})))
 		}
-		return pad.Render(s.Faint.Render(sqlKey) + " " + m.searchInput.View())
+		return pad.Render(ilovetui.S.Faint.Render(sqlKey) + " " + m.searchInput.View())
 	default:
 		return pad.Render(m.help.View(historyKeyMap{width: m.width}))
 	}
 }
 
 func (m *Model) renderList() string {
-	s := style.S
 	if m.searchErr != "" {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			lipgloss.NewStyle().Foreground(s.Error).Render(m.searchErr),
+			lipgloss.NewStyle().Foreground(ilovetui.S.Error).Render(m.searchErr),
 		)
 	}
 	if len(m.entries) == 0 {
-		msg := "    (⌐■_■)\nno history yet"
+		msg := util.EmptyState(m.listViewport.Width(), "(⌐■_■)", "no history yet")
 		if m.searchKind != searchKindOff {
-			msg = "ʕノ•ᴥ•ʔノ ︵ ┻━┻\n   no results"
+			msg = util.EmptyState(m.listViewport.Width(), "ʕノ•ᴥ•ʔノ ︵ ┻━┻", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			s.Faint.Render(msg),
+			ilovetui.S.Faint.Render(msg),
 		)
 	}
 
-	start, end := m.pager.GetSliceBounds(len(m.entries))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.pager, len(m.entries))
 
 	var sb strings.Builder
 	for i, e := range m.entries[start:end] {
 		globalIdx := start + i
 		selected := globalIdx == m.cursor
 
-		selBg := s.Selection
+		selBg := ilovetui.S.Selection
 		w := m.listViewport.Width()
 
 		statusStr := fmt.Sprintf("%3d", e.StatusCode)
-		const fixedW = 2 + 7 + 1 + 3 + 1 + 10 + 1
+		const fixedW = 2 + 2 + 7 + 1 + 3 + 1 + 10 + 1
 		hostPathW := w - fixedW
 		if hostPathW < 0 {
 			hostPathW = 0
@@ -120,31 +112,42 @@ func (m *Model) renderList() string {
 
 		ts := e.Timestamp.Format("15:04:05")
 		statusSt := style.StatusStyle(e.StatusCode, 3)
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
-				s.Method(e.Method).Background(selBg).Render(e.Method),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
+				style.S.Method(e.Method).Background(selBg).Render(e.Method),
 				bg.Width(1).Render(""),
 				statusSt.Background(selBg).Render(statusStr),
 				bg.Width(1).Render(""),
-				bg.Foreground(s.Subtle).Width(10).Render(ts),
+				bg.Foreground(ilovetui.S.Subtle).Width(10).Render(ts),
 				bg.Width(1).Render(""),
 				bg.Bold(true).Width(hostPathW).Render(e.Host+e.Path),
 			)
 		} else {
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
-				s.Method(e.Method).Render(e.Method),
+				flagSt.Width(2).Render(flagStr),
+				style.S.Method(e.Method).Render(e.Method),
 				" ",
 				statusSt.Render(statusStr),
 				" ",
-				s.Faint.Width(10).Render(ts),
+				ilovetui.S.Faint.Width(10).Render(ts),
 				" ",
-				s.Bold.Render(e.Host),
-				s.Faint.Render(e.Path),
+				ilovetui.S.Bold.Render(e.Host),
+				ilovetui.S.Faint.Render(e.Path),
 			)
 		}
 		sb.WriteString(line + "\n")

internal/ui/home/model.go

@@ -14,10 +14,10 @@ import (
 	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
 	"github.com/anotherhadi/spilltea/internal/ui/components/teapot"
 )
 
@@ -88,19 +88,18 @@ type homeDelegate struct {
 }
 
 func newHomeDelegate() homeDelegate {
-	s := style.S
 	leftBorder := lipgloss.Border{Left: "│"}
 	return homeDelegate{
-		normalTitle: lipgloss.NewStyle().Foreground(s.Text).PaddingLeft(4),
-		normalDesc:  lipgloss.NewStyle().Foreground(s.Subtle).Faint(true).PaddingLeft(4),
+		normalTitle: lipgloss.NewStyle().Foreground(ilovetui.S.Text).PaddingLeft(4),
+		normalDesc:  lipgloss.NewStyle().Foreground(ilovetui.S.Subtle).Faint(true).PaddingLeft(4),
 		selectedTitle: lipgloss.NewStyle().
 			Border(leftBorder, false, false, false, true).
-			BorderForeground(s.Primary).
-			Foreground(s.Primary).Bold(true).PaddingLeft(3),
+			BorderForeground(ilovetui.S.Primary).
+			Foreground(ilovetui.S.Primary).Bold(true).PaddingLeft(3),
 		selectedDesc: lipgloss.NewStyle().
 			Border(leftBorder, false, false, false, true).
-			BorderForeground(s.Primary).
-			Foreground(s.MutedFg).PaddingLeft(3),
+			BorderForeground(ilovetui.S.Primary).
+			Foreground(ilovetui.S.Muted).PaddingLeft(3),
 		filterMatch: lipgloss.NewStyle().Underline(true),
 	}
 }
@@ -142,6 +141,11 @@ type Project struct {
 	ModTime time.Time
 }
 
+// ProjectSelectedMsg is emitted when the user picks a project from the home screen.
+type ProjectSelectedMsg struct {
+	Project *Project
+}
+
 type inputMode int
 
 const (
@@ -161,16 +165,11 @@ type Model struct {
 	list        list.Model
 	projectDir  string
 	nameInput   textinput.Model
-	selected    *Project
 	width       int
 	height      int
 	teapotFrame int
 }
 
-// Selected returns the project chosen by the user, or nil if the program was
-// quit without making a selection.
-func (m Model) Selected() *Project { return m.selected }
-
 func New(projectDir string) Model {
 	projects := loadProjects(projectDir)
 
@@ -304,14 +303,13 @@ func buildItems(projects []Project) []list.Item {
 }
 
 func (m Model) renderHelpLine() string {
-	s := style.S
 	k := keys.Keys.Home
 	fs := m.list.FilterState()
 
-	kStyle := lipgloss.NewStyle().Foreground(s.MutedFg).Inline(true)
-	dStyle := s.Faint.Inline(true)
+	kStyle := lipgloss.NewStyle().Foreground(ilovetui.S.Muted).Inline(true)
+	dStyle := ilovetui.S.Faint.Inline(true)
 
-	sep := s.Faint.Inline(true).Render(" • ")
+	sep := ilovetui.S.Faint.Inline(true).Render(" • ")
 	item := func(keyStr, desc string) string {
 		return kStyle.Render(keyStr) + " " + dStyle.Render(desc)
 	}
@@ -320,19 +318,20 @@ func (m Model) renderHelpLine() string {
 	}
 
 	var parts []string
+	escKey := keys.Keys.Global.Escape.Help().Key
 	if fs == list.Filtering {
 		parts = append(parts, item("enter", "apply filter"))
-		parts = append(parts, item("esc", "cancel"))
+		parts = append(parts, item(escKey, "cancel"))
 	} else {
 		parts = append(parts, item("↑/↓", "navigate"))
 		if fs == list.FilterApplied {
-			parts = append(parts, item("esc", "clear filter"))
+			parts = append(parts, item(escKey, "clear filter"))
 		} else {
 			parts = append(parts, binding(k.Filter))
 		}
 		parts = append(parts, binding(k.Open))
 		parts = append(parts, binding(k.Delete))
-		parts = append(parts, item("q", "quit"))
+		parts = append(parts, item(keys.Keys.Global.Quit.Help().Key, "quit"))
 	}
 
 	return strings.Join(parts, sep)

internal/ui/home/update.go

@@ -3,6 +3,7 @@ package home
 import (
 	crypto "crypto/rand"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,15 +73,16 @@ func (m Model) handleSelection() (tea.Model, tea.Cmd) {
 		return m, m.nameInput.Focus()
 	case kindTemp:
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create temp dir: %v", err)
 			return m, nil
 		}
 		initProjectFiles(dir)
-		m.selected = &Project{Name: "temporary", Path: filepath.Join(dir, "data.db")}
-		return m, tea.Quit
+		p := &Project{Name: "temporary", Path: filepath.Join(dir, "data.db")}
+		return m, func() tea.Msg { return ProjectSelectedMsg{Project: p} }
 	default:
-		m.selected = &Project{Name: item.name, Path: item.path}
-		return m, tea.Quit
+		p := &Project{Name: item.name, Path: item.path}
+		return m, func() tea.Msg { return ProjectSelectedMsg{Project: p} }
 	}
 }
 
@@ -90,7 +92,9 @@ func (m Model) deleteSelected() (tea.Model, tea.Cmd) {
 		return m, nil
 	}
 	dir := filepath.Dir(item.path) // parent dir of data.db
-	os.RemoveAll(dir)
+	if err := os.RemoveAll(dir); err != nil {
+		log.Printf("home: remove project dir: %v", err)
+	}
 	idx := m.list.GlobalIndex()
 	m.list.RemoveItem(idx)
 	if idx > 0 && idx >= len(m.list.Items()) {
@@ -113,12 +117,13 @@ func (m Model) updateNaming(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.mode = modeSelect
 		m.nameInput.Blur()
 		dir := filepath.Join(m.projectDir, name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			log.Printf("home: create project dir %q: %v", name, err)
 			return m, nil
 		}
 		initProjectFiles(dir)
-		m.selected = &Project{Name: name, Path: filepath.Join(dir, "data.db")}
-		return m, tea.Quit
+		p := &Project{Name: name, Path: filepath.Join(dir, "data.db")}
+		return m, func() tea.Msg { return ProjectSelectedMsg{Project: p} }
 	default:
 		var cmd tea.Cmd
 		m.nameInput, cmd = m.nameInput.Update(msg)
@@ -138,23 +143,23 @@ func sanitizeName(s string) string {
 }
 
 func IsValidProjectName(s string) bool {
-	if s == "tmp" {
+	if s == "tmp" || s == "temp" || s == "temporary" {
 		return true
 	}
 	return s != "" && s == sanitizeName(s)
 }
 
 func OpenProject(projectDir, name string) (*Project, error) {
-	if name == "tmp" {
+	if name == "tmp" || name == "temp" || name == "temporary" {
 		dir := tempDir()
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
 			return nil, err
 		}
 		initProjectFiles(dir)
 		return &Project{Name: "temporary", Path: filepath.Join(dir, "data.db")}, nil
 	}
 	dir := filepath.Join(projectDir, name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, err
 	}
 	initProjectFiles(dir)
@@ -171,9 +176,11 @@ func initProjectFiles(dir string) {
 	for _, name := range []string{"data.db", "logs.log"} {
 		p := filepath.Join(dir, name)
 		if _, err := os.Stat(p); os.IsNotExist(err) {
-			f, err := os.Create(p)
+			f, err := os.Create(p) // #nosec G304 -- p is filepath.Join(dir, hardcoded_name), no traversal possible
 			if err == nil {
-				f.Close()
+				if cerr := f.Close(); cerr != nil {
+					log.Printf("home: close project file: %v", cerr)
+				}
 			}
 		}
 	}

internal/ui/home/view.go

@@ -5,29 +5,29 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/style"
+	ilovetui "github.com/anotherhadi/ilovetui"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/ui/components/teapot"
 )
 
 const inputPanelMaxW = 44
 
 func (m Model) View() tea.View {
-	s := style.S
 	iw := m.innerW()
 
 	var sb strings.Builder
 	sb.WriteString("\n")
 	if m.height > teapotMinH {
 		frames := teapot.TeapotFrames()
-		frame := lipgloss.NewStyle().Foreground(s.Primary).Render(frames[m.teapotFrame])
+		frame := lipgloss.NewStyle().Foreground(ilovetui.S.Primary).Render(frames[m.teapotFrame])
 		sb.WriteString(center(iw, frame))
 		sb.WriteString("\n\n")
 	} else {
 		sb.WriteString("\n")
 	}
-	sb.WriteString(center(iw, lipgloss.NewStyle().Bold(true).Foreground(s.Primary).Render("SPILLTEA")))
+	sb.WriteString(center(iw, lipgloss.NewStyle().Bold(true).Foreground(ilovetui.S.Primary).Render("SPILLTEA")))
 	sb.WriteString("\n")
-	sb.WriteString(center(iw, s.Faint.Render("choose a project to get started")))
+	sb.WriteString(center(iw, ilovetui.S.Faint.Render("choose a project to get started")))
 	sb.WriteString("\n\n")
 
 	if m.mode == modeNaming {
@@ -46,11 +46,11 @@ func (m Model) View() tea.View {
 	v := tea.NewView(content)
 	v.AltScreen = true
 	v.MouseMode = tea.MouseModeCellMotion
+	v.WindowTitle = "Spilltea"
 	return v
 }
 
 func (m Model) renderNamingPanel() string {
-	s := style.S
 	iw := m.innerW()
 
 	panelW := inputPanelMaxW
@@ -63,15 +63,16 @@ func (m Model) renderNamingPanel() string {
 	innerW := inputPanelInnerW(iw)
 	inputLine := lipgloss.NewStyle().Width(innerW).Render(m.nameInput.View())
 
-	label := lipgloss.NewStyle().Foreground(s.MutedFg).Render("Project name")
+	label := lipgloss.NewStyle().Foreground(ilovetui.S.Muted).Render("Project name")
 	panel := lipgloss.NewStyle().
 		Border(lipgloss.RoundedBorder()).
-		BorderForeground(s.Primary).
+		BorderForeground(ilovetui.S.Primary).
 		Padding(1, 2).
 		Width(panelW).
 		Render(label + "\n" + inputLine)
 
-	hint := s.Faint.Render("[enter] confirm  [esc] cancel")
+	escKey := keys.Keys.Global.Escape.Help().Key
+	hint := ilovetui.S.Faint.Render("[enter] confirm  [" + escKey + "] cancel")
 
 	var sb strings.Builder
 	sb.WriteString(center(iw, panel))

internal/ui/intercept/helpers.go

@@ -4,114 +4,46 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"sort"
 	"strconv"
 	"strings"
 
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/intercept"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
-func formatRawRequest(req *intercept.PendingRequest) string {
-	r := req.Flow.Request
-	var sb strings.Builder
-
-	fmt.Fprintf(&sb, "%s %s %s\n", r.Method, r.URL.RequestURI(), r.Proto)
-
-	keys := make([]string, 0, len(r.Header))
-	for k := range r.Header {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		for _, v := range r.Header[k] {
-			fmt.Fprintf(&sb, "%s: %s\n", k, v)
-		}
-	}
-
-	sb.WriteString("\n")
-	if len(r.Body) > 0 {
-		sb.Write(r.Body)
-	}
-	return sb.String()
-}
-
-func formatRawResponse(resp *intercept.PendingResponse) string {
-	r := resp.Flow.Response
-	if r == nil {
-		return "(no response)"
-	}
-	var sb strings.Builder
-
-	proto := resp.Flow.Request.Proto
-	if proto == "" {
-		proto = "HTTP/1.1"
-	}
-	fmt.Fprintf(&sb, "%s %d %s\n", proto, r.StatusCode, http.StatusText(r.StatusCode))
-
-	keys := make([]string, 0, len(r.Header))
-	for k := range r.Header {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		for _, v := range r.Header[k] {
-			fmt.Fprintf(&sb, "%s: %s\n", k, v)
-		}
-	}
-
-	sb.WriteString("\n")
-	if len(r.Body) > 0 {
-		sb.Write(r.Body)
-	}
-	return sb.String()
-}
-
 func parseRawRequest(content string, req *intercept.PendingRequest) {
+	parsed := util.ParseRawRequest(content)
 	r := req.Flow.Request
-	lines := strings.Split(strings.ReplaceAll(content, "\r\n", "\n"), "\n")
-	if len(lines) == 0 {
-		return
+	if parsed.Method != "" {
+		r.Method = parsed.Method
 	}
-
-	parts := strings.SplitN(lines[0], " ", 3)
-	if len(parts) >= 1 {
-		r.Method = strings.TrimSpace(parts[0])
-	}
-	if len(parts) >= 2 {
-		if u, err := url.ParseRequestURI(strings.TrimSpace(parts[1])); err == nil {
+	if parsed.Path != "" {
+		if u, err := url.ParseRequestURI(parsed.Path); err == nil {
 			r.URL.Path = u.Path
 			r.URL.RawQuery = u.RawQuery
 		}
 	}
-	if len(parts) >= 3 {
-		r.Proto = strings.TrimSpace(parts[2])
+	if parsed.Proto != "" {
+		r.Proto = parsed.Proto
+	}
+	if parsed.Host != "" {
+		r.URL.Host = parsed.Host
 	}
-
 	r.Header = make(http.Header)
-	i := 1
-	for i < len(lines) {
-		line := strings.TrimRight(lines[i], "\r")
-		if line == "" {
-			i++
-			break
+	for _, h := range parsed.Headers {
+		if strings.EqualFold(h.Key, "host") {
+			continue
 		}
-		if kv := strings.SplitN(line, ": ", 2); len(kv) == 2 {
-			r.Header.Set(strings.TrimSpace(kv[0]), strings.TrimSpace(kv[1]))
+		r.Header.Set(h.Key, h.Value)
 	}
-		i++
-	}
-
-	if i < len(lines) {
-		body := strings.Join(lines[i:], "\n")
-		body = strings.TrimRight(body, "\n")
-		if body != "" {
-			r.Body = []byte(body)
+	if parsed.Body != "" {
+		r.Body = []byte(parsed.Body)
 	} else {
 		r.Body = nil
 	}
 }
-}
 
 func parseRawResponse(content string, resp *intercept.PendingResponse) {
 	r := resp.Flow.Response
@@ -232,20 +164,20 @@ func (m *Model) listHalfWidths() (leftW, rightW int) {
 func (m *Model) recalcSizes() {
 	m.help.SetWidth(m.width - 2)
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	bodyInner := m.width - 2
 	if bodyInner < 0 {
 		bodyInner = 0
 	}
-	bodyVH := style.PanelContentH(bodyH)
+	bodyVH := ilovetui.ContentHeight(bodyH)
 
 	m.textarea.SetWidth(bodyInner)
 	m.textarea.SetHeight(bodyVH)
 	m.bodyViewport.SetWidth(bodyInner)
 	m.bodyViewport.SetHeight(bodyVH)
 
