Changelog

New "Developer" category in Settings (between Security and Enterprise)

with UI to enable/disable the local HTTP API server:

• Enable toggle that starts/stops the Kestrel server immediately
• Port configuration field (default 9720)
• API key display with Copy and Regenerate buttons
• Status indicator showing running state
• Quick test curl command for easy verification

Add IApiProvider to the capability table and describe the local API server

in the shell features section (port, auth, endpoints, opt-in setting).

New SDK capability interface (IApiProvider) lets plugins declare HTTP API

routes and handle requests via pure SDK DTOs — no Kestrel dependency in

plugins. The shell hosts a Kestrel minimal API server on 127.0.0.1:9720

(configurable) that discovers providers and maps routes.

• IApiProvider interface + ApiProviderModels DTOs (ApiMethod, ApiRouteDescriptor,

ApiRequest, ApiResponse with static factory methods)

• LocalApiServer: WebApplication.CreateSlimBuilder(), API key auth middleware

(constant-time compare), per-provider route mapping, /api/v1/status (no auth)

and /api/v1/routes shell endpoints

• AppSettings: ApiEnabled (default false), ApiPort (default 9720), ApiKey

(auto-generated base64url on first enable)

• ServiceRegistration: LocalApiServer singleton
• App.axaml.cs: conditional server start in deferred background services
• PluginRegistry.ActivatePlugin: auto-register IApiProvider to CapabilityBroker
• FrameworkReference Microsoft.AspNetCore.App in Desktop csproj

Resize: Changed ColumnDefinitions from star (*) to Auto sizing for

both panes. Star columns have implicit minimum widths from content,

preventing the left pane from shrinking below ~50%. Both panes now

get explicit programmatic widths set in ApplyDetailPanelRatio() and

OnPanelResizeMoved(), allowing true 25%-75% range.

Selection: Stripped the default ThemeSelectedBrush lavender highlight

on ListBoxItem. Selected items now use ThemeHoverBrush background

with a subtle drop shadow on the .item-card border instead.

All cloud AI providers (Anthropic, OpenAI, Gemini, Groq, Mistral) now

check the API's stop/finish reason field to detect token-limit truncation.

Previously, truncated responses were returned as Success=true with

partial content, causing garbled output or literal "MAX_TOKENS" error

strings to leak through to the user.

Changes:

• AiResponse: add WasTruncated property for consumer-side handling
• AnthropicProvider: check stop_reason == "max_tokens"
• OpenAiProvider: check finish_reason == "length"
• OpenAiCompatibleProviderBase: check finish_reason == "length" (covers

Groq, Mistral, and any future OpenAI-compatible providers)

• GeminiProvider: check finishReason == "MAX_TOKENS", log warning
• All providers log a warning with the MaxTokens limit when truncated