diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 799e054..8ce5b37 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,4 +21,5 @@ jobs:
       - run: npm ci
       - run: npm run lint
       - run: npm run typecheck
+      - run: npm test
       - run: npm run build
diff --git a/README.md b/README.md
index 137fe2b..68a785d 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ Open <https://wingman.manifest.build>, then:
 
 - **Provider preset** — pick a provider (OpenAI, Anthropic, Mistral, Groq, …) to auto-fill its base URL and wire format. The default, **Custom / Manifest**, pre-fills the Manifest Cloud gateway (`https://app.manifest.build`) — edit the Base URL by hand to point at your own gateway (which switches the pill back to Custom).
 - **Format** — the wire protocol: OpenAI Chat Completions (`/v1/chat/completions`), OpenAI Responses (`/v1/responses`), or Anthropic Messages (`/v1/messages`). This sets the endpoint path, auth scheme, body shape, and how the response is parsed.
-- **Base URL** — e.g. `https://your-manifest.example.com`, `https://api.openai.com`, `https://api.anthropic.com`, or `http://localhost:3001` (more on cross-origin below). Wingman appends the format's path.
+- **Base URL** — e.g. `https://your-manifest.example.com`, `https://api.openai.com`, `https://api.anthropic.com`, or `http://localhost:3001` (more on cross-origin below). Wingman appends the format's path, and shows the resolved endpoint under the field. Pasting a full endpoint or a base ending in `/v1` is fine — the duplicate is stripped rather than producing `/v1/v1/chat/completions`. A missing scheme is filled in (`http://` for loopback hosts, `https://` otherwise).
 - **API key** — `Authorization: Bearer` for OpenAI-style formats, `x-api-key` for Anthropic (attached automatically per format). Keys are kept per provider: switching preset shows that provider's own key (blank until you set one), and switching back restores it.
 - **Model** — `auto` or a specific model id.
 - **Stream** — toggle in the composer toolbar to read the reply as it's generated (Server-Sent Events).
@@ -47,7 +47,21 @@ Access-Control-Allow-Headers: Authorization, Content-Type, X-API-Key, X-Stainles
 
 The `X-Stainless-*` headers matter: the OpenClaw, Hermes, and OpenAI SDK profiles replay them to mimic the real SDK fingerprint, so an allow-list that omits them fails the preflight and the request never leaves the browser. Hermes sends a couple more (`X-Stainless-Async`, `X-Stainless-Read-Timeout`), so the robust option is to reflect the request's `Access-Control-Request-Headers` instead of hard-coding a list.
 
-If the gateway is on a loopback address (`localhost` / `127.0.0.1`) and you load Wingman over HTTPS, Chrome's Private Network Access also wants `Access-Control-Allow-Private-Network: true` on the preflight.
+### Reaching a gateway on localhost
+
+CORS is not the obstacle here, and this is worth being precise about because the symptom looks identical.
+
+If your gateway is on a loopback or private address (`localhost`, `127.0.0.1`, `192.168.x.x`) and you load Wingman over HTTPS, **the browser blocks the request before CORS is even consulted**. Chrome ≥ 138 gates public-page → local-network requests behind the **Local Network Access** permission; it replaced Private Network Access, so the `Access-Control-Allow-Private-Network: true` preflight header that used to satisfy it no longer does anything. Safari refuses the call outright as mixed content. In a cross-origin iframe the permission is denied by permissions policy unless the embedder adds `allow="local-network-access"`, which means no prompt ever appears.
+
+No change to the gateway can lift this — it's a property of the two origins. To test a local gateway, serve Wingman from the local network too:
+
+```bash
+git clone https://github.com/mnfst/wingman && cd wingman
+npm install && npm run dev
+# → http://localhost:3002, same address space as your gateway
+```
+
+Wingman reports this case as **local network blocked** rather than "CORS blocked", so you don't go editing an allow-list that was already correct.
 