-	listVH := style.PanelContentH(listH) - 1 // -1 for the pager dots row
+	listVH := ilovetui.ContentHeight(listH) - 1 // -1 for the pager dots row
 	if listVH < 0 {
 		listVH = 0
 	}
@@ -343,7 +275,7 @@ func (m *Model) loadIntoTextarea() {
 		if edited, ok := m.pendingResponseEdits[resp]; ok {
 			m.textarea.SetValue(edited)
 		} else {
-			m.textarea.SetValue(formatRawResponse(resp))
+			m.textarea.SetValue(intercept.FormatRawResponse(resp.Flow))
 		}
 	} else {
 		if len(m.queue) == 0 {
@@ -353,7 +285,7 @@ func (m *Model) loadIntoTextarea() {
 		if edited, ok := m.pendingEdits[req]; ok {
 			m.textarea.SetValue(edited)
 		} else {
-			m.textarea.SetValue(formatRawRequest(req))
+			m.textarea.SetValue(intercept.FormatRawRequest(req.Flow))
 		}
 	}
 }
@@ -370,7 +302,7 @@ func (m *Model) refreshBody() {
 		if edited, ok := m.pendingResponseEdits[resp]; ok {
 			raw = edited
 		} else {
-			raw = formatRawResponse(resp)
+			raw = intercept.FormatRawResponse(resp.Flow)
 		}
 	} else {
 		if len(m.queue) == 0 {
@@ -381,7 +313,7 @@ func (m *Model) refreshBody() {
 		if edited, ok := m.pendingEdits[req]; ok {
 			raw = edited
 		} else {
-			raw = formatRawRequest(req)
+			raw = intercept.FormatRawRequest(req.Flow)
 		}
 	}
 	m.bodyViewport.SetContent(style.HighlightHTTP(raw))

internal/ui/intercept/keymap.go

@@ -1,29 +1,18 @@
 package intercept
 
 import (
-	"charm.land/bubbles/v2/help"
 	"charm.land/bubbles/v2/key"
-	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
 )
 
-func newHelp() help.Model { return style.NewHelp() }
-
 type interceptKeyMap struct{ width int }
 
-func iconBinding(b key.Binding, icon string) key.Binding {
-	h := b.Help()
-	return key.NewBinding(key.WithKeys(b.Keys()...), key.WithHelp(h.Key, icon+h.Desc))
-}
-
 func (interceptKeyMap) ShortHelp() []key.Binding {
 	ic := keys.Keys.Intercept
-	i := icons.I
 	return []key.Binding{
-		iconBinding(ic.Forward, i.Forward),
-		iconBinding(ic.Drop, i.Drop),
-		iconBinding(ic.Edit, i.Edit),
+		ic.Forward,
+		ic.Drop,
+		ic.Edit,
 		keys.Keys.Global.Help,
 	}
 }

internal/ui/intercept/model.go

@@ -6,9 +6,9 @@ import (
 	"charm.land/bubbles/v2/textarea"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/config"
 	"github.com/anotherhadi/spilltea/internal/intercept"
-	"github.com/anotherhadi/spilltea/internal/style"
 )
 
 type panel int
@@ -30,6 +30,7 @@ type Model struct {
 
 	editing              bool
 	interceptEnabled     bool
+	hasUnread            bool
 	pendingEdits         map[*intercept.PendingRequest]string
 	pendingResponseEdits map[*intercept.PendingResponse]string
 
@@ -47,14 +48,14 @@ type Model struct {
 
 func New(broker *intercept.Broker) Model {
 	cfg := config.Global
-	ta := style.NewTextarea(false)
+	ta := ilovetui.NewTextarea(false)
 	ta.Blur()
 
-	lv := style.NewViewport()
-	rv := style.NewViewport()
-	bv := style.NewViewport()
-	p := style.NewPaginator()
-	rp := style.NewPaginator()
+	lv := ilovetui.NewViewport()
+	rv := ilovetui.NewViewport()
+	bv := ilovetui.NewViewport()
+	p := ilovetui.NewPaginator()
+	rp := ilovetui.NewPaginator()
 
 	broker.SetCaptureResponse(cfg.Intercept.DefaultCaptureResponse)
 
@@ -68,7 +69,7 @@ func New(broker *intercept.Broker) Model {
 		textarea:             ta,
 		pager:                p,
 		responsePager:        rp,
-		help:                 newHelp(),
+		help:                 ilovetui.NewHelp(),
 		pendingEdits:         make(map[*intercept.PendingRequest]string),
 		pendingResponseEdits: make(map[*intercept.PendingResponse]string),
 	}
@@ -76,8 +77,15 @@ func New(broker *intercept.Broker) Model {
 
 func (m Model) Init() tea.Cmd { return nil }
 
+func (m Model) HasUnread() bool { return m.hasUnread }
+func (m *Model) ClearUnread()   { m.hasUnread = false }
+
 func (m Model) IsEditing() bool { return m.editing }
 
+func (m Model) IsResponseFocused() bool {
+	return m.captureResponse && m.focusedPanel == panelResponses
+}
+
 func (m Model) CurrentScheme() string {
 	if len(m.queue) == 0 {
 		return "https"
@@ -98,7 +106,7 @@ func (m Model) CurrentRaw() string {
 		if edited, ok := m.pendingResponseEdits[resp]; ok {
 			return edited
 		}
-		return formatRawResponse(resp)
+		return intercept.FormatRawResponse(resp.Flow)
 	}
 	if len(m.queue) == 0 {
 		return ""
@@ -107,7 +115,7 @@ func (m Model) CurrentRaw() string {
 	if edited, ok := m.pendingEdits[req]; ok {
 		return edited
 	}
-	return formatRawRequest(req)
+	return intercept.FormatRawRequest(req.Flow)
 }
 
 func (m *Model) SetSize(w, h int) {

internal/ui/intercept/update.go

@@ -31,6 +31,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 		wasEmpty := len(m.queue) == 0
 		m.queue = append(m.queue, msg.Req)
+		m.hasUnread = true
 		m.refreshListViewport()
 		if wasEmpty && (!m.captureResponse || m.focusedPanel == panelRequests) {
 			m.refreshBody()
@@ -52,24 +53,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	case tea.MouseWheelMsg:
 		if !m.editing {
-			switch msg.Button {
-			case tea.MouseWheelUp:
-				if msg.Mod.Contains(tea.ModShift) {
-					m.bodyViewport.ScrollLeft(6)
-				} else {
-					m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - 1)
-				}
-			case tea.MouseWheelDown:
-				if msg.Mod.Contains(tea.ModShift) {
-					m.bodyViewport.ScrollRight(6)
-				} else {
-					m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + 1)
-				}
-			case tea.MouseWheelLeft:
-				m.bodyViewport.ScrollLeft(6)
-			case tea.MouseWheelRight:
-				m.bodyViewport.ScrollRight(6)
-			}
+			util.HandleMouseWheel(msg, &m.bodyViewport)
 		}
 
 	case tea.KeyPressMsg:
@@ -127,18 +111,10 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 		}
 
 	case key.Matches(msg, keys.Keys.Global.ScrollUp):
-		step := m.bodyViewport.Height() / 2
-		if step < 1 {
-			step = 1
-		}
-		m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() - step)
+		util.ScrollViewport(&m.bodyViewport, -1)
 
 	case key.Matches(msg, keys.Keys.Global.ScrollDown):
-		step := m.bodyViewport.Height() / 2
-		if step < 1 {
-			step = 1
-		}
-		m.bodyViewport.SetYOffset(m.bodyViewport.YOffset() + step)
+		util.ScrollViewport(&m.bodyViewport, 1)
 
 	case key.Matches(msg, keys.Keys.Global.Left):
 		m.bodyViewport.ScrollLeft(6)
@@ -146,9 +122,6 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 	case key.Matches(msg, keys.Keys.Global.Right):
 		m.bodyViewport.ScrollRight(6)
 
-	case key.Matches(msg, keys.Keys.Global.Quit):
-		return m, tea.Quit
-
 	case key.Matches(msg, keys.Keys.Intercept.UndoEdits):
 		if onResponses {
 			if len(m.responseQueue) > 0 {
@@ -237,10 +210,10 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 
 	case key.Matches(msg, keys.Keys.Intercept.EditExternal):
 		if !onResponses && len(m.queue) > 0 {
-			return m, util.OpenExternalEditor(formatRawRequest(m.queue[m.cursor]))
+			return m, util.OpenExternalEditor(intercept.FormatRawRequest(m.queue[m.cursor].Flow))
 		}
 		if onResponses && len(m.responseQueue) > 0 {
-			return m, util.OpenExternalEditor(formatRawResponse(m.responseQueue[m.responseCursor]))
+			return m, util.OpenExternalEditor(intercept.FormatRawResponse(m.responseQueue[m.responseCursor].Flow))
 		}
 
 	case key.Matches(msg, keys.Keys.Global.SendToReplay):
@@ -268,14 +241,52 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model
 				return diffUI.SendToDiffMsg{Label: label, Raw: raw}
 			}
 		}
+
+	case key.Matches(msg, keys.Keys.Global.GotoTop):
+		if onResponses {
+			m.responseCursor = 0
+		} else {
+			m.cursor = 0
+		}
+		m.refreshListViewport()
+		m.refreshResponseListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, keys.Keys.Global.GotoBottom):
+		if onResponses {
+			m.responseCursor = util.CursorGotoBottom(len(m.responseQueue))
+		} else {
+			m.cursor = util.CursorGotoBottom(len(m.queue))
+		}
+		m.refreshListViewport()
+		m.refreshResponseListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, keys.Keys.Global.PrevPage):
+		if onResponses {
+			m.responseCursor = util.CursorMovePage(m.responseCursor, len(m.responseQueue), m.responsePager.PerPage, false)
+		} else {
+			m.cursor = util.CursorMovePage(m.cursor, len(m.queue), m.pager.PerPage, false)
+		}
+		m.refreshListViewport()
+		m.refreshResponseListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, keys.Keys.Global.NextPage):
+		if onResponses {
+			m.responseCursor = util.CursorMovePage(m.responseCursor, len(m.responseQueue), m.responsePager.PerPage, true)
+		} else {
+			m.cursor = util.CursorMovePage(m.cursor, len(m.queue), m.pager.PerPage, true)
+		}
+		m.refreshListViewport()
+		m.refreshResponseListViewport()
+		m.refreshBody()
 	}
 
 	return m, tea.Batch(*cmds...)
 }
 
 func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model, tea.Cmd) {
-	onResponses := m.captureResponse && m.focusedPanel == panelResponses
-
 	switch {
 	case key.Matches(msg, keys.Keys.Global.Escape):
 		m.saveCurrentEdit()
@@ -283,19 +294,6 @@ func (m Model) updateEditMode(msg tea.KeyPressMsg, cmds *[]tea.Cmd) (tea.Model,
 		m.textarea.Blur()
 		m.refreshBodyViewport()
 
-	case key.Matches(msg, keys.Keys.Intercept.UndoEdits):
-		if onResponses {
-			if len(m.responseQueue) > 0 {
-				delete(m.pendingResponseEdits, m.responseQueue[m.responseCursor])
-				m.textarea.SetValue(formatRawResponse(m.responseQueue[m.responseCursor]))
-			}
-		} else {
-			if len(m.queue) > 0 {
-				delete(m.pendingEdits, m.queue[m.cursor])
-				m.textarea.SetValue(formatRawRequest(m.queue[m.cursor]))
-			}
-		}
-
 	default:
 		var cmd tea.Cmd
 		m.textarea, cmd = m.textarea.Update(msg)

internal/ui/intercept/view.go

@@ -6,8 +6,10 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) View() tea.View {
@@ -15,7 +17,7 @@ func (m Model) View() tea.View {
 		return tea.NewView("Loading...")
 	}
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	var listRow string
 	if m.captureResponse {
@@ -37,17 +39,15 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderListPanel(w, h int) string {
-	s := style.S
-
 	focused := !m.editing && (!m.captureResponse || m.focusedPanel == panelRequests)
-	border := s.Panel
+	border := ilovetui.S.Panel
 	if focused {
-		border = s.PanelFocused
+		border = ilovetui.S.PanelFocused
 	}
 
 	var dots string
 	if len(m.queue) > 0 {
-		dots = s.Faint.Render(m.pager.View())
+		dots = ilovetui.S.Faint.Render(m.pager.View())
 	}
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.listViewport.View(),
@@ -56,46 +56,42 @@ func (m *Model) renderListPanel(w, h int) string {
 
 	title := icons.I.Request + "Requests"
 	if !m.interceptEnabled {
-		title += " " + lipgloss.NewStyle().Foreground(style.S.Error).Render("[intercept off]")
+		title += " " + lipgloss.NewStyle().Foreground(ilovetui.S.Error).Render("[intercept off]")
 	}
-	return style.RenderWithTitle(border, title, inner, w, h)
+	return ilovetui.RenderWithTitle(border, title, inner, w, h)
 }
 
 func (m *Model) renderResponseListPanel(w, h int) string {
-	s := style.S
-
 	focused := !m.editing && m.focusedPanel == panelResponses
-	border := s.Panel
+	border := ilovetui.S.Panel
 	if focused {
-		border = s.PanelFocused
+		border = ilovetui.S.PanelFocused
 	}
 
-	dots := s.Faint.Render(m.responsePager.View())
+	dots := ilovetui.S.Faint.Render(m.responsePager.View())
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.responseViewport.View(),
 		lipgloss.PlaceHorizontal(m.responseViewport.Width(), lipgloss.Center, dots),
 	)
 
-	return style.RenderWithTitle(border, icons.I.Response+"Responses", inner, w, h)
+	return ilovetui.RenderWithTitle(border, icons.I.Response+"Responses", inner, w, h)
 }
 
 func (m *Model) renderBodyPanel(h int) string {
-	s := style.S
-
 	var body string
 	if m.editing {
 		body = m.textarea.View()
 	} else {
-		body = m.bodyViewport.View()
+		body = ilovetui.ViewportView(&m.bodyViewport)
 	}
 
-	border := s.Panel
+	border := ilovetui.S.Panel
 	if m.editing {
-		border = s.PanelFocused
+		border = ilovetui.S.PanelFocused
 	}
 
 	title := icons.I.Detail + "Details"
-	return style.RenderWithTitle(border, title, body, m.width, h)
+	return ilovetui.RenderWithTitle(border, title, body, m.width, h)
 }
 
 func (m *Model) renderStatusBar() string {
@@ -104,17 +100,10 @@ func (m *Model) renderStatusBar() string {
 
 func (m *Model) renderList() string {
 	if len(m.queue) == 0 {
-		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, style.S.Faint.Render("       (｡◕‿‿◕｡)\nwaiting for a request"))
+		return lipgloss.Place(m.listViewport.Width(), m.listViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(｡◕‿‿◕｡)", "waiting for a request")))
 	}
 
-	s := style.S
-	start, end := m.pager.GetSliceBounds(len(m.queue))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.pager, len(m.queue))
 
 	var sb strings.Builder
 	for i, req := range m.queue[start:end] {
@@ -126,7 +115,7 @@ func (m *Model) renderList() string {
 		}
 
 		selected := globalIdx == m.cursor
-		selBg := s.Selection
+		selBg := ilovetui.S.Selection
 
 		w := m.listViewport.Width()
 		const fixedW = 2 + 7 + 2
@@ -139,18 +128,18 @@ func (m *Model) renderList() string {
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
-				s.Method(r.Method).Background(selBg).Render(r.Method),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				style.S.Method(r.Method).Background(selBg).Render(r.Method),
 				bg.Width(2).Render(""),
 				bg.Bold(true).Width(hostPathW).Render(r.URL.Host+path),
 			)
 		} else {
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
-				s.Method(r.Method).Render(r.Method),
-				s.Faint.Render("  "),
-				s.Bold.Render(r.URL.Host),
-				s.Faint.Render(path),
+				style.S.Method(r.Method).Render(r.Method),
+				ilovetui.S.Faint.Render("  "),
+				ilovetui.S.Bold.Render(r.URL.Host),
+				ilovetui.S.Faint.Render(path),
 			)
 		}
 		sb.WriteString(line + "\n")
@@ -160,17 +149,10 @@ func (m *Model) renderList() string {
 
 func (m *Model) renderResponseList() string {
 	if len(m.responseQueue) == 0 {
-		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, style.S.Faint.Render("     (҂◡_◡)\nno response yet"))
+		return lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(҂◡_◡)", "no response yet")))
 	}
 
