The menu that never appeared, and the reason it never did

composer.js built its menu lazily inside show(), and refresh() wrote
list.innerHTML before calling it. `list` is null until build() has run, so the
first `/` or `@` ever typed threw a TypeError and took the handler with it. The
menu has never appeared in any browser. That is why /compact "isn't there":
nothing was. I shipped it having only run `node --check`, which parses the file
happily.

So this also brings the thing that catches it: a DOM stub driven under node --
not committed, hard rule 1 stands, it is an instrument like curl. It reproduced
the crash in one run and immediately found two more: choosing a command from the
menu left `/help` sitting in the box so the next Enter ran it again, and Tab
completed nothing. Tab now completes and Enter runs, which is the split that
matters for a command taking an argument.

`.select--sm` was used three times and defined nowhere. I deleted the copy in
chat.css and left a comment saying it "is defined once, in app.css", where it
did not exist -- so those selects fell back to plain `.select`: width 100% in a
flex row where four siblings wanted the same, all of them shrinking together
until each was a few characters wide, and half a rem taller than everything
beside them. That was the whole of "the connection switch needs to be wider".

The connection and directory move to the topbar. They cannot change -- update_chat
refuses both with a 409 -- so they are facts about the chat, of a kind with the
Temporary badge, not controls on the message. The mode stays by the box.

Compaction says it is working. It makes a model call that takes seconds and had
no indicator anywhere: `hx-indicator` appears nowhere in this codebase, and the
Generation.status channel that says "Summarising earlier messages…" for the
automatic path cannot be borrowed, because it lives in the streaming bubble and
this endpoint refuses to run while any message is unfinished. The overflow menu
now runs the same code as /compact rather than posting for itself, so there is
one implementation, one spinner, and one place the endpoint's four carefully
written 409s finally reach somebody.

/effort, low medium high, per chat with a per-model default. It goes out twice
because there is no field that works everywhere: OpenAI and vLLM read
reasoning_effort, llama.cpp's own docs say other values "have no effect" and its
maintainer says the field "simply gets dropped without error or logging" -- what
reaches gpt-oss behind it is chat_template_kwargs. Both are sent, and only once
an effort has been chosen, so a provider strict about unknown parameters sees
exactly the request it always did until somebody opts in. The control appears
only on a model marked `reasoning`, a flag that has existed since the beginning
with no reader at all.

Mentions and recognised commands are marked as you type -- a mirror behind the
textarea holding the same text with every character transparent, contributing
nothing but a rounded rectangle, so a pixel of drift is a misplaced rectangle
rather than a doubled glyph. A command is marked only when it resolves, so
`/thoughts on this` visibly is not one before you send it. And again in the
transcript, where user turns had no render step at all and now escape before
they inject.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/markdown.py

@@ -120,6 +120,37 @@ def render_markdown(text: str) -> str:
     )
 
 
+# A mention is `@` followed by a run of non-space, claimed only at the start of
+# the text or after whitespace. That last part is the whole rule: without it
+# every email address in a message becomes a highlighted file reference, which
+# is both wrong and ugly. It matches what composer.js recognises while typing,
+# and the two must stay in step or the box and the transcript disagree.
+_MENTION = re.compile(r"(?:(?<=\s)|^)@([^\s@]+)")
+
+
+def highlight_tokens(text: str) -> str:
+    """A user's own message, escaped, with `@mentions` marked.
+
+    User turns have no render step at all -- the template prints the column and
+    relies on `white-space: pre-wrap` -- so this is it, and it must escape
+    before it injects or it is an XSS hole in the one place a person controls
+    the bytes exactly.
+
+    Only mentions. A `/command` never survives to a message: commands are
+    intercepted in the composer and never posted, so anything beginning with a
+    slash in a transcript is text somebody meant as text, and marking it as a
+    command would be marking it as something it is not.
+    """
+    if not text:
+        return ""
+    escaped = html.escape(text, quote=False)
+    # Applied to the *escaped* string, so the span is the only markup that can
+    # exist. `@` and the path characters are untouched by html.escape, and a
+    # `&amp;` it produced contains no whitespace -- which is why the pattern is
+    # anchored on whitespace rather than on a character class.
+    return _MENTION.sub(r'<span class="tok-mention">@\1</span>', escaped)
+
+
 def escape_text(text: str) -> str:
     """Escape a plain-text run for insertion as HTML element content.