 Calling **Anthropic** directly: its API blocks browser origins by default, so Wingman sends the `anthropic-dangerous-direct-browser-access: true` header (alongside `anthropic-version`) automatically when you pick the Anthropic Messages format.
 
diff --git a/package-lock.json b/package-lock.json
index c979018..c62d3da 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,12 +18,35 @@
         "@typescript-eslint/parser": "^8.56.0",
         "eslint": "^9.39.2",
         "eslint-config-prettier": "^10.1.8",
+        "jsdom": "^26.1.0",
         "prettier": "^3.8.1",
         "typescript": "^5.7.0",
         "vite": "^6.1.0",
-        "vite-plugin-solid": "^2.11.0"
+        "vite-plugin-solid": "^2.11.0",
+        "vitest": "^3.2.7"
       }
     },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/@babel/code-frame": {
       "version": "7.29.0",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
@@ -310,6 +333,121 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
@@ -1466,6 +1604,24 @@
         "@babel/types": "^7.28.2"
       }
     },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/estree": {
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
@@ -1723,6 +1879,121 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@vitest/expect": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-3.2.7.tgz",
+      "integrity": "sha512-E8eBXaKibuvH2pSZErOjdVb5vF4PbKYcrnluBTYxEk1l/VhhwZg1kZQsdtjq+CsF5CFydf2Rdkz7jDHKSisi3w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "3.2.7",
+        "@vitest/utils": "3.2.7",
+        "chai": "^5.2.0",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.7.tgz",
+      "integrity": "sha512-Trr0hYO9CM3Wj6ksWHRhK9IZpIY6wTMO5u/MqXurMxT57sWBaOPEtP3Oq60ihZuh5JsiagKfz95OcxdEP6dBrA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "3.2.7",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.17"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.7.tgz",
+      "integrity": "sha512-KUHlwqVu0sRlhCdyPdQ/wBoTfRahjUky1MubOmYw9fWfIZy1gNoHpuaaQBPAaMaVYdQYHJLurzj8ECCj5OwTqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-3.2.7.tgz",
+      "integrity": "sha512-sB9y4ovltoQP+WaUPwmSxO9WIg9Ig694Di5PalVPsYHklAdE027mehpWF2SQSVq+k6sFgaivbTjTJwZLSHbedA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "3.2.7",
+        "pathe": "^2.0.3",
+        "strip-literal": "^3.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-3.2.7.tgz",
+      "integrity": "sha512-7C+MwShwtBSI5Buwoyg3s/iY1eHL9PKAf+O1wVh/TdnjXUtkoL/9YQtre90i4MtNXM6edP1wJ2zOBpfCyhIS7g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.7",
+        "magic-string": "^0.30.17",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.2.7.tgz",
+      "integrity": "sha512-Q2eQGI6d2L/hBtZ0qNuKcAGid68XK6cv1xsoaIma6PaJhHPoqcEJhYpXZ/5myCMqkNgtP6UKuBhbc0nHKnrkuQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyspy": "^4.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.2.7.tgz",
+      "integrity": "sha512-x6BDOd7dyo3PFLY3I9/HJ25X/6OurhGXk2/B9gOZNPF7XDVjeBK4k01lQE5uvDpbuheErh91qYuE1E2OEjK3Rw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.7",
+        "loupe": "^3.1.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/acorn": {
       "version": "8.16.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
@@ -1746,6 +2017,16 @@
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/ajv": {
       "version": "6.15.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
@@ -1786,6 +2067,16 @@
       "dev": true,
       "license": "Python-2.0"
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/babel-plugin-jsx-dom-expressions": {
       "version": "0.40.6",
       "resolved": "https://registry.npmjs.org/babel-plugin-jsx-dom-expressions/-/babel-plugin-jsx-dom-expressions-0.40.6.tgz",
@@ -1905,6 +2196,16 @@
         "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
       }
     },
+    "node_modules/cac": {
+      "version": "6.7.14",
+      "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz",
+      "integrity": "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/callsites": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -1936,6 +2237,23 @@
       ],
       "license": "CC-BY-4.0"
     },
+    "node_modules/chai": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-5.3.3.tgz",
+      "integrity": "sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "assertion-error": "^2.0.1",
+        "check-error": "^2.1.1",
+        "deep-eql": "^5.0.1",
+        "loupe": "^3.1.0",
+        "pathval": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -1953,6 +2271,16 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/check-error": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.3.tgz",
+      "integrity": "sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      }
+    },
     "node_modules/color-convert": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
@@ -2002,12 +2330,40 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/csstype": {
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
       "license": "MIT"
     },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -2026,6 +2382,23 @@
         }
       }
     },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/deep-eql": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz",
+      "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/deep-is": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
@@ -2053,6 +2426,13 @@
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/esbuild": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
@@ -2345,6 +2725,16 @@
         "node": ">=4.0"
       }
     },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
     "node_modules/esutils": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
@@ -2355,6 +2745,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -2515,6 +2915,19 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/html-entities": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.3.3.tgz",
@@ -2522,6 +2935,47 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/ignore": {
       "version": "7.0.5",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
@@ -2582,6 +3036,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/is-what": {
       "version": "4.1.16",
       "resolved": "https://registry.npmjs.org/is-what/-/is-what-4.1.16.tgz",
@@ -2622,6 +3083,46 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -2716,6 +3217,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/loupe": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz",
+      "integrity": "sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lru-cache": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