-	s := style.S
-	start, end := m.responsePager.GetSliceBounds(len(m.responseQueue))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.responsePager, len(m.responseQueue))
 
 	var sb strings.Builder
 	for i, resp := range m.responseQueue[start:end] {
@@ -188,7 +170,7 @@ func (m *Model) renderResponseList() string {
 		statusStr := fmt.Sprintf("%d", code)
 
 		selected := globalIdx == m.responseCursor
-		selBg := s.Selection
+		selBg := ilovetui.S.Selection
 
 		statusSt := style.StatusStyle(code, 7)
 
@@ -203,7 +185,7 @@ func (m *Model) renderResponseList() string {
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
 				statusSt.Background(selBg).Render(statusStr),
 				bg.Width(2).Render(""),
 				bg.Bold(true).Width(hostPathW).Render(f.Request.URL.Host+path),
@@ -212,9 +194,9 @@ func (m *Model) renderResponseList() string {
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
 				statusSt.Render(statusStr),
-				s.Faint.Render("  "),
-				s.Bold.Render(f.Request.URL.Host),
-				s.Faint.Render(path),
+				ilovetui.S.Faint.Render("  "),
+				ilovetui.S.Bold.Render(f.Request.URL.Host),
+				ilovetui.S.Faint.Render(path),
 			)
 		}
 		sb.WriteString(line + "\n")

internal/ui/plugins/model.go

@@ -10,9 +10,9 @@ import (
 	"charm.land/bubbles/v2/textinput"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/plugins"
-	"github.com/anotherhadi/spilltea/internal/style"
 )
 
 type Model struct {
@@ -36,7 +36,7 @@ type Model struct {
 }
 
 func New(mgr *plugins.Manager) Model {
-	ta := style.NewTextarea(true)
+	ta := ilovetui.NewTextarea(true)
 	ta.Placeholder = "plugin configuration..."
 	ta.Blur()
 
@@ -45,12 +45,12 @@ func New(mgr *plugins.Manager) Model {
 
 	return Model{
 		manager:        mgr,
-		listViewport:   style.NewViewport(),
-		detailViewport: style.NewViewport(),
+		listViewport:   ilovetui.NewViewport(),
+		detailViewport: ilovetui.NewViewport(),
 		textarea:       ta,
 		filterInput:    fi,
-		pager:          style.NewPaginator(),
-		help:           style.NewHelp(),
+		pager:          ilovetui.NewPaginator(),
+		help:           ilovetui.NewHelp(),
 	}
 }
 
@@ -70,14 +70,14 @@ func (m *Model) recalcSizes() {
 	}
 	m.help.SetWidth(m.width - 2)
 
-	listH, detailH := style.SplitH(m.height, m.renderStatusBar(), 0.4)
+	listH, detailH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.4)
 
 	inner := m.width - 2
 	if inner < 0 {
 		inner = 0
 	}
 
-	listVH := style.PanelContentH(listH) - 1 // -1 for the pager dots row
+	listVH := ilovetui.ContentHeight(listH) - 1 // -1 for the pager dots row
 	if listVH < 0 {
 		listVH = 0
 	}
@@ -90,7 +90,7 @@ func (m *Model) recalcSizes() {
 
 	m.filterInput.SetWidth(inner - 2)
 
-	detailContentH := style.PanelContentH(detailH)
+	detailContentH := ilovetui.ContentHeight(detailH)
 	const headerH = 2
 	const configFixedH = 2 // blank line + label line
 	textareaH := max(3, detailContentH/3)
@@ -112,7 +112,6 @@ func (m *Model) recalcSizes() {
 	m.syncDetailViewport()
 }
 
-// Refresh reloads the plugin list from the manager.
 func (m *Model) Refresh() {
 	if m.manager == nil {
 		return

internal/ui/plugins/update.go

@@ -4,23 +4,10 @@ import (
 	"charm.land/bubbles/v2/key"
 	tea "charm.land/bubbletea/v2"
 	"github.com/anotherhadi/spilltea/internal/keys"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
-// PluginsChangedMsg is sent when the plugin list should be refreshed.
-type PluginsChangedMsg struct{}
-
-// RefreshCmd returns a command that triggers a list refresh.
-func RefreshCmd() tea.Cmd {
-	return func() tea.Msg { return PluginsChangedMsg{} }
-}
-
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	switch msg.(type) {
-	case PluginsChangedMsg:
-		m.Refresh()
-		return m, nil
-	}
-
 	// Route non-key messages to textarea when editing so internal
 	// textarea messages (e.g. clipboard paste) are handled correctly.
 	if m.editing {
@@ -34,12 +21,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
 	case tea.MouseWheelMsg:
 		if !m.editing {
-			switch msg.Button {
-			case tea.MouseWheelUp:
-				m.detailViewport.SetYOffset(m.detailViewport.YOffset() - 1)
-			case tea.MouseWheelDown:
-				m.detailViewport.SetYOffset(m.detailViewport.YOffset() + 1)
-			}
+			util.HandleMouseWheel(msg, &m.detailViewport)
 		}
 
 	case tea.KeyPressMsg:
@@ -77,11 +59,11 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.textarea.Blur()
 				if info, ok := m.selected(); ok && m.manager != nil {
 					val := m.textarea.Value()
-					m.manager.SaveConfig(info.Name, val)
+					m.manager.SaveConfig(info.ID, val)
 					// Update cached info.
 					m.filtered[m.cursor].ConfigText = val
 					for i := range m.items {
-						if m.items[i].Name == info.Name {
+						if m.items[i].ID == info.ID {
 							m.items[i].ConfigText = val
 							break
 						}
@@ -125,10 +107,10 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 		case key.Matches(msg, pk.Toggle):
 			if info, ok := m.selected(); ok && m.manager != nil {
-				m.manager.TogglePlugin(info.Name)
+				m.manager.TogglePlugin(info.ID)
 				m.filtered[m.cursor].Enabled = !info.Enabled
 				for i := range m.items {
-					if m.items[i].Name == info.Name {
+					if m.items[i].ID == info.ID {
 						m.items[i].Enabled = !info.Enabled
 						break
 					}
@@ -142,19 +124,23 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.textarea.Focus()
 			}
 
+		case key.Matches(msg, g.PrevPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.filtered), m.pager.PerPage, false)
+			m.recalcSizes()
+			m.syncTextarea()
+			m.detailViewport.GotoTop()
+
+		case key.Matches(msg, g.NextPage):
+			m.cursor = util.CursorMovePage(m.cursor, len(m.filtered), m.pager.PerPage, true)
+			m.recalcSizes()
+			m.syncTextarea()
+			m.detailViewport.GotoTop()
+
 		case key.Matches(msg, g.ScrollUp):
-			step := m.detailViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.detailViewport.SetYOffset(m.detailViewport.YOffset() - step)
+			util.ScrollViewport(&m.detailViewport, -1)
 
 		case key.Matches(msg, g.ScrollDown):
-			step := m.detailViewport.Height() / 2
-			if step < 1 {
-				step = 1
-			}
-			m.detailViewport.SetYOffset(m.detailViewport.YOffset() + step)
+			util.ScrollViewport(&m.detailViewport, 1)
 
 		case key.Matches(msg, g.Help):
 			m.help.ShowAll = !m.help.ShowAll

internal/ui/plugins/view.go

@@ -7,18 +7,18 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/glamour/v2"
 	"charm.land/lipgloss/v2"
-	"github.com/anotherhadi/spilltea/internal/config"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) View() tea.View {
 	if m.width == 0 || m.manager == nil {
-		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, style.S.Faint.Render("    (._.)~*.'\n no plugins loaded")))
+		return tea.NewView(lipgloss.Place(m.width, m.height, lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.width, "(._.)~*.'", "no plugins loaded"))))
 	}
 
-	listH, detailH := style.SplitH(m.height, m.renderStatusBar(), 0.4)
+	listH, detailH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.4)
 
 	content := lipgloss.JoinVertical(lipgloss.Left,
 		m.renderListPanel(m.width, listH),
@@ -29,36 +29,34 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderListPanel(w, h int) string {
-	s := style.S
-	panelStyle := s.PanelFocused
+	panelStyle := ilovetui.S.PanelFocused
 	if m.editing {
-		panelStyle = s.Panel
+		panelStyle = ilovetui.S.Panel
 	}
 	var dots string
 	if len(m.filtered) > 0 {
-		dots = s.Faint.Render(m.pager.View())
+		dots = ilovetui.S.Faint.Render(m.pager.View())
 	}
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.listViewport.View(),
 		lipgloss.PlaceHorizontal(m.listViewport.Width(), lipgloss.Center, dots),
 	)
-	return style.RenderWithTitle(panelStyle, icons.I.Plugin+"Plugins", inner, w, h)
+	return ilovetui.RenderWithTitle(panelStyle, icons.I.Plugin+"Plugins", inner, w, h)
 }
 
 func (m *Model) renderDetailPanel(h int) string {
-	s := style.S
-	panelStyle := s.Panel
+	panelStyle := ilovetui.S.Panel
 	if m.editing {
-		panelStyle = s.PanelFocused
+		panelStyle = ilovetui.S.PanelFocused
 	}
 	info, ok := m.selected()
 	if !ok {
-		return style.RenderWithTitle(panelStyle, icons.I.Detail+"Detail", "", m.width, h)
+		return ilovetui.RenderWithTitle(panelStyle, icons.I.Detail+"Detail", "", m.width, h)
 	}
 
-	statusSt := lipgloss.NewStyle().Foreground(s.Error)
+	statusSt := lipgloss.NewStyle().Foreground(ilovetui.S.Error)
 	if info.Enabled {
-		statusSt = lipgloss.NewStyle().Foreground(s.Success)
+		statusSt = lipgloss.NewStyle().Foreground(ilovetui.S.Success)
 	}
 	status := "disabled"
 	if info.Enabled {
@@ -68,26 +66,26 @@ func (m *Model) renderDetailPanel(h int) string {
 	pad := lipgloss.NewStyle().Padding(0, 1)
 
 	header := pad.Render(
-		s.Bold.Render(info.Name) + "  " + statusSt.Render(status) + "\n" +
-			s.Faint.Render(filepath.Base(info.FilePath)),
+		ilovetui.S.Bold.Render(info.Name) + "  " + statusSt.Render(status) + "\n" +
+			ilovetui.S.Faint.Render(filepath.Base(info.FilePath)),
 	)
 
-	parts := []string{header, m.detailViewport.View()}
+	parts := []string{header, ilovetui.ViewportView(&m.detailViewport)}
 
 	if m.hasConfig() {
 		var configLabel string
 		if m.editing {
 			escKey := keys.Keys.Global.Escape.Help().Key
-			configLabel = pad.Render(s.Faint.Render("editing config (" + escKey + " to save):"))
+			configLabel = pad.Render(ilovetui.S.Faint.Render("editing config (" + escKey + " to save):"))
 		} else {
 			editKey := keys.Keys.Plugins.EditConfig.Help().Key
-			configLabel = pad.Render(s.Faint.Render("config (" + editKey + " to edit):"))
+			configLabel = pad.Render(ilovetui.S.Faint.Render("config (" + editKey + " to edit):"))
 		}
 		parts = append(parts, "", configLabel, pad.Render(m.textarea.View()))
 	}
 
 	inner := lipgloss.JoinVertical(lipgloss.Left, parts...)
-	return style.RenderWithTitle(panelStyle, icons.I.Detail+"Detail", inner, m.width, h)
+	return ilovetui.RenderWithTitle(panelStyle, icons.I.Detail+"Detail", inner, m.width, h)
 }
 
 func renderPluginDescription(desc string, width int) string {
@@ -99,7 +97,7 @@ func renderPluginDescription(desc string, width int) string {
 	desc = strings.Join(lines, "\n")
 
 	r, err := glamour.NewTermRenderer(
-		glamour.WithStyles(style.GlamourStyleConfig(config.Global)),
+		glamour.WithStyles(ilovetui.GlamourStyleConfig()),
 		glamour.WithWordWrap(width),
 	)
 	if err != nil {
@@ -113,52 +111,44 @@ func renderPluginDescription(desc string, width int) string {
 }
 
 func (m *Model) renderStatusBar() string {
-	s := style.S
 	pad := lipgloss.NewStyle().Padding(0, 1)
 	filterKey := keys.Keys.Plugins.Filter.Help().Key
 	if m.filtering {
-		return pad.Render(s.Faint.Render(filterKey) + " " + m.filterInput.View())
+		return pad.Render(ilovetui.S.Faint.Render(filterKey) + " " + m.filterInput.View())
 	}
 	if m.filter != "" {
 		escKey := keys.Keys.Global.Escape.Help().Key
-		accent := lipgloss.NewStyle().Foreground(s.Primary)
-		filterLine := pad.Render(accent.Render(filterKey) + " " + s.Bold.Render(m.filter) + s.Faint.Render("  "+escKey+" to clear"))
+		accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+		filterLine := pad.Render(accent.Render(filterKey) + " " + ilovetui.S.Bold.Render(m.filter) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
 		return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(pluginsKeyMap{editing: m.editing, hasConfig: m.hasConfig(), width: m.width})))
 	}
 	return pad.Render(m.help.View(pluginsKeyMap{editing: m.editing, hasConfig: m.hasConfig(), width: m.width}))
 }
 
 func (m *Model) renderList() string {
-	s := style.S
 	if len(m.filtered) == 0 {
-		msg := " (ง •̀_•́)ง\nno plugins"
+		msg := util.EmptyState(m.listViewport.Width(), "(ง •̀_•́)ง", "no plugins", "", "spilltea --add-default-plugins")
 		if m.filter != "" {
-			msg = "   = _ =\nno results"
+			msg = util.EmptyState(m.listViewport.Width(), "= _ =", "no results")
 		}
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			s.Faint.Render(msg),
+			ilovetui.S.Faint.Render(msg),
 		)
 	}
 
-	start, end := m.pager.GetSliceBounds(len(m.filtered))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.pager, len(m.filtered))
 
 	var sb strings.Builder
 	for i, p := range m.filtered[start:end] {
 		globalIdx := start + i
 		selected := globalIdx == m.cursor
 
-		enabledSt := lipgloss.NewStyle().Foreground(s.Error)
+		enabledSt := lipgloss.NewStyle().Foreground(ilovetui.S.Error)
 		enabledStr := "off"
 		if p.Enabled {
-			enabledSt = lipgloss.NewStyle().Foreground(s.Success)
+			enabledSt = lipgloss.NewStyle().Foreground(ilovetui.S.Success)
 			enabledStr = "on "
 		}
 
@@ -171,10 +161,10 @@ func (m *Model) renderList() string {
 
 		var line string
 		if selected {
-			bg := lipgloss.NewStyle().Background(s.Selection)
+			bg := lipgloss.NewStyle().Background(ilovetui.S.Selection)
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
-				enabledSt.Background(s.Selection).Width(3).Render(enabledStr),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				enabledSt.Background(ilovetui.S.Selection).Width(3).Render(enabledStr),
 				bg.Width(1).Render(""),
 				bg.Bold(true).Width(nameW).Render(p.Name),
 			)
@@ -183,7 +173,7 @@ func (m *Model) renderList() string {
 				"  ",
 				enabledSt.Width(3).Render(enabledStr),
 				" ",
-				s.Bold.Render(p.Name),
+				ilovetui.S.Bold.Render(p.Name),
 			)
 		}
 		sb.WriteString(line + "\n")

internal/ui/replay/model.go

@@ -2,16 +2,18 @@ package replay
 
 import (
 	"fmt"
+	"strings"
 
 	"charm.land/bubbles/v2/help"
 	"charm.land/bubbles/v2/key"
 	"charm.land/bubbles/v2/paginator"
 	"charm.land/bubbles/v2/textarea"
+	"charm.land/bubbles/v2/textinput"
 	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/keys"
-	"github.com/anotherhadi/spilltea/internal/style"
 )
 
 type SendToReplayMsg struct {
@@ -31,15 +33,31 @@ type Entry struct {
 	ResponseRaw string // filled after send
 	StatusCode  int    // 0 = not sent yet
 	Sending     bool
+	Flagged     bool
 	Err         error
 }
 
+type panel int
+
+const (
+	panelList panel = iota
+	panelRequest
+	panelResponse
+)
+
 type Model struct {
-	entries  []Entry
+	allEntries   []Entry
+	entries      []Entry // filtered view; equals allEntries when no filter
+	entryIndices []int   // maps entries[i] -> allEntries[i]; nil when no filter
 	cursor       int
 	editing      bool
+	focusedPanel panel
 	database     *db.DB
 