@@ -2726,6 +3234,16 @@
         "yallist": "^3.0.2"
       }
     },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
     "node_modules/merge-anything": {
       "version": "5.1.7",
       "resolved": "https://registry.npmjs.org/merge-anything/-/merge-anything-5.1.7.tgz",
@@ -2798,6 +3316,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/nwsapi": {
+      "version": "2.2.24",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -2894,6 +3419,23 @@
         "node": ">=8"
       }
     },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathval": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.1.tgz",
+      "integrity": "sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.16"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -3041,6 +3583,33 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/semver": {
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
@@ -3098,6 +3667,13 @@
         "node": ">=8"
       }
     },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/solid-js": {
       "version": "1.9.12",
       "resolved": "https://registry.npmjs.org/solid-js/-/solid-js-1.9.12.tgz",
@@ -3134,6 +3710,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "3.10.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
+      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -3147,6 +3737,26 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/strip-literal": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/strip-literal/-/strip-literal-3.1.0.tgz",
+      "integrity": "sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "js-tokens": "^9.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/strip-literal/node_modules/js-tokens": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz",
+      "integrity": "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -3160,6 +3770,27 @@
         "node": ">=8"
       }
     },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
+      "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.16",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
@@ -3177,6 +3808,82 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
+    "node_modules/tinypool": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.1.1.tgz",
+      "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-2.0.0.tgz",
+      "integrity": "sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tinyspy": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/tinyspy/-/tinyspy-4.0.4.tgz",
+      "integrity": "sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/ts-api-utils": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
@@ -3340,6 +4047,29 @@
         }
       }
     },
+    "node_modules/vite-node": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-3.2.4.tgz",
+      "integrity": "sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cac": "^6.7.14",
+        "debug": "^4.4.1",
+        "es-module-lexer": "^1.7.0",
+        "pathe": "^2.0.3",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "bin": {
+        "vite-node": "vite-node.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/vite-plugin-solid": {
       "version": "2.11.12",
       "resolved": "https://registry.npmjs.org/vite-plugin-solid/-/vite-plugin-solid-2.11.12.tgz",
@@ -3385,6 +4115,140 @@
         }
       }
     },
+    "node_modules/vitest": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.7.tgz",
+      "integrity": "sha512-KrxIJ62Fd89gfysR4WotlgZABiz2dqFPgqGzX7s+CwsqLFomRH7777ZcrOD6+WVAh7khPQP41A+BKbpcJFrdEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/expect": "3.2.7",
+        "@vitest/mocker": "3.2.7",
+        "@vitest/pretty-format": "^3.2.7",
+        "@vitest/runner": "3.2.7",
+        "@vitest/snapshot": "3.2.7",
+        "@vitest/spy": "3.2.7",
+        "@vitest/utils": "3.2.7",
+        "chai": "^5.2.0",
+        "debug": "^4.4.1",
+        "expect-type": "^1.2.1",
+        "magic-string": "^0.30.17",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.2",
+        "std-env": "^3.9.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^0.3.2",
+        "tinyglobby": "^0.2.14",
+        "tinypool": "^1.1.1",
+        "tinyrainbow": "^2.0.0",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0",
+        "vite-node": "3.2.4",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@types/debug": "^4.1.12",
+        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "@vitest/browser": "3.2.7",
+        "@vitest/ui": "3.2.7",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@types/debug": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -3401,6 +4265,23 @@
         "node": ">= 8"
       }
     },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/word-wrap": {
       "version": "1.2.5",
       "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
@@ -3411,6 +4292,45 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
diff --git a/package.json b/package.json
index 7df4025..1e4fb58 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "dev": "vite",
     "build": "vite build",
     "preview": "vite preview",
+    "test": "vitest run",
     "lint": "eslint src/",
     "format": "prettier --write 'src/**/*.{ts,tsx,css}'",
     "typecheck": "tsc --noEmit"
@@ -31,9 +32,11 @@
     "@typescript-eslint/parser": "^8.56.0",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
+    "jsdom": "^26.1.0",
     "prettier": "^3.8.1",
     "typescript": "^5.7.0",
     "vite": "^6.1.0",
-    "vite-plugin-solid": "^2.11.0"
+    "vite-plugin-solid": "^2.11.0",
+    "vitest": "^3.2.7"
   }
 }
diff --git a/src/App.tsx b/src/App.tsx
index 9393596..0c85134 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -35,6 +35,7 @@ import {
   type HistoryEntry,
 } from './services/history';
 import { checkHealth, type HealthStatus } from './services/healthCheck';
+import { normalizeBaseUrl } from './services/baseUrl';
 import { isExecutable, runUserCode } from './runners';
 import { buildMarkdownReport } from './services/gist';
 import GistModal from './components/GistModal.jsx';
@@ -264,9 +265,10 @@ const App: Component = () => {
       return;
     }
     const controller = new AbortController();
+    const formatPath = format().path;
     const timer = window.setTimeout(() => {
       setHealthStatus({ kind: 'checking' });
-      checkHealth(url, path, controller.signal).then(setHealthStatus);
+      checkHealth(url, path, formatPath, controller.signal).then(setHealthStatus);
     }, 400);
     onCleanup(() => {
       window.clearTimeout(timer);
@@ -274,15 +276,20 @@ const App: Component = () => {
     });
   });
 