+	filterInput    textinput.Model
+	filterActive   bool
+	filterAccepted bool
+
 	listViewport     viewport.Model
 	requestViewport  viewport.Model
 	responseViewport viewport.Model
@@ -52,26 +70,36 @@ type Model struct {
 }
 
 func New() Model {
-	ta := style.NewTextarea(false)
+	ta := ilovetui.NewTextarea(false)
 	ta.Blur()
+	ti := textinput.New()
+	ti.Prompt = ""
 	return Model{
-		listViewport:     style.NewViewport(),
-		requestViewport:  style.NewViewport(),
-		responseViewport: style.NewViewport(),
+		listViewport:     ilovetui.NewViewport(),
+		requestViewport:  ilovetui.NewViewport(),
+		responseViewport: ilovetui.NewViewport(),
 		textarea:         ta,
-		pager:            style.NewPaginator(),
-		help:             style.NewHelp(),
+		filterInput:      ti,
+		pager:            ilovetui.NewPaginator(),
+		help:             ilovetui.NewHelp(),
 	}
 }
 
 func (m Model) Init() tea.Cmd { return nil }
 
-func (m Model) IsEditing() bool { return m.editing }
+func (m Model) IsEditing() bool { return m.editing || (m.filterActive && !m.filterAccepted) }
+
+func (m Model) IsResponseFocused() bool {
+	return m.focusedPanel == panelResponse
+}
 
 func (m Model) CurrentRaw() string {
 	if len(m.entries) == 0 || m.cursor >= len(m.entries) {
 		return ""
 	}
+	if m.focusedPanel == panelResponse {
+		return m.entries[m.cursor].ResponseRaw
+	}
 	return m.entries[m.cursor].RequestRaw
 }
 
@@ -95,8 +123,9 @@ func (m *Model) SetDB(d *db.DB) {
 		return
 	}
 	for _, dbe := range entries {
-		m.entries = append(m.entries, entryFromDB(dbe))
+		m.allEntries = append(m.allEntries, entryFromDB(dbe))
 	}
+	m.entries = m.allEntries
 	m.pager.SetTotalPages(len(m.entries))
 	if len(m.entries) > 0 {
 		m.cursor = len(m.entries) - 1
@@ -120,6 +149,7 @@ func entryFromDB(dbe db.ReplayEntry) Entry {
 		RequestRaw:  dbe.RequestRaw,
 		ResponseRaw: dbe.ResponseRaw,
 		StatusCode:  dbe.StatusCode,
+		Flagged:     dbe.Flagged,
 		Err:         err,
 	}
 }
@@ -132,14 +162,15 @@ func (m *Model) SetSize(w, h int) {
 
 func (m *Model) recalcSizes() {
 	m.help.SetWidth(m.width - 2)
+	m.filterInput.SetWidth(m.width - 4)
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 
 	listInner := m.width - 2
 	if listInner < 0 {
 		listInner = 0
 	}
-	listVH := style.PanelContentH(listH) - 1 // -1 for the pager dots row
+	listVH := ilovetui.ContentHeight(listH) - 1 // -1 for the pager dots row
 	if listVH < 0 {
 		listVH = 0
 	}
@@ -159,7 +190,7 @@ func (m *Model) recalcSizes() {
 	if rightInner < 0 {
 		rightInner = 0
 	}
-	bodyVH := style.PanelContentH(bodyH)
+	bodyVH := ilovetui.ContentHeight(bodyH)
 
 	m.requestViewport.SetWidth(leftInner)
 	m.requestViewport.SetHeight(bodyVH)
@@ -178,17 +209,82 @@ func (m *Model) bodyHalfWidths() (left, right int) {
 	return
 }
 
+func (m *Model) currentAllIdx() int {
+	if m.entryIndices != nil && m.cursor < len(m.entryIndices) {
+		return m.entryIndices[m.cursor]
+	}
+	if m.cursor < len(m.allEntries) {
+		return m.cursor
+	}
+	return -1
+}
+
+func matchesFilter(e Entry, term string) bool {
+	return strings.Contains(strings.ToLower(e.Host), term) ||
+		strings.Contains(strings.ToLower(e.Path), term) ||
+		strings.Contains(strings.ToLower(strings.TrimSpace(e.Method)), term)
+}
+
+func (m *Model) applyFilter(preferAllIdx int) {
+	term := strings.ToLower(m.filterInput.Value())
+	if !m.filterActive || term == "" {
+		m.entries = m.allEntries
+		m.entryIndices = nil
+		if preferAllIdx >= 0 && preferAllIdx < len(m.allEntries) {
+			m.cursor = preferAllIdx
+		}
+	} else {
+		m.entries = nil
+		m.entryIndices = nil
+		newCursor := 0
+		found := false
+		for i, e := range m.allEntries {
+			if matchesFilter(e, term) {
+				if i == preferAllIdx && !found {
+					newCursor = len(m.entries)
+					found = true
+				}
+				m.entries = append(m.entries, e)
+				m.entryIndices = append(m.entryIndices, i)
+			}
+		}
+		if found {
+			m.cursor = newCursor
+		} else {
+			m.cursor = 0
+		}
+	}
+	if len(m.entries) == 0 {
+		m.cursor = 0
+	} else if m.cursor >= len(m.entries) {
+		m.cursor = len(m.entries) - 1
+	}
+	m.pager.SetTotalPages(len(m.entries))
+	m.refreshListViewport()
+	m.refreshBody()
+}
+
+func (m *Model) clearFilter() {
+	prevAllIdx := m.currentAllIdx()
+	m.filterActive = false
+	m.filterAccepted = false
+	m.filterInput.SetValue("")
+	m.filterInput.Blur()
+	m.recalcSizes()
+	m.applyFilter(prevAllIdx)
+}
+
 type replayKeyMap struct{ width int }
 
 func (replayKeyMap) ShortHelp() []key.Binding {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
-	return []key.Binding{g.Up, g.Down, r.Send, r.Edit, g.Help}
+	return []key.Binding{g.Up, g.Down, g.CycleFocus, r.Send, r.Edit, r.Flag, r.Filter, g.Help}
 }
 
 func (m replayKeyMap) FullHelp() [][]key.Binding {
 	g := keys.Keys.Global
-	pageGlobals := []key.Binding{g.Up, g.Down, g.ScrollUp, g.ScrollDown, g.Left, g.Right, g.Escape, g.Copy, g.CopyAs}
+	pageGlobals := []key.Binding{g.Up, g.Down, g.CycleFocus, g.ScrollUp, g.ScrollDown, g.Left, g.Right, g.Escape, g.Copy, g.CopyAs, g.SendToDiff}
 	all := append(keys.Keys.Replay.Bindings(), pageGlobals...)
 	all = append(all, g.CommonBindings()...)
 	return keys.ChunkByWidth(all, m.width)

internal/ui/replay/update.go

@@ -2,21 +2,33 @@ package replay
 
 import (
 	"bytes"
+	"compress/gzip"
+	"compress/zlib"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
-	"sort"
+	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
 	"charm.land/bubbles/v2/key"
+	"charm.land/bubbles/v2/viewport"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	"github.com/andybalholm/brotli"
+	ilovetui "github.com/anotherhadi/ilovetui"
+	"github.com/anotherhadi/spilltea/internal/config"
 	"github.com/anotherhadi/spilltea/internal/db"
 	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
+	diffUI "github.com/anotherhadi/spilltea/internal/ui/diff"
 	"github.com/anotherhadi/spilltea/internal/util"
+	"github.com/klauspost/compress/zstd"
 )
 
 type sentMsg struct {
@@ -55,15 +67,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				entry.DBID = id
 			}
 		}
-		m.entries = append(m.entries, entry)
-		m.cursor = len(m.entries) - 1
-		m.pager.SetTotalPages(len(m.entries))
-		m.refreshListViewport()
-		m.refreshBody()
+		m.allEntries = append(m.allEntries, entry)
+		m.applyFilter(len(m.allEntries) - 1)
 
 	case sentMsg:
-		if msg.index >= 0 && msg.index < len(m.entries) {
-			e := &m.entries[msg.index]
+		allIdx := msg.index
+		if allIdx >= 0 && allIdx < len(m.allEntries) {
+			e := m.allEntries[allIdx]
 			e.Sending = false
 			e.StatusCode = msg.statusCode
 			e.ResponseRaw = msg.responseRaw
@@ -72,11 +82,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				e.ResponseRaw = "Error: " + msg.err.Error()
 			}
 			if m.database != nil && e.DBID != 0 {
-				m.database.UpdateReplayEntry(entryToDB(*e))
+				if err := m.database.UpdateReplayEntry(entryToDB(e)); err != nil {
+					log.Printf("replay: update entry: %v", err)
 				}
 			}
-		m.refreshListViewport()
-		m.refreshBody()
+			m.allEntries[allIdx] = e
+		}
+		prevAllIdx := m.currentAllIdx()
+		m.applyFilter(prevAllIdx)
 
 	case util.EditorFinishedMsg:
 		if msg.Err == nil && msg.Content != "" && len(m.entries) > 0 {
@@ -89,24 +102,20 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			switch msg.Button {
 			case tea.MouseWheelUp:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollLeft(6)
-					m.responseViewport.ScrollLeft(6)
+					m.scrollBothViewports(true)
 				} else {
-					m.responseViewport.SetYOffset(m.responseViewport.YOffset() - 1)
+					m.scrollFocusedViewportVertical(-1)
 				}
 			case tea.MouseWheelDown:
 				if msg.Mod.Contains(tea.ModShift) {
-					m.requestViewport.ScrollRight(6)
-					m.responseViewport.ScrollRight(6)
+					m.scrollBothViewports(false)
 				} else {
-					m.responseViewport.SetYOffset(m.responseViewport.YOffset() + 1)
+					m.scrollFocusedViewportVertical(1)
 				}
 			case tea.MouseWheelLeft:
-				m.requestViewport.ScrollLeft(6)
-				m.responseViewport.ScrollLeft(6)
+				m.scrollBothViewports(true)
 			case tea.MouseWheelRight:
-				m.requestViewport.ScrollRight(6)
-				m.responseViewport.ScrollRight(6)
+				m.scrollBothViewports(false)
 			}
 		}
 
@@ -123,29 +132,74 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 	g := keys.Keys.Global
 	r := keys.Keys.Replay
+
+	if m.filterActive && !m.filterAccepted {
+		switch {
+		case key.Matches(msg, g.Escape):
+			m.clearFilter()
+		case msg.String() == "enter":
+			m.filterAccepted = true
+			m.filterInput.Blur()
+			m.recalcSizes()
+		default:
+			var cmd tea.Cmd
+			m.filterInput, cmd = m.filterInput.Update(msg)
+			prevAllIdx := m.currentAllIdx()
+			m.applyFilter(prevAllIdx)
+			return m, cmd
+		}
+		return m, nil
+	}
+
+	if m.filterActive && m.filterAccepted {
+		if key.Matches(msg, g.Escape) {
+			m.clearFilter()
+			return m, nil
+		}
+	}
+
 	switch {
 	case key.Matches(msg, g.Up):
+		if m.focusedPanel == panelList {
 			if m.cursor > 0 {
 				m.cursor--
 				m.refreshListViewport()
 				m.refreshBody()
 			}
+		} else {
+			m.scrollFocusedViewportVertical(-1)
+		}
 
 	case key.Matches(msg, g.Down):
+		if m.focusedPanel == panelList {
 			if m.cursor < len(m.entries)-1 {
 				m.cursor++
 				m.refreshListViewport()
 				m.refreshBody()
 			}
+		} else {
+			m.scrollFocusedViewportVertical(1)
+		}
+
+	case key.Matches(msg, g.CycleFocus):
+		switch m.focusedPanel {
+		case panelList:
+			m.focusedPanel = panelRequest
+		case panelRequest:
+			m.focusedPanel = panelResponse
+		default:
+			m.focusedPanel = panelList
+		}
 
 	case key.Matches(msg, r.Send):
 		if len(m.entries) > 0 && !m.entries[m.cursor].Sending {
-			m.entries[m.cursor].Sending = true
-			m.entries[m.cursor].ResponseRaw = ""
-			m.entries[m.cursor].Err = nil
-			m.refreshListViewport()
-			m.refreshBody()
-			return m, sendCmd(m.entries[m.cursor], m.cursor)
+			allIdx := m.currentAllIdx()
+			m.allEntries[allIdx].Sending = true
+			m.allEntries[allIdx].ResponseRaw = ""
+			m.allEntries[allIdx].Err = nil
+			entry := m.allEntries[allIdx]
+			m.applyFilter(allIdx)
+			return m, sendCmd(entry, allIdx)
 		}
 
 	case key.Matches(msg, r.Edit):
@@ -157,6 +211,9 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 
 	case key.Matches(msg, r.EditExt):
 		if len(m.entries) > 0 {
+			if m.focusedPanel == panelResponse {
+				return m, util.OpenExternalEditorView(m.entries[m.cursor].ResponseRaw)
+			}
 			return m, util.OpenExternalEditor(m.entries[m.cursor].RequestRaw)
 		}
 
@@ -167,18 +224,14 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		}
 
 	case key.Matches(msg, g.ScrollUp):
-		step := m.responseViewport.Height() / 2
-		if step < 1 {
-			step = 1
-		}
-		m.responseViewport.SetYOffset(m.responseViewport.YOffset() - step)
+		vp := m.focusedViewport()
+		util.ScrollViewport(&vp, -1)
+		m.setFocusedViewport(vp)
 
 	case key.Matches(msg, g.ScrollDown):
-		step := m.responseViewport.Height() / 2
-		if step < 1 {
-			step = 1
-		}
-		m.responseViewport.SetYOffset(m.responseViewport.YOffset() + step)
+		vp := m.focusedViewport()
+		util.ScrollViewport(&vp, 1)
+		m.setFocusedViewport(vp)
 
 	case key.Matches(msg, g.Left):
 		m.requestViewport.ScrollLeft(6)
@@ -188,31 +241,116 @@ func (m Model) updateNormalMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 		m.requestViewport.ScrollRight(6)
 		m.responseViewport.ScrollRight(6)
 
+	case key.Matches(msg, r.Flag):
+		if len(m.entries) > 0 {
+			allIdx := m.currentAllIdx()
+			if m.database != nil && m.allEntries[allIdx].DBID != 0 {
+				if err := m.database.ToggleReplayFlag(m.allEntries[allIdx].DBID); err != nil {
+					log.Printf("replay: toggle flag: %v", err)
+				}
+			}
+			m.allEntries[allIdx].Flagged = !m.allEntries[allIdx].Flagged
+			m.applyFilter(allIdx)
+		}
+
 	case key.Matches(msg, r.Delete):
 		if len(m.entries) > 0 {
-			e := m.entries[m.cursor]
+			allIdx := m.currentAllIdx()
+			e := m.allEntries[allIdx]
 			if m.database != nil && e.DBID != 0 {
-				m.database.DeleteReplayEntry(e.DBID)
+				if err := m.database.DeleteReplayEntry(e.DBID); err != nil {
+					log.Printf("replay: delete entry: %v", err)
 				}
-			m.entries = append(m.entries[:m.cursor], m.entries[m.cursor+1:]...)
-			if m.cursor >= len(m.entries) && m.cursor > 0 {
-				m.cursor--
 			}
-			m.pager.SetTotalPages(len(m.entries))
-			m.refreshListViewport()
-			m.refreshBody()
+			m.allEntries = append(m.allEntries[:allIdx], m.allEntries[allIdx+1:]...)
+			preferAllIdx := allIdx
+			if preferAllIdx >= len(m.allEntries) {
+				preferAllIdx = len(m.allEntries) - 1
+			}
+			m.applyFilter(preferAllIdx)
 		}
 
 	case key.Matches(msg, r.DeleteAll):
 		if m.database != nil {
-			m.database.DeleteAllReplayEntries()
+			if err := m.database.DeleteAllReplayEntriesExceptFlagged(); err != nil {
+				log.Printf("replay: delete all entries: %v", err)
+			}
+		}
+		// Mirror the DB logic in memory: delete unflagged first; if none, delete all.
+		hasUnflagged := false
+		for _, e := range m.allEntries {
+			if !e.Flagged {
+				hasUnflagged = true
+				break
+			}
+		}
+		if hasUnflagged {
+			filtered := m.allEntries[:0]
+			for _, e := range m.allEntries {
+				if e.Flagged {
+					filtered = append(filtered, e)
+				}
+			}
+			m.allEntries = filtered
+		} else {
+			m.allEntries = nil
 		}
-		m.entries = nil
 		m.cursor = 0
-		m.pager.SetTotalPages(0)
+		m.filterActive = false
+		m.filterAccepted = false
+		m.filterInput.SetValue("")
+		m.filterInput.Blur()
+		m.recalcSizes()
+		m.applyFilter(-1)
+
+	case key.Matches(msg, keys.Keys.Global.GotoTop):
+		m.cursor = 0
+		m.pager.Page = 0
 		m.refreshListViewport()
 		m.refreshBody()
 
+	case key.Matches(msg, keys.Keys.Global.GotoBottom):
+		m.cursor = util.CursorGotoBottom(len(m.entries))
+		m.refreshListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, keys.Keys.Global.PrevPage):
+		m.cursor = util.CursorMovePage(m.cursor, len(m.entries), m.pager.PerPage, false)
+		m.refreshListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, keys.Keys.Global.NextPage):
+		m.cursor = util.CursorMovePage(m.cursor, len(m.entries), m.pager.PerPage, true)
+		m.refreshListViewport()
+		m.refreshBody()
+
+	case key.Matches(msg, g.SendToDiff):
+		if len(m.entries) > 0 {
+			e := m.entries[m.cursor]
+			var raw, label string
+			if m.focusedPanel == panelResponse {
+				raw = e.ResponseRaw
+				label = fmt.Sprintf("%d %s", e.StatusCode, http.StatusText(e.StatusCode))
+			} else {
+				raw = e.RequestRaw
+				label = e.Method + " " + e.Host + e.Path
+			}
+			if raw != "" {
+				return m, func() tea.Msg {
+					return diffUI.SendToDiffMsg{Label: label, Raw: raw}
+				}
+			}
+		}
+
+	case key.Matches(msg, r.Filter):
+		if m.focusedPanel == panelList {
+			m.filterActive = true
+			m.filterAccepted = false
+			m.filterInput.Placeholder = "filter requests..."
+			m.filterInput.Focus()
+			m.recalcSizes()
+		}
+
 	case key.Matches(msg, g.Help):
 		m.help.ShowAll = !m.help.ShowAll
 		m.recalcSizes()
@@ -240,6 +378,39 @@ func (m Model) updateEditMode(msg tea.KeyPressMsg) (tea.Model, tea.Cmd) {
 	return m, nil
 }
 
+// focusedViewport returns the viewport that should receive scroll events.
+// When the list is focused, scroll targets the request panel.
+func (m *Model) focusedViewport() viewport.Model {
+	if m.focusedPanel == panelResponse {
+		return m.responseViewport
+	}
+	return m.requestViewport
+}
+
+func (m *Model) setFocusedViewport(vp viewport.Model) {
+	if m.focusedPanel == panelResponse {
+		m.responseViewport = vp
+	} else {
+		m.requestViewport = vp
+	}
+}
+
+func (m *Model) scrollBothViewports(left bool) {
+	if left {
+		m.requestViewport.ScrollLeft(6)
+		m.responseViewport.ScrollLeft(6)
+	} else {
+		m.requestViewport.ScrollRight(6)
+		m.responseViewport.ScrollRight(6)
+	}
+}
+
+func (m *Model) scrollFocusedViewportVertical(delta int) {
+	vp := m.focusedViewport()
+	vp.SetYOffset(vp.YOffset() + delta)
+	m.setFocusedViewport(vp)
+}
+
 func (m *Model) refreshListViewport() {
 	if m.pager.PerPage > 0 {
 		if len(m.entries) == 0 {
@@ -265,79 +436,72 @@ func (m *Model) refreshBody() {
 	m.requestViewport.SetXOffset(0)
 
 	if e.Sending {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, style.S.Faint.Render("  (ﾉ◕ヮ◕)ﾉ*:･ﾟ\n   sending...")))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "(ﾉ◕ヮ◕)ﾉ*:･ﾟ", "sending..."))))
 	} else if e.ResponseRaw != "" {
 		m.responseViewport.SetContent(style.HighlightHTTP(e.ResponseRaw))
 	} else {
-		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, style.S.Faint.Render("    ( •_•)>⌐■\npress send to fire")))
+		m.responseViewport.SetContent(lipgloss.Place(m.responseViewport.Width(), m.responseViewport.Height(), lipgloss.Center, lipgloss.Center, ilovetui.S.Faint.Render(util.EmptyState(m.responseViewport.Width(), "( •_•)>⌐■", "press send to fire"))))
 	}
 	m.responseViewport.SetYOffset(0)
 	m.responseViewport.SetXOffset(0)
 }
 
 func doSend(entry Entry) (responseRaw string, statusCode int, err error) {
-	lines := strings.Split(strings.ReplaceAll(entry.RequestRaw, "\r\n", "\n"), "\n")
-	if len(lines) == 0 {
+	parsed := util.ParseRawRequest(entry.RequestRaw)
+	if parsed.Method == "" {
 		return "", 0, fmt.Errorf("empty request")
 	}
 
-	parts := strings.SplitN(lines[0], " ", 3)
-	if len(parts) < 2 {
-		return "", 0, fmt.Errorf("invalid request line")
+	host := parsed.Host
+	if host == "" {
+		host = entry.Host
 	}
-	method := strings.TrimSpace(parts[0])
-	path := strings.TrimSpace(parts[1])
-
 	headers := make(http.Header)
-	host := entry.Host
-	i := 1
-	for i < len(lines) {
-		line := strings.TrimRight(lines[i], "\r")
-		if line == "" {
-			i++
-			break
+	for _, h := range parsed.Headers {
+		if strings.EqualFold(h.Key, "host") {
+			continue
 		}
-		if kv := strings.SplitN(line, ": ", 2); len(kv) == 2 {
-			k := strings.TrimSpace(kv[0])
-			v := strings.TrimSpace(kv[1])
-			if strings.ToLower(k) == "host" {
-				host = v
-			} else {
-				headers.Add(k, v)
-			}
-		}
-		i++
-	}
-
-	var bodyBytes []byte
-	if i < len(lines) {
-		b := strings.Join(lines[i:], "\n")
-		b = strings.TrimRight(b, "\n")
-		bodyBytes = []byte(b)
+		headers.Add(h.Key, h.Value)
 	}
 
 	scheme := entry.Scheme
 	if scheme == "" {
 		scheme = "https"
 	}
-	urlStr := scheme + "://" + host + path
+	urlStr := scheme + "://" + host + parsed.Path
 
 	var bodyReader io.Reader
-	if len(bodyBytes) > 0 {
-		bodyReader = bytes.NewReader(bodyBytes)
+	if parsed.Body != "" {
+		bodyReader = strings.NewReader(parsed.Body)
 	}
 
-	req, err := http.NewRequest(method, urlStr, bodyReader)
+	req, err := http.NewRequest(parsed.Method, urlStr, bodyReader)
 	if err != nil {
 		return "", 0, err
 	}
 	req.Header = headers
 
+	tlsCfg := &tls.Config{InsecureSkipVerify: config.Global.App.SslInsecure} // #nosec G402 -- controlled by ssl_insecure config
+	if !config.Global.App.SslInsecure {
+		if certPool, err := x509.SystemCertPool(); err == nil {
+			caPath := filepath.Join(config.ExpandPath(config.Global.App.CertDir), "mitmproxy-ca-cert.pem")
+			if pem, err := os.ReadFile(caPath); err == nil {
+				certPool.AppendCertsFromPEM(pem)
+			}
+			tlsCfg.RootCAs = certPool
+		}
+	}
+	transport := &http.Transport{
+		TLSClientConfig: tlsCfg,
+	}
+	if up := config.Global.App.UpstreamProxy; up != "" {
+		if proxyURL, err := url.Parse(up); err == nil {
+			transport.Proxy = http.ProxyURL(proxyURL)
+		}
+	}
 	client := &http.Client{
 		Timeout:   30 * time.Second,
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-		},
+		Transport: transport,
 		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
@@ -349,19 +513,21 @@ func doSend(entry Entry) (responseRaw string, statusCode int, err error) {
 	}
 	defer resp.Body.Close()
 
-	respBody, _ := io.ReadAll(resp.Body)
+	limit := int64(config.Global.App.MaxBodySizeMB) * 1024 * 1024
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, limit))
+
+	if enc := resp.Header.Get("Content-Encoding"); enc != "" {
+		if decoded, decErr := decodeBody(enc, respBody); decErr == nil {
+			respBody = decoded
+			resp.Header.Del("Content-Encoding")
+			resp.Header.Del("Content-Length")
+		}
+	}
 
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "%s %d %s\n", resp.Proto, resp.StatusCode, http.StatusText(resp.StatusCode))
-	sortedKeys := make([]string, 0, len(resp.Header))
-	for k := range resp.Header {
-		sortedKeys = append(sortedKeys, k)
-	}
-	sort.Strings(sortedKeys)
-	for _, k := range sortedKeys {
-		for _, v := range resp.Header[k] {
-			fmt.Fprintf(&sb, "%s: %s\n", k, v)
-		}
+	for _, line := range util.SortedHeaderLines(resp.Header) {
+		sb.WriteString(line)
 	}
 	sb.WriteString("\n")
 	sb.Write(respBody)
@@ -369,6 +535,35 @@ func doSend(entry Entry) (responseRaw string, statusCode int, err error) {
 	return sb.String(), resp.StatusCode, nil
 }
 
+func decodeBody(encoding string, body []byte) ([]byte, error) {
+	switch strings.ToLower(strings.TrimSpace(encoding)) {
+	case "gzip":
+		r, err := gzip.NewReader(bytes.NewReader(body))
+		if err != nil {
+			return nil, err
+		}
+		defer r.Close()
+		return io.ReadAll(r)
+	case "br":
+		return io.ReadAll(brotli.NewReader(bytes.NewReader(body)))
+	case "deflate":
+		r, err := zlib.NewReader(bytes.NewReader(body))
+		if err != nil {
+			return nil, err
+		}
+		defer r.Close()
+		return io.ReadAll(r)
+	case "zstd":
+		r, err := zstd.NewReader(bytes.NewReader(body))
+		if err != nil {
+			return nil, err
+		}
+		defer r.Close()
+		return io.ReadAll(r)
+	}
+	return nil, fmt.Errorf("unsupported encoding: %s", encoding)
+}
+
 func entryToDB(e Entry) db.ReplayEntry {
 	errMsg := ""
 	if e.Err != nil {
@@ -386,11 +581,16 @@ func entryToDB(e Entry) db.ReplayEntry {
 		ResponseRaw: e.ResponseRaw,
 		StatusCode:  e.StatusCode,
 		ErrorMsg:    errMsg,
+		Flagged:     e.Flagged,
 	}
 }
 
 func entryFromMsg(msg SendToReplayMsg) Entry {
-	method, host, path := parseFirstLine(msg.RequestRaw, msg.Host)
+	parsed := util.ParseRawRequest(msg.RequestRaw)
+	host := parsed.Host
+	if host == "" {
+		host = msg.Host
+	}
 	scheme := msg.Scheme
 	if scheme == "" {
 		scheme = util.InferScheme(host)
@@ -398,34 +598,9 @@ func entryFromMsg(msg SendToReplayMsg) Entry {
 	return Entry{
 		Scheme:      scheme,
 		Host:        host,
-		Path:        path,
-		Method:      method,
+		Path:        parsed.Path,
+		Method:      parsed.Method,
 		OriginalRaw: msg.RequestRaw,
 		RequestRaw:  msg.RequestRaw,
 	}
 }
-
-func parseFirstLine(raw, fallbackHost string) (method, host, path string) {
-	host = fallbackHost
-	path = "/"
-	lines := strings.SplitN(raw, "\n", 2)
-	if len(lines) == 0 {
-		return
-	}
-	parts := strings.Fields(lines[0])
-	if len(parts) >= 1 {
-		method = parts[0]
-	}
-	if len(parts) >= 2 {
-		path = parts[1]
-	}
-	if len(lines) > 1 {
-		for _, line := range strings.Split(lines[1], "\n") {
-			if strings.HasPrefix(strings.ToLower(line), "host:") {
-				host = strings.TrimSpace(line[5:])
-				break
-			}
-		}
-	}
-	return
-}

internal/ui/replay/view.go

@@ -6,8 +6,11 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	ilovetui "github.com/anotherhadi/ilovetui"
 	"github.com/anotherhadi/spilltea/internal/icons"
+	"github.com/anotherhadi/spilltea/internal/keys"
 	"github.com/anotherhadi/spilltea/internal/style"
+	"github.com/anotherhadi/spilltea/internal/util"
 )
 
 func (m Model) View() tea.View {
@@ -15,7 +18,7 @@ func (m Model) View() tea.View {
 		return tea.NewView("Loading...")
 	}
 
-	listH, bodyH := style.SplitH(m.height, m.renderStatusBar(), 0.35)
+	listH, bodyH := ilovetui.SplitH(m.height, m.renderStatusBar(), 0.35)
 	leftW, rightW := m.bodyHalfWidths()
 
 	bodyRow := lipgloss.JoinHorizontal(lipgloss.Top,
@@ -32,42 +35,57 @@ func (m Model) View() tea.View {
 }
 
 func (m *Model) renderListPanel(w, h int) string {
-	s := style.S
-	panelStyle := s.PanelFocused
-	if m.editing {
-		panelStyle = s.Panel
+	panelStyle := ilovetui.S.Panel
+	if !m.editing && m.focusedPanel == panelList {
+		panelStyle = ilovetui.S.PanelFocused
 	}
 	var dots string
 	if len(m.entries) > 0 {
-		dots = s.Faint.Render(m.pager.View())
+		dots = ilovetui.S.Faint.Render(m.pager.View())
 	}
 	inner := lipgloss.JoinVertical(lipgloss.Left,
 		m.listViewport.View(),
 		lipgloss.PlaceHorizontal(m.listViewport.Width(), lipgloss.Center, dots),
 	)
-	return style.RenderWithTitle(panelStyle, icons.I.Replay+"Replay", inner, w, h)
+	return ilovetui.RenderWithTitle(panelStyle, icons.I.Replay+"Replay", inner, w, h)
 }
 
 func (m *Model) renderRequestPanel(w, h int) string {
-	s := style.S
 	var body string
-	border := s.Panel
+	border := ilovetui.S.Panel
 	if m.editing {
 		body = m.textarea.View()
-		border = s.PanelFocused
+		border = ilovetui.S.PanelFocused
 	} else {
-		body = m.requestViewport.View()
+		body = ilovetui.ViewportView(&m.requestViewport)
+		if m.focusedPanel == panelRequest {
+			border = ilovetui.S.PanelFocused
 		}
-	return style.RenderWithTitle(border, icons.I.Request+"Request", body, w, h)
+	}
+	return ilovetui.RenderWithTitle(border, icons.I.Request+"Request", body, w, h)
 }
 
 func (m *Model) renderResponsePanel(w, h int) string {
-	s := style.S
-	return style.RenderWithTitle(s.Panel, icons.I.Response+"Response", m.responseViewport.View(), w, h)
+	border := ilovetui.S.Panel
+	if !m.editing && m.focusedPanel == panelResponse {
+		border = ilovetui.S.PanelFocused
+	}
+	return ilovetui.RenderWithTitle(border, icons.I.Response+"Response", ilovetui.ViewportView(&m.responseViewport), w, h)
 }
 
 func (m *Model) renderStatusBar() string {
-	return lipgloss.NewStyle().Padding(0, 1).Render(m.help.View(replayKeyMap{width: m.width}))
+	pad := lipgloss.NewStyle().Padding(0, 1)
+	if m.filterActive {
+		filterKey := keys.Keys.Replay.Filter.Help().Key
+		escKey := keys.Keys.Global.Escape.Help().Key
+		if m.filterAccepted {
+			accent := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
+			filterLine := pad.Render(accent.Render(filterKey) + " " + ilovetui.S.Bold.Render(m.filterInput.Value()) + ilovetui.S.Faint.Render("  "+escKey+" to clear"))
+			return lipgloss.JoinVertical(lipgloss.Left, filterLine, pad.Render(m.help.View(replayKeyMap{width: m.width})))
+		}
+		return pad.Render(ilovetui.S.Faint.Render(filterKey) + " " + m.filterInput.View())
+	}
+	return pad.Render(m.help.View(replayKeyMap{width: m.width}))
 }
 
 func (m *Model) renderList() string {
@@ -75,54 +93,58 @@ func (m *Model) renderList() string {
 		return lipgloss.Place(
 			m.listViewport.Width(), m.listViewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			style.S.Faint.Render("                  (╥﹏╥)\nsend a request from History or Intercept"),
+			ilovetui.S.Faint.Render(util.EmptyState(m.listViewport.Width(), "(╥﹏╥)", "send a request from History or Intercept")),
 		)
 	}
 
-	s := style.S
-	start, end := m.pager.GetSliceBounds(len(m.entries))
-	if start < 0 {
-		start = 0
-	}
-	if end < start {
-		end = start
-	}
+	start, end := util.PageBounds(m.pager, len(m.entries))
 
 	var sb strings.Builder
 	for i, e := range m.entries[start:end] {
 		globalIdx := start + i
 		selected := globalIdx == m.cursor
-		selBg := s.Selection
+		selBg := ilovetui.S.Selection
 
 		w := m.listViewport.Width()
-		const fixedW = 2 + 7 + 1 + 3 + 1
+		const fixedW = 2 + 2 + 7 + 1 + 3 + 1
 		hostPathW := w - fixedW
 		if hostPathW < 0 {
 			hostPathW = 0
 		}
 
 		statusStr, statusSt := entryStatus(e)
+		flagSt := lipgloss.NewStyle().Foreground(ilovetui.S.Primary)
 
 		var line string
 		if selected {
 			bg := lipgloss.NewStyle().Background(selBg)
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
-				bg.Bold(true).Foreground(s.Primary).Width(2).Render(">"),
-				s.Method(e.Method).Background(selBg).Render(e.Method),
+				bg.Bold(true).Foreground(ilovetui.S.Primary).Width(2).Render(">"),
+				bg.Foreground(ilovetui.S.Primary).Width(2).Render(flagStr),
+				style.S.Method(e.Method).Background(selBg).Render(e.Method),
 				bg.Width(1).Render(""),
 				statusSt.Background(selBg).Render(statusStr),
 				bg.Width(1).Render(""),
 				bg.Bold(true).Width(hostPathW).Render(e.Host+e.Path),
 			)
 		} else {
+			flagStr := "  "
+			if e.Flagged {
+				flagStr = icons.I.Flag + " "
+			}
 			line = lipgloss.JoinHorizontal(lipgloss.Top,
 				"  ",
-				s.Method(e.Method).Render(e.Method),
+				flagSt.Width(2).Render(flagStr),
+				style.S.Method(e.Method).Render(e.Method),
 				" ",
 				statusSt.Render(statusStr),
 				" ",
-				s.Bold.Render(e.Host),
-				s.Faint.Render(e.Path),
+				ilovetui.S.Bold.Render(e.Host),
+				ilovetui.S.Faint.Render(e.Path),
 			)
 		}
 		sb.WriteString(line + "\n")
@@ -134,11 +156,11 @@ func entryStatus(e Entry) (string, lipgloss.Style) {
 	base := lipgloss.NewStyle().Bold(true).Width(3)
 	switch {
 	case e.Sending:
-		return "···", base.Foreground(style.S.Subtle)
+		return "···", base.Foreground(ilovetui.S.Subtle)
 	case e.Err != nil:
-		return "ERR", base.Foreground(style.S.Error)
+		return "ERR", base.Foreground(ilovetui.S.Error)
 	case e.StatusCode == 0:
-		return "---", base.Foreground(style.S.Subtle)
+		return "---", base.Foreground(ilovetui.S.Subtle)
 	}
 	return fmt.Sprintf("%3d", e.StatusCode), style.StatusStyle(e.StatusCode, 3)
 }

internal/util/cursor.go

@@ -0,0 +1,30 @@
+package util
+
+// CursorMovePage moves cursor forward or backward by one page (perPage items),
+// clamped to [0, total-1].
+func CursorMovePage(cursor, total, perPage int, forward bool) int {
+	step := perPage
+	if step < 1 {
+		step = 1
+	}
+	if forward {
+		cursor += step
+	} else {
+		cursor -= step
+	}
+	if cursor < 0 || total <= 0 {
+		return 0
+	}
+	if cursor >= total {
+		return total - 1
+	}
+	return cursor
+}
+
+// CursorGotoBottom returns the last valid cursor index for a list of total items.
+func CursorGotoBottom(total int) int {
+	if total <= 0 {
+		return 0
+	}
+	return total - 1
+}

internal/util/editor.go

@@ -1,10 +1,13 @@
 package util
 
 import (
+	"log"
 	"os"
 	"os/exec"
 
 	tea "charm.land/bubbletea/v2"
+
+	"github.com/anotherhadi/spilltea/internal/config"
 )
 
 type EditorFinishedMsg struct {
@@ -12,27 +15,51 @@ type EditorFinishedMsg struct {
 	Err     error
 }
 
-func OpenExternalEditor(content string) tea.Cmd {
-	editor := os.Getenv("EDITOR")
+func ResolveEditor() string {
+	editor := config.Global.App.ExternalEditor
+	if editor == "" {
+		editor = os.Getenv("EDITOR")
+	}
 	if editor == "" {
 		editor = "vi"
 	}
+	return editor
+}
+
+func openWithEditor(content string, callback func(string, error) tea.Msg) tea.Cmd {
 	f, err := os.CreateTemp("", "spilltea-*.http")
 	if err != nil {
+		log.Printf("editor: create temp file: %v", err)
 		return nil
 	}
 	tmpPath := f.Name()
-	_, _ = f.WriteString(content)
-	f.Close()
-	return tea.ExecProcess(exec.Command(editor, tmpPath), func(err error) tea.Msg {
+	if _, err := f.WriteString(content); err != nil {
+		log.Printf("editor: writing temp file: %v", err)
+	}
+	if err := f.Close(); err != nil {
+		log.Printf("editor: closing temp file: %v", err)
+	}
+	return tea.ExecProcess(exec.Command(ResolveEditor(), tmpPath), func(err error) tea.Msg { // #nosec G204 -- editor from trusted config/$EDITOR, tmpPath from os.CreateTemp
 		defer os.Remove(tmpPath)
+		return callback(tmpPath, err)
+	})
+}
+
+func OpenExternalEditor(content string) tea.Cmd {
+	return openWithEditor(content, func(tmpPath string, err error) tea.Msg {
 		if err != nil {
 			return EditorFinishedMsg{Err: err}
 		}
-		data, readErr := os.ReadFile(tmpPath)
+		data, readErr := os.ReadFile(tmpPath) // #nosec G304 -- tmpPath is from os.CreateTemp, controlled by this process
 		if readErr != nil {
 			return EditorFinishedMsg{Err: readErr}
 		}
 		return EditorFinishedMsg{Content: string(data)}
 	})
 }
+
+func OpenExternalEditorView(content string) tea.Cmd {
+	return openWithEditor(content, func(_ string, _ error) tea.Msg {
+		return nil
+	})
+}

internal/util/rawhttp.go

@@ -0,0 +1,86 @@
+package util
+
+import (
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+)
+
+// RawRequest holds a parsed raw HTTP request string.
+type RawRequest struct {
+	Method  string
+	Path    string
+	Proto   string
+	Host    string
+	Headers []RawHeader
+	Body    string
+}
+
+// RawHeader is a single header key/value pair preserving insertion order.
+type RawHeader struct {
+	Key   string
+	Value string
+}
+
+// ParseRawRequest parses a raw HTTP request string (as produced by
+// FormatRawRequest). The Host header, if present, is extracted into Host
+// but also kept in Headers.
+func ParseRawRequest(raw string) RawRequest {
+	lines := strings.Split(strings.ReplaceAll(raw, "\r\n", "\n"), "\n")
+	var r RawRequest
+	if len(lines) == 0 {
+		return r
+	}
+
+	parts := strings.SplitN(lines[0], " ", 3)
+	if len(parts) >= 1 {
+		r.Method = strings.TrimSpace(parts[0])
+	}
+	if len(parts) >= 2 {
+		r.Path = strings.TrimSpace(parts[1])
+	}
+	if len(parts) >= 3 {
+		r.Proto = strings.TrimSpace(parts[2])
+	}
+
+	i := 1
+	for i < len(lines) {
+		line := strings.TrimRight(lines[i], "\r")
+		if line == "" {
+			i++
+			break
+		}
+		if kv := strings.SplitN(line, ": ", 2); len(kv) == 2 {
+			k := strings.TrimSpace(kv[0])
+			v := strings.TrimSpace(kv[1])
+			r.Headers = append(r.Headers, RawHeader{k, v})
+			if strings.EqualFold(k, "host") {
+				r.Host = v
+			}
+		}
+		i++
+	}
+
+	if i < len(lines) {
+		r.Body = strings.TrimRight(strings.Join(lines[i:], "\n"), "\n")
+	}
+	return r
+}
+
+// SortedHeaderLines returns header lines sorted by key name, formatted as
+// "Key: Value\n" strings. Useful for deterministic serialisation.
+func SortedHeaderLines(h http.Header) []string {
+	keys := make([]string, 0, len(h))
+	for k := range h {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var out []string
+	for _, k := range keys {
+		for _, v := range h[k] {
+			out = append(out, fmt.Sprintf("%s: %s\n", k, v))
+		}
+	}
+	return out
+}

internal/util/util.go

@@ -1,6 +1,11 @@
 package util
 
-import "strings"
+import (
+	"strings"
+
+	"charm.land/bubbles/v2/paginator"
+	"charm.land/lipgloss/v2"
+)
 
 func Truncate(s string, max int) string {
 	if len(s) <= max {
@@ -9,6 +14,41 @@ func Truncate(s string, max int) string {
 	return s[:max-1] + "…"
 }
 
+// EmptyState renders centered placeholder lines, word-wrapping to fit maxW.
+func EmptyState(maxW int, lines ...string) string {
+	return lipgloss.NewStyle().
+		Width(maxW).
+		AlignHorizontal(lipgloss.Center).
+		Render(strings.Join(lines, "\n"))
+}
+
+// CenterLines centers each line horizontally relative to the longest one.
+func CenterLines(lines ...string) string {
+	maxWidth := 0
+	for _, l := range lines {
+		if w := lipgloss.Width(l); w > maxWidth {
+			maxWidth = w
+		}
+	}
+	centered := make([]string, len(lines))
+	for i, l := range lines {
+		centered[i] = lipgloss.PlaceHorizontal(maxWidth, lipgloss.Center, l)
+	}
+	return strings.Join(centered, "\n")
+}
+
+// PageBounds returns clamped start/end indices for rendering a paginated list.
+func PageBounds(p paginator.Model, total int) (start, end int) {
+	start, end = p.GetSliceBounds(total)
+	if start < 0 {
+		start = 0
+	}
+	if end < start {
+		end = start
+	}
+	return
+}
+
 // InferScheme returns "http" for port 80, "https" otherwise.
 func InferScheme(host string) string {
 	if strings.HasSuffix(host, ":80") {

internal/util/viewport.go

@@ -0,0 +1,39 @@
+package util
+
+import (
+	"charm.land/bubbles/v2/viewport"
+	tea "charm.land/bubbletea/v2"
+)
+
+// ScrollViewport scrolls vp vertically by half its height.
+// delta should be -1 for up, +1 for down.
+func ScrollViewport(vp *viewport.Model, delta int) {
+	step := vp.Height() / 2
+	if step < 1 {
+		step = 1
+	}
+	vp.SetYOffset(vp.YOffset() + delta*step)
+}
+
+// HandleMouseWheel applies standard mouse wheel scrolling to vp.
+// Vertical: one line at a time. Shift+vertical or horizontal: scroll 6 columns.
+func HandleMouseWheel(msg tea.MouseWheelMsg, vp *viewport.Model) {
+	switch msg.Button {
+	case tea.MouseWheelUp:
+		if msg.Mod.Contains(tea.ModShift) {
+			vp.ScrollLeft(6)
+		} else {
+			vp.SetYOffset(vp.YOffset() - 1)
+		}
+	case tea.MouseWheelDown:
+		if msg.Mod.Contains(tea.ModShift) {
+			vp.ScrollRight(6)
+		} else {
+			vp.SetYOffset(vp.YOffset() + 1)
+		}
+	case tea.MouseWheelLeft:
+		vp.ScrollLeft(6)
+	case tea.MouseWheelRight:
+		vp.ScrollRight(6)
+	}
+}

lefthook.yml

@@ -1,19 +0,0 @@
-pre-commit:
-  piped: true
-  commands:
-    check-vendor-hash:
-      glob: "{go.mod,go.sum}"
-      run: .github/scripts/check-vendor-hash.sh
-      stage_fixed: true
-    inject-exec-basics:
-      glob: "{docs/basics.md,cmd/**}"
-      run: python3 .github/scripts/inject-exec.py docs/basics.md
-      stage_fixed: true
-    inject-exec:
-      glob: "{README.md,docs/basics.md,cmd/**}"
-      run: python3 .github/scripts/inject-exec.py README.md
-      stage_fixed: true
-    toc:
-      glob: "{README.md,docs/basics.md,cmd/**}"
-      run: doctoc --notitle README.md
-      stage_fixed: true

nix/browser.nix

@@ -0,0 +1,61 @@
+{pkgs}: let
+  defaultCertDir = "$HOME/.local/share/spilltea";
+  defaultHost = "127.0.0.1";
+  defaultPort = "8080";
+in
+  pkgs.writeShellApplication {
+    name = "spilltea-browser";
+    runtimeInputs = with pkgs; [nss.tools librewolf netcat-gnu procps];
+    text = ''
+      CERT_DIR="${defaultCertDir}"
+      HOST="${defaultHost}"
+      PORT="${defaultPort}"
+
+      while [[ $# -gt 0 ]]; do
+        case "$1" in
+          --cert-dir) CERT_DIR="$2"; shift 2 ;;
+          --host)     HOST="$2";     shift 2 ;;
+          --port)     PORT="$2";     shift 2 ;;
+          *) echo "Unknown argument: $1"; exit 1 ;;
+        esac
+      done
+
+      CERT_FILE="$CERT_DIR/mitmproxy-ca-cert.pem"
+
+      if [[ ! -f "$CERT_FILE" ]]; then
+        echo "Certificate not found at $CERT_FILE"
+        echo "Launch spilltea first, or use --cert-dir if you changed cert_dir in your config."
+        exit 1
+      fi
+
+      if ! pgrep -x spilltea > /dev/null 2>&1; then
+        echo "spilltea is not running. Launch spilltea first."
+        exit 1
+      fi
+
+      if ! nc -z "$HOST" "$PORT" > /dev/null 2>&1; then
+        echo "Nothing is listening on $HOST:$PORT."
+        echo "Is spilltea configured on that port? Use --host and --port if you changed them in your config."
+        exit 1
+      fi
+
+      PROFILE=$(mktemp -d)
+      trap 'rm -rf "$PROFILE"' EXIT
+
+      certutil -N -d sql:"$PROFILE" --empty-password
+      certutil -d sql:"$PROFILE" -A -n "spilltea" -t "CT,," -i "$CERT_FILE"
+
+      cat > "$PROFILE/user.js" <<EOF
+      user_pref("network.proxy.type", 1);
+      user_pref("network.proxy.http", "$HOST");
+      user_pref("network.proxy.http_port", $PORT);
+      user_pref("network.proxy.ssl", "$HOST");
+      user_pref("network.proxy.ssl_port", $PORT);
+      user_pref("network.proxy.no_proxies_on", "");
+      user_pref("network.stricttransportsecurity.preloadlist", false);
+      user_pref("dom.security.https_only_mode", false);
+      EOF
+
+      librewolf --profile "$PROFILE" --no-remote
+    '';
+  }

nix/gomod2nix.toml

@@ -0,0 +1,254 @@
+schema = 3
+
+[mod]
+  [mod.'charm.land/bubbles/v2']
+    version = 'v2.1.0'
+    hash = 'sha256-2OmqpBrl+taOJzAhVM6OReLmoYRxZOXx9JqFNjQjsPA='
+
+  [mod.'charm.land/bubbletea/v2']
+    version = 'v2.0.6'
+    hash = 'sha256-1jxXmcnI4peUE0Xs3HGe57pIhRONx235aAaeqm2r434='
+
+  [mod.'charm.land/glamour/v2']
+    version = 'v2.0.0'
+    hash = 'sha256-CZYlNGw2MihqnSHf1Xxqz55NnqW9fVpLxyvLItryIw4='
+
+  [mod.'charm.land/lipgloss/v2']
+    version = 'v2.0.3'
+    hash = 'sha256-/RFkSUscU3NwymzT+PfizGf3XyQIdVGQlX7vxktCUGk='
+
+  [mod.'github.com/alecthomas/chroma/v2']
+    version = 'v2.24.1'
+    hash = 'sha256-DufsljWRKireFuLFcnPozuF0N3UoRYGlEfNFMD+z0ng='
+
+  [mod.'github.com/andybalholm/brotli']
+    version = 'v1.0.4'
+    hash = 'sha256-gAnPRdGP4yna4hiRIEDyBtDOVJqd7RU27wlPu96Rdf8='
+
+  [mod.'github.com/anotherhadi/ilovetui']
+    version = 'v0.1.6'
+    hash = 'sha256-7E+7UFks5vM3XWCvX2joFmHGcW7qqnoox6ZPFglaLO4='
+
+  [mod.'github.com/atotto/clipboard']
+    version = 'v0.1.4'
+    hash = 'sha256-ZZ7U5X0gWOu8zcjZcWbcpzGOGdycwq0TjTFh/eZHjXk='
+
+  [mod.'github.com/aymerick/douceur']
+    version = 'v0.2.0'
+    hash = 'sha256-NiBX8EfOvLXNiK3pJaZX4N73YgfzdrzRXdiBFe3X3sE='
+
+  [mod.'github.com/charmbracelet/colorprofile']
+    version = 'v0.4.3'
+    hash = 'sha256-y+QDUxGOKhugEMQLRUTZYT2C+wKqYHnMLJ44jbh7+JA='
+
+  [mod.'github.com/charmbracelet/ultraviolet']
+    version = 'v0.0.0-20260511121909-c840852527f3'
+    hash = 'sha256-oWEEaaetCmXvflD03MWy8qD105Kd62iI62+lxofE9Ns='
+
+  [mod.'github.com/charmbracelet/x/ansi']
+    version = 'v0.11.7'
+    hash = 'sha256-q8BZJq4K7NE5ETocN9/G/EoV0dUyD703ONSfHiUYzWQ='
+
+  [mod.'github.com/charmbracelet/x/exp/slice']
+    version = 'v0.0.0-20260517005351-920740d613be'
+    hash = 'sha256-bMsbEzP1gHA2OJx4zMYZUI3UFhcTG+mcFm8rRY+Khh8='
+
+  [mod.'github.com/charmbracelet/x/term']
+    version = 'v0.2.2'
+    hash = 'sha256-KF7IU1Luxl/sZP6XjomWB2e3lxSUS4/5AahhapGir/4='
+
+  [mod.'github.com/charmbracelet/x/termios']
+    version = 'v0.1.1'
+    hash = 'sha256-sri3LpHCBhGvnJldDzBxwbbZpeSGZVCJFOUL45uBFds='
+
+  [mod.'github.com/charmbracelet/x/windows']
+    version = 'v0.2.2'
+    hash = 'sha256-CvmE8kAC5wlPSeWjl2hc5xizvGS2FeOLHw84froldkk='
+
+  [mod.'github.com/clipperhouse/displaywidth']
+    version = 'v0.11.0'
+    hash = 'sha256-WokyTaofEy95xlshqK5YDzpemhXV5oaQifxS9YyfCXo='
+
+  [mod.'github.com/clipperhouse/uax29/v2']
+    version = 'v2.7.0'
+    hash = 'sha256-GO3az7WiGcwU0OvmocwdfR5ohGRL8NbjscIaMyhAdxE='
+
+  [mod.'github.com/dlclark/regexp2']
+    version = 'v1.12.0'
+    hash = 'sha256-PVX2rDCkiG0vyA1CbDi3bzLeZ2T8hcqJv3pZ5YwGzMI='
+
+  [mod.'github.com/dustin/go-humanize']
+    version = 'v1.0.1'
+    hash = 'sha256-yuvxYYngpfVkUg9yAmG99IUVmADTQA0tMbBXe0Fq0Mc='
+
+  [mod.'github.com/fsnotify/fsnotify']
+    version = 'v1.10.1'
+    hash = 'sha256-6LBLgsh4nKkMpgRKVsYFEaGDSU1fncBcWVSjKBdfgjU='
+
+  [mod.'github.com/go-viper/mapstructure/v2']
+    version = 'v2.5.0'
+    hash = 'sha256-LbrCBANBprVI84M0CWrXc7rriJL5ac5VKbh58LBTw7U='
+
+  [mod.'github.com/golang/groupcache']
+    version = 'v0.0.0-20210331224755-41bb18bfe9da'
+    hash = 'sha256-7Gs7CS9gEYZkbu5P4hqPGBpeGZWC64VDwraSKFF+VR0='
+
+  [mod.'github.com/google/uuid']
+    version = 'v1.6.0'
+    hash = 'sha256-VWl9sqUzdOuhW0KzQlv0gwwUQClYkmZwSydHG2sALYw='
+
+  [mod.'github.com/gorilla/css']
+    version = 'v1.0.1'
+    hash = 'sha256-6JwNHqlY2NpZ0pSQTyYPSpiNqjXOdFHqrUT10sv3y8A='
+
+  [mod.'github.com/gorilla/websocket']
+    version = 'v1.5.0'
+    hash = 'sha256-EYVgkSEMo4HaVrsWKqnsYRp8SSS8gNf7t+Elva02Ofc='
+
+  [mod.'github.com/inconshreveable/mousetrap']
+    version = 'v1.1.0'
+    hash = 'sha256-XWlYH0c8IcxAwQTnIi6WYqq44nOKUylSWxWO/vi+8pE='
+
+  [mod.'github.com/klauspost/compress']
+    version = 'v1.17.8'
+    hash = 'sha256-8rgCCfHX29le8m6fyVn6gwFde5TPUHjwQqZqv9JIubs='
+
+  [mod.'github.com/lqqyt2423/go-mitmproxy']
+    version = 'v1.8.11'
+    hash = 'sha256-PoCL6TOt99JsenH4XFx+7MqIzzYnnLHYwUpEQ7kxxyg='
+
+  [mod.'github.com/lucasb-eyer/go-colorful']
+    version = 'v1.4.0'
+    hash = 'sha256-i/3GDHKEMLCy0kc3mtyk58UWYOPmKoUVaq6QCAWXKP0='
+
+  [mod.'github.com/mattn/go-isatty']
+    version = 'v0.0.22'
+    hash = 'sha256-6O/0jc33pKUzlzUGpH8Ekk54XgJvx6Qe7kJtbcNJAV4='
+
+  [mod.'github.com/mattn/go-runewidth']
+    version = 'v0.0.23'
+    hash = 'sha256-SmChZ2U1aR8pW3LPhdM7KcVF5TO6VcHgRzBtUXbBWJA='
+
+  [mod.'github.com/microcosm-cc/bluemonday']
+    version = 'v1.0.27'
+    hash = 'sha256-EZSya9FLPQ83CL7N2cZy21fdS35hViTkiMK5f3op8Es='
+
+  [mod.'github.com/muesli/cancelreader']
+    version = 'v0.2.2'
+    hash = 'sha256-uEPpzwRJBJsQWBw6M71FDfgJuR7n55d/7IV8MO+rpwQ='
+
+  [mod.'github.com/ncruces/go-strftime']
+    version = 'v1.0.0'
+    hash = 'sha256-GYIwYDONuv/yTE0AEugCHQbtV3oiBaco93xUNYFcVBQ='
+
+  [mod.'github.com/pelletier/go-toml/v2']
+    version = 'v2.3.1'
+    hash = 'sha256-5H8+UOtPOs+Yc+8oVT/3bugCCdbq3jFMH6eOW8dadyg='
+
+  [mod.'github.com/remyoudompheng/bigfft']
+    version = 'v0.0.0-20230129092748-24d4a6f8daec'
+    hash = 'sha256-vYmpyCE37eBYP/navhaLV4oX4/nu0Z/StAocLIFqrmM='
+
+  [mod.'github.com/rivo/uniseg']
+    version = 'v0.4.7'
+    hash = 'sha256-rDcdNYH6ZD8KouyyiZCUEy8JrjOQoAkxHBhugrfHjFo='
+
+  [mod.'github.com/sagikazarmark/locafero']
+    version = 'v0.12.0'
+    hash = 'sha256-EXk9S5Z5sYyApAzCgHIugsGMbt/pHWRfHYFZH5D+5Ws='
+
+  [mod.'github.com/sahilm/fuzzy']
+    version = 'v0.1.1'
+    hash = 'sha256-f2VsDI6G+V2w31tSDzbZPi9EI2E7jRV6Aq8yeOorSZY='
+
+  [mod.'github.com/satori/go.uuid']
+    version = 'v1.2.0'
+    hash = 'sha256-y/lSGbnZa7mYJCs30a3LTyjfCFQSaYp8GbVR8dwtmsg='
+
+  [mod.'github.com/sirupsen/logrus']
+    version = 'v1.9.4'
+    hash = 'sha256-ltRvmtM3XTCAFwY0IesfRqYIivyXPPuvkFjL4ARh1wg='
+
+  [mod.'github.com/spf13/afero']
+    version = 'v1.15.0'
+    hash = 'sha256-LhcezbOqfuBzacytbqck0hNUxi6NbWNhifUc5/9uHQ8='
+
+  [mod.'github.com/spf13/cast']
+    version = 'v1.10.0'
+    hash = 'sha256-dQ6Qqf26IZsa6XsGKP7GDuCj+WmSsBmkBwGTDfue/rk='
+
+  [mod.'github.com/spf13/cobra']
+    version = 'v1.10.2'
+    hash = 'sha256-nbRCTFiDCC2jKK7AHi79n7urYCMP5yDZnWtNVJrDi+k='
+
+  [mod.'github.com/spf13/pflag']
+    version = 'v1.0.10'
+    hash = 'sha256-uDPnWjHpSrzXr17KEYEA1yAbizfcsfo5AyztY2tS6ZU='
+
+  [mod.'github.com/spf13/viper']
+    version = 'v1.21.0'
+    hash = 'sha256-A9A8i7HH/ge4j3hw7G++HNj8BjhhpZKvxHhfY+QAxkI='
+
+  [mod.'github.com/subosito/gotenv']
+    version = 'v1.6.0'
+    hash = 'sha256-LspbjTniiq2xAICSXmgqP7carwlNaLqnCTQfw2pa80A='
+
+  [mod.'github.com/xo/terminfo']
+    version = 'v0.0.0-20220910002029-abceb7e1c41e'
+    hash = 'sha256-GyCDxxMQhXA3Pi/TsWXpA8cX5akEoZV7CFx4RO3rARU='
+
+  [mod.'github.com/yuin/goldmark']
+    version = 'v1.8.2'
+    hash = 'sha256-LoWfW1Tb6mNuMR7SoA/4SJv4pTKfsVXqeXEVm4uEQ7Q='
+
+  [mod.'github.com/yuin/goldmark-emoji']
+    version = 'v1.0.6'
+    hash = 'sha256-+d6bZzOPE+JSFsZbQNZMCWE+n3jgcQnkPETVk47mxSY='
+
+  [mod.'github.com/yuin/gopher-lua']
+    version = 'v1.1.2'
+    hash = 'sha256-2YMCxv7RO3uqq6OTjvE0kR9nTt+n2cF+MrLtGEW68po='
+
+  [mod.'go.uber.org/atomic']
+    version = 'v1.11.0'
+    hash = 'sha256-TyYws/cSPVqYNffFX0gbDml1bD4bBGcysrUWU7mHPIY='
+
+  [mod.'go.yaml.in/yaml/v3']
+    version = 'v3.0.4'
+    hash = 'sha256-NkGFiDPoCxbr3LFsI6OCygjjkY0rdmg5ggvVVwpyDQ4='
+
+  [mod.'golang.org/x/net']
+    version = 'v0.55.0'
+    hash = 'sha256-Phi2mSmBGOJcvqPPAit3uqF3UP8SKRI9dHj6yTM3s5s='
+
+  [mod.'golang.org/x/sync']
+    version = 'v0.20.0'
+    hash = 'sha256-ybcjhCfK6lroUM0yswUvWooW8MOQZBXyiSqoxG6Uy0Y='
+
+  [mod.'golang.org/x/sys']
+    version = 'v0.45.0'
+    hash = 'sha256-hkBoNazrDA67ER6sWhb+EKxx9nJ24+nz3zGy+zT5Hvw='
+
+  [mod.'golang.org/x/text']
+    version = 'v0.37.0'
+    hash = 'sha256-8XDOnlPIybcDRy89fkjG5VqtIt5Ku+LmaqYhgKl7i1E='
+
+  [mod.'gopkg.in/yaml.v3']
+    version = 'v3.0.1'
+    hash = 'sha256-FqL9TKYJ0XkNwJFnq9j0VvJ5ZUU1RvH/52h/f5bkYAU='
+
+  [mod.'modernc.org/libc']
+    version = 'v1.72.3'
+    hash = 'sha256-eOCoqSnX/VzpG63nh1j3JpXRndnZZcn2cDTeutexXAI='
+
+  [mod.'modernc.org/mathutil']
+    version = 'v1.7.1'
+    hash = 'sha256-COZ5rF2GhQVR1r6a0DanJ8qwQ94JSKdQxTMWrDzE0Cc='
+
+  [mod.'modernc.org/memory']
+    version = 'v1.11.0'
+    hash = 'sha256-MkybF8vvrxXS5j7O8w3skwTo0aMo1yjWS0K440rYcHM='
+
+  [mod.'modernc.org/sqlite']
+    version = 'v1.50.1'
+    hash = 'sha256-JbGP3eerH/6mgzI0aq9SpLLwe6ld6PV/zJReG8mLQN0='

nix/package.nix

@@ -0,0 +1,31 @@
+{
+  pkgs,
+  buildGoApplication,
+}: let
+  browser = import ./browser.nix {inherit pkgs;};
+  pname = "spilltea";
+  version = "0.0.8";
+  ldflags = ["-s" "-w" "-X main.version=${version}"];
+  pkg = buildGoApplication {
+    inherit pname version ldflags;
+    src = ../.;
+    modules = ./gomod2nix.toml;
+    nativeBuildInputs = [pkgs.installShellFiles];
+    env.GOTOOLCHAIN = "local";
+    postInstall = ''
+      installShellCompletion --cmd spilltea \
+        --bash <($out/bin/spilltea completion bash) \
+        --zsh <($out/bin/spilltea completion zsh) \
+        --fish <($out/bin/spilltea completion fish)
+    '';
+    meta = with pkgs.lib; {
+      description = "A minimal, terminal-based HTTP(S) proxy for pentesters and CTF players.";
+      homepage = "https://github.com/anotherhadi/spilltea";
+      platforms = platforms.unix;
+    };
+  };
+in {
+  "${pname}" = pkg;
+  default = pkg;
+  browser = browser;
+}

nix/shell.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  gitHooksLib,
+  gomod2nixPkgs,
+}: let
+  hooks = gitHooksLib.run {
+    src = ../.;
+    hooks = {
+      gofmt.enable = true;
+      govet.enable = true;
+      stylua.enable = true;
+
+      gomod2nix = {
+        enable = true;
+        name = "gomod2nix";
+        entry = "gomod2nix --outdir ./nix";
+        language = "system";
+        files = "go\\.(mod|sum)$";
+        pass_filenames = false;
+      };
+
+      inject-exec-basics = {
+        enable = true;
+        name = "inject-exec-basics";
+        entry = "python3 .github/scripts/inject-exec.py docs/basics.md";
+        language = "system";
+        files = "(docs/basics\\.md|cmd/)";
+        pass_filenames = false;
+      };
+
+      inject-exec = {
+        enable = true;
+        name = "inject-exec";
+        entry = "python3 .github/scripts/inject-exec.py README.md";
+        language = "system";
+        files = "(README\\.md|docs/basics\\.md|cmd/)";
+        pass_filenames = false;
+      };
+
+      doctoc = {
+        enable = true;
+        name = "doctoc";
+        entry = "doctoc --notitle README.md";
+        language = "system";
+        files = "(README\\.md|docs/basics\\.md|cmd/)";
+        pass_filenames = false;
+      };
+    };
+  };
+in
+  pkgs.mkShell {
+    packages = with pkgs;
+      [
+        go
+        gosec
+        govulncheck
+        python3
+        doctoc
+        stylua
+        trufflehog
+        gomod2nixPkgs.gomod2nix
+      ]
+      ++ hooks.enabledPackages;
+
+    shellHook = hooks.shellHook;
+  }

plugins/inject_header.lua

@@ -4,22 +4,28 @@ Plugin = {
 Inject custom headers into every intercepted request.
 
 **Config**:
-- one 'Header-Name: value' per line.
+```yaml
+headers:
+  - "X-My-Header: myvalue"
+```
   ]],
 	on_request = { sync = true },
 }
 
 local headers = {}
 
-function on_config(config_text)
+function on_config()
 	headers = {}
-  for line in config_text:gmatch("[^\n]+") do
+	local cfg = get_config()
+	if cfg and cfg.headers then
+		for _, line in ipairs(cfg.headers) do
 			local name, value = line:match("^([^:]+):%s*(.+)$")
 			if name and value then
 				table.insert(headers, { name = name, value = value })
 			end
 		end
 	end
+end
 
 function on_request(req)
 	for _, h in ipairs(headers) do

plugins/ip_filter.lua

@@ -4,24 +4,28 @@ Plugin = {
 Checks that the proxy's outbound IP is in an allowed list on startup.
 
 **Config**:
-- one IP per line
-- prefix with `!` for a blacklist entry (blocked)
-- prefix with `#` to comment it out (ignored)
-- if no IPs are configured, the check is skipped
+```yaml
+ips:
+  - "1.2.3.4"     # whitelist entry
+  - "!5.6.7.8"    # blacklist entry (blocked)
+```
+
+- If no IPs are configured, the check is skipped.
   ]],
 	on_start = { sync = false },
+	disable_by_default = true,
 }
 
 local whitelist = {}
 local blacklist = {}
 
-function on_config(config_text)
-  whitelist = {}
-  blacklist = {}
-
-  for line in config_text:gmatch("[^\n]+") do
-    local trimmed = line:match("^%s*(.-)%s*$")
-    if trimmed ~= "" and trimmed:sub(1, 1) ~= "#" then
+function on_config()
+	whitelist, blacklist = {}, {}
+	local cfg = get_config()
+	if cfg and cfg.ips then
+		for _, entry in ipairs(cfg.ips) do
+			local trimmed = entry:match("^%s*(.-)%s*$")
+			if trimmed ~= "" then
 				if trimmed:sub(1, 1) == "!" then
 					local ip = trimmed:sub(2):match("^%s*(.-)%s*$")
 					if ip ~= "" then
@@ -33,22 +37,17 @@ function on_config(config_text)
 			end
 		end
 	end
+end
 
 function on_start()
 	if #whitelist == 0 and #blacklist == 0 then
 		return
 	end
 
-  -- Fetch the current outbound IP via a public API.
-  local ok, result = pcall(function()
-    local handle = io.popen("curl -sf https://api.ipify.org 2>/dev/null")
-    if not handle then return nil end
-    local ip = handle:read("*a")
-    handle:close()
-    return ip and ip:match("^%s*(.-)%s*$") or nil
-  end)
+	local result, err = shell_pipe("curl -sf https://api.ipify.org 2>/dev/null")
+	result = result and result:match("^%s*(.-)%s*$") or nil
 
-  if not ok or not result or result == "" then
+	if err or not result or result == "" then
 		log("could not determine outbound IP, skipping check")
 		notif("IP Filter", "Could not determine outbound IP, skipping check", "warning")
 		return

plugins/match_replace.lua

@@ -0,0 +1,125 @@
+Plugin = {
+	name = "Match & Replace",
+	description = [[
+Automatically find and replace content in requests and responses.
+
+**Config**:
+```yaml
+rules:
+  - on: "request"         # "request", "response", or "both" (default: "both")
+    url: "example%.com"   # optional: Lua pattern to filter by URL
+    target: "body"        # "body", "path", "url", or "header:Name"
+    find: "old_string"    # Lua pattern to search
+    replace: "new_string" # replacement string (supports %1, %2 for captures)
+```
+
+Example (inject a debug flag in JSON bodies):
+```yaml
+rules:
+  - on: "both"
+    url: "api%.example%.com"
+    target: "body"
+    find: '"debug":false'
+    replace: '"debug":true'
+```
+
+Example (replace an Authorization header):
+```yaml
+rules:
+  - on: "request"
+    target: "header:Authorization"
+    find: "Bearer .*"
+    replace: "Bearer MY_NEW_TOKEN"
+```
+
+Example (rewrite a path prefix):
+```yaml
+rules:
+  - on: "request"
+    url: "staging%.example%.com"
+    target: "path"
+    find: "^/v1/"
+    replace: "/v2/"
+```
+  ]],
+	priority = 50,
+	on_request = { sync = true },
+	on_response = { sync = true },
+}
+
+local rules = {}
+
+function on_config()
+	rules = {}
+	local cfg = get_config()
+	if not cfg or not cfg.rules then
+		return
+	end
+	for _, r in ipairs(cfg.rules) do
+		if r.find and r.find ~= "" then
+			table.insert(rules, {
+				on = r.on or "both",
+				url = r.url,
+				target = r.target or "body",
+				find = r.find,
+				replace = r.replace or "",
+			})
+		end
+	end
+end
+
+local function should_apply(rule, req, context)
+	if rule.on ~= "both" and rule.on ~= context then
+		return false
+	end
+	if rule.url and not req.url:match(rule.url) then
+		return false
+	end
+	return true
+end
+
+local function apply(rule, req, res, context)
+	local target = rule.target
+	if target == "body" then
+		local obj = (context == "response") and res or req
+		local body = obj:get_body()
+		local new_body = body:gsub(rule.find, rule.replace)
+		if new_body ~= body then
+			obj:set_body(new_body)
+		end
+	elseif target == "path" then
+		local new_path = req.path:gsub(rule.find, rule.replace)
+		if new_path ~= req.path then
+			req:set_path(new_path)
+		end
+	elseif target == "url" then
+		local new_url = req.url:gsub(rule.find, rule.replace)
+		if new_url ~= req.url then
+			req:set_url(new_url)
+		end
+	elseif target:sub(1, 7) == "header:" then
+		local name = target:sub(8)
+		local obj = (context == "response") and res or req
+		local val = obj.headers[name] or ""
+		local new_val = val:gsub(rule.find, rule.replace)
+		if new_val ~= val then
+			obj:set_header(name, new_val)
+		end
+	end
+end
+
+function on_request(req)
+	for _, rule in ipairs(rules) do
+		if should_apply(rule, req, "request") then
+			apply(rule, req, nil, "request")
+		end
+	end
+end
+
+function on_response(req, res)
+	for _, rule in ipairs(rules) do
+		if should_apply(rule, req, "response") then
+			apply(rule, req, res, "response")
+		end
+	end
+end

plugins/scopes.lua

@@ -4,37 +4,34 @@ Plugin = {
 Auto-forward requests and exclude them from history based on patterns.
 
 **Config**:
-- `pattern`    - whitelist: only intercept matching requests/responses and history entries
-- `!pattern`   - blacklist: skip matching requests/responses and history entries
-- `r:pattern`  - whitelist for requests/responses only (history unaffected)
-- `r:!pattern` - blacklist for requests/responses only
-- `h:pattern`  - whitelist for history entries only (requests unaffected)
-- `h:!pattern` - blacklist for history entries only
-- lines starting with `#` are comments
+```yaml
+patterns:
+  - "pattern"      # whitelist: only intercept matching requests/responses and history
+  - "!pattern"     # blacklist: skip matching requests/responses and history
+  - "r:pattern"    # whitelist for requests/responses only
+  - "r:!pattern"   # blacklist for requests/responses only
+  - "h:pattern"    # whitelist for history only
+  - "h:!pattern"   # blacklist for history only
+```
 
 Example (ignore static assets):
-```
-!%.css$
-!%.js$
-!%.png$
+```yaml
+patterns:
+  - "!%.css$"
+  - "!%.js$"
+  - "!%.png$"
 ```
 
-Example (focus on mytarget.com, skip everything else):
-```
-mytarget%.com/
+Example (focus on mytarget.com):
+```yaml
+patterns:
+  - "mytarget%.com/"
 ```
 
-Example (intercept mytarget.com except its static assets):
-```
-mytarget%.com/
-!%.css$
-!%.js$
-!%.png$
-```
-
-Example (disable history — h: whitelist never matches any real URL):
-```
-h:^$
+Example (disable history):
+```yaml
+patterns:
+  - "h:^$"
 ```
   ]],
 	priority = 100,
@@ -50,11 +47,15 @@ local whitelist_req  = {}
 local blacklist_hist = {}
 local whitelist_hist = {}
 
-function on_config(config_text)
+function on_config()
 	blacklist, whitelist = {}, {}
 	blacklist_req, whitelist_req = {}, {}
 	blacklist_hist, whitelist_hist = {}, {}
-  for line in config_text:gmatch("[^\n]+") do
+	local cfg = get_config()
+	if not cfg or not cfg.patterns then
+		return
+	end
+	for _, line in ipairs(cfg.patterns) do
 		local trimmed = line:match("^%s*(.-)%s*$")
 		if trimmed ~= "" and trimmed:sub(1, 1) ~= "#" then
 			local scope = trimmed:match("^([rh]):")
@@ -74,17 +75,27 @@ end
 
 local function check_skip(url, bl_extra, wl_extra)
 	for _, p in ipairs(blacklist) do
-    if url:match(p) then return true end
+		if url:match(p) then
+			return true
+		end
 	end
 	for _, p in ipairs(bl_extra) do
-    if url:match(p) then return true end
+		if url:match(p) then
+			return true
+		end
 	end
 	local wl = {}
-  for _, p in ipairs(whitelist)  do wl[#wl + 1] = p end
-  for _, p in ipairs(wl_extra)   do wl[#wl + 1] = p end
+	for _, p in ipairs(whitelist) do
+		wl[#wl + 1] = p
+	end
+	for _, p in ipairs(wl_extra) do
+		wl[#wl + 1] = p
+	end
 	if #wl > 0 then
 		for _, p in ipairs(wl) do
-      if url:match(p) then return false end
+			if url:match(p) then
+				return false
+			end
 		end
 		return true
 	end
@@ -92,13 +103,19 @@ local function check_skip(url, bl_extra, wl_extra)
 end
 
 function on_request(req)
-  if check_skip(req.url, blacklist_req, whitelist_req) then return "forward" end
+	if check_skip(req.url, blacklist_req, whitelist_req) then
+		return "forward"
+	end
 end
 
 function on_response(req)
-  if check_skip(req.url, blacklist_req, whitelist_req) then return "forward" end
+	if check_skip(req.url, blacklist_req, whitelist_req) then
+		return "forward"
+	end
 end
 
 function on_history_entry(entry)
-  if check_skip(entry.host .. entry.path, blacklist_hist, whitelist_hist) then return "skip" end
+	if check_skip(entry.host .. entry.path, blacklist_hist, whitelist_hist) then
+		return "skip"
+	end
 end

plugins/secretscan.lua

@@ -0,0 +1,214 @@
+Plugin = {
+	name = "Secret Scan",
+	description = [[
+Scans HTML, JavaScript and JSON content (requests and responses) for hardcoded
+secrets by matching common secret key names followed by a non-trivial value.
+
+Uses `grep -E` (available on all Unix systems, no extra dependencies).
+  ]],
+	on_request = { sync = false },
+	on_response = { sync = false },
+	disable_by_default = true,
+}
+
+local CONTENT_TYPES = {
+	"text/html",
+	"text/javascript",
+	"application/javascript",
+	"application/json",
+}
+
+-- Key name alternation (case-insensitive via grep -i)
+-- Suffixes are required (no bare generic keyword alone).
+local KEYS = {
+	"access(_key|_token)",
+	"accessid_secret",
+	"account(_key|_sid)",
+	"admin_pass(word)?",
+	"admin_user",
+	"(algolia|aws|gcp|azure|heroku|firebase|github|gitlab|slack|datadog|stripe|twilio|vercel|supabase|sendgrid|cloudinary|cloudflare|bitbucket|npm|netlify|auth0|okta|sentry)(_?(api|secret|access)(_?(key|token|id|sid|secret))?|_?(key|token|id|sid|secret))",
+	"ansible_vault_password",
+	"aos_key",
+	"api(_key|_secret|_token)",
+	"app_(id|key|secret)",
+	"application(_key|_id|_secret)",
+	"auth(_token|_secret|orization)",
+	"authkey",
+	"authsecret",
+	"bearer_?token",
+	"bucket(_password|_key)",
+	"cert_?pass(word)?",
+	"certificate_password",
+	"client(_id|_secret)",
+	"codecov_token",
+	"consumer_(key|secret)",
+	"connection_?string",
+	"credentials?",
+	"crypt(_key|_secret)",
+	"db_(password|passwd|user(name)?)",
+	"deploy(_key|_password|_token)",
+	"docker_?pass(word)?",
+	"dockerhub_?password",
+	"encryption_(key|password)",
+	"jwt_secret",
+	"json_web_token",
+	"keycloak_secret",
+	"kubernetes_token",
+	"ldap_(password|bindpw)",
+	"login(_password|_token)",
+	"mail_?password",
+	"mail_smtp_pass",
+	"mysql_password",
+	"mongo_password",
+	"netlify_token",
+	"npm(_token|_auth_token)",
+	"oauth(_token|_secret)",
+	"openai_(api_key|secret)",
+	"pass(word)?",
+	"passwd",
+	"private(_key|_token)",
+	"rds_password",
+	"s3(_key|_secret|_access_key_id)",
+	"secret(_key|_token|_id)",
+	"security_token",
+	"sendgrid_api_key",
+	"ses_(smtp|access|secret)",
+	"service(_account|_key|_token)",
+	"smtp_pass(word)?",
+	"smtp_secret",
+	"sonar_token",
+	"ssh(_key|_private_key|_rsa)",
+	"supabase(_anon|_service)?_key",
+	"symfony_secret",
+	"telegram_bot_token",
+	"token",
+	"travis_token",
+	"vault(_token|_secret)",
+	"webhook(_secret|_token)",
+	"zapier_webhook_token",
+}
+
+-- Built once at load time.
+-- Pattern breakdown:
+--   KEY[a-z0-9._-]{0,20}   key name + optional alphanumeric suffix (e.g. _ID in AWS_ACCESS_KEY_ID)
+--   [^=:a-zA-Z0-9_]{0,3}  optional non-identifier chars before separator (e.g. closing " in JSON "key":)
+--   [[:space:]]*[:=]        REQUIRED: actual = or : assignment operator
+--   [[:space:]]*"?          optional whitespace + opening quote
+--   [a-zA-Z0-9+/=_.-]{8,} the secret value, at least 8 chars
+local KEY_PAT = "(" .. table.concat(KEYS, "|") .. ")"
+local FULL_PAT = KEY_PAT .. '[a-z0-9._-]{0,20}[^=:a-zA-Z0-9_]{0,3}[[:space:]]*[:=][[:space:]]*"?[a-zA-Z0-9+/=_.-]{8,}'
+local GREP_CMD = "grep -Eoni '" .. FULL_PAT .. "'"
+
+local function is_relevant(ct)
+	if not ct or ct == "" then
+		return false
+	end
+	ct = ct:lower()
+	for _, t in ipairs(CONTENT_TYPES) do
+		if ct:find(t, 1, true) then
+			return true
+		end
+	end
+	return false
+end
+
+local function build_context(lines, linenum)
+	local lo = math.max(1, linenum - 6)
+	local hi = math.min(#lines, linenum + 6)
+
+	local before, after = {}, {}
+	for i = lo, linenum - 1 do
+		local l = lines[i] or ""
+		if #l > 120 then
+			l = l:sub(1, 120) .. "..."
+		end
+		table.insert(before, l)
+	end
+	for i = linenum + 1, hi do
+		local l = lines[i] or ""
+		if #l > 120 then
+			l = l:sub(1, 120) .. "..."
+		end
+		table.insert(after, l)
+	end
+
+	local matched_line = lines[linenum] or ""
+	if #matched_line > 200 then
+		matched_line = matched_line:sub(1, 200) .. "..."
+	end
+
+	local parts = {}
+	if #before > 0 then
+		table.insert(parts, "```\n" .. table.concat(before, "\n") .. "\n```")
+	end
+	table.insert(parts, "> **`" .. matched_line .. "`**")
+	if #after > 0 then
+		table.insert(parts, "```\n" .. table.concat(after, "\n") .. "\n```")
+	end
+	return table.concat(parts, "\n\n")
+end
+
+local function scan(label, ct, body, host, path)
+	if not is_relevant(ct) then
+		return
+	end
+	if not body or body == "" then
+		return
+	end
+
+	local out, err = shell_pipe(GREP_CMD, body)
+	if err and err ~= "" then
+		log("grep error on " .. label .. " for " .. host .. path .. ": " .. err)
+		return
+	end
+	if not out or out == "" then
+		return
+	end
+
+	local lines = {}
+	for line in (body .. "\n"):gmatch("([^\n]*)\n") do
+		table.insert(lines, line)
+	end
+
+	for entry in out:gmatch("[^\n]+") do
+		local linenum_str, matched = entry:match("^(%d+):(.+)$")
+		if linenum_str then
+			local linenum = tonumber(linenum_str)
+			matched = matched:match("^%s*(.-)%s*$")
+			if matched ~= "" then
+				local display = matched
+				if #display > 200 then
+					display = display:sub(1, 200) .. "..."
+				end
+				local ctx = build_context(lines, linenum)
+				create_finding({
+					title = "Potential secret in " .. label .. " (" .. host .. ")",
+					description = "**Host:** `"
+						.. host
+						.. "`\n"
+						.. "\n**Path:** `"
+						.. path
+						.. "`\n"
+						.. "\n**Match:** `"
+						.. display
+						.. "`\n\n"
+						.. ctx,
+					key = host .. "|" .. path .. "|" .. label .. "|" .. matched,
+					severity = "high",
+				})
+			end
+		end
+	end
+end
+
+function on_request(req)
+	scan("request", req.headers["Content-Type"] or "", req:get_body(), req.host, req.path)
+end
+
+function on_response(req, res)
+	local ct = ""
+	if res.headers then
+		ct = res.headers["Content-Type"] or ""
+	end
+	scan("response", ct, res:get_body(), req.host, req.path)
+end

plugins/trufflehog.lua

@@ -0,0 +1,69 @@
+Plugin = {
+	name = "TruffleHog",
+	description = [[
+Scans request and response bodies for secrets using [TruffleHog](https://github.com/trufflesecurity/trufflehog).
+
+Requires `trufflehog` v3+ to be installed and available in PATH.
+  ]],
+	on_start = { sync = false },
+	on_request = { sync = false },
+	on_response = { sync = false },
+	disable_by_default = true,
+}
+
+function on_start()
+	local result, _ = shell_pipe("command -v trufflehog 2>/dev/null")
+	if not result or result:match("^%s*$") then
+		log("trufflehog is not installed or not in PATH")
+		notif("TruffleHog", "trufflehog is not installed or not in PATH, plugin disabled", "error")
+		return false
+	end
+end
+
+local function scan(label, content, host, path)
+	if not content or content == "" then
+		return
+	end
+	local out, err = shell_pipe(
+		'f=$(mktemp) && cat > "$f" && trufflehog filesystem --no-color "$f"; rc=$?; rm -f "$f"; exit $rc',
+		content
+	)
+	if err and err ~= "" then
+		log("trufflehog error on " .. label .. ": " .. err)
+		return
+	end
+	if not out or out == "" then
+		return
+	end
+	local blocks = {}
+	local current = nil
+	for line in out:gmatch("[^\n]+") do
+		if line:match("^Found ") then
+			if current then
+				table.insert(blocks, current)
+			end
+			current = line
+		elseif current then
+			current = current .. "\n" .. line
+		end
+	end
+	if current then
+		table.insert(blocks, current)
+	end
+	for _, block in ipairs(blocks) do
+		create_finding({
+			title = "Secret detected in " .. label .. " (" .. host .. ")",
+			description = "**Host:** `" .. host .. "`\n\n**Path:** `" .. path .. "`\n\n```\n" .. block .. "\n```",
+			key = host .. "|" .. path .. "|" .. label .. "|" .. block,
+			severity = "high",
+		})
+	end
+end
+
+function on_request(req)
+	scan("request", req:get_body(), req.host, req.path)
+end
+
+function on_response(req, res)
+	scan("response", res:get_body(), req.host, req.path)
+end