+  // One normalisation for the whole app: the SDK snippet, the health probe and
+  // the request itself all read from here, so the code Wingman shows you is the
+  // code that would reproduce the call it just made.
+  const normalized = createMemo(() => normalizeBaseUrl(baseUrl(), format().path));
+
   const params = () => ({
-    baseUrl: baseUrl().replace(/\/+$/, ''),
+    baseUrl: normalized().base,
     apiKey: apiKey(),
     model: model(),
     systemPrompt: systemPrompts()[profile().id] ?? '',
     userMessage: userMessage(),
   });
 
-  const requestUrl = () => `${baseUrl().replace(/\/+$/, '')}${format().path}`;
+  const requestUrl = () => normalized().requestUrl;
 
   const generatedSdkCode = createMemo(() => profile().code(params(), lang(), format()));
 
@@ -411,10 +418,10 @@ const App: Component = () => {
     setSystemPrompts({ ...systemPrompts(), [profile().id]: value });
   };
 
-  const errorResult = (message: string): SendResult => ({
+  const errorResult = (message: string, statusText = 'Code error'): SendResult => ({
     url: requestUrl(),
     status: 0,
-    statusText: 'Code error',
+    statusText,
     ok: false,
     durationMs: 0,
     requestHeaders: {},
@@ -438,6 +445,16 @@ const App: Component = () => {
     let next: SendResult;
     let sentHeaders: Record<string, string>;
 
+    // Stop before `fetch` does. An unusable base URL used to surface either a
+    // raw "Failed to parse URL" TypeError or — worse, for a schemeless value —
+    // a request resolved against Wingman's own origin, quietly shipping the
+    // user's API key somewhere they never pointed at.
+    if (!normalized().valid) {
+      setResult(errorResult(normalized().problem ?? 'Invalid base URL.', 'Invalid base URL'));
+      setLoading(false);
+      return;
+    }
+
     if (willRunCode()) {
       // The user edited the SDK preview, and the profile/lang combination can
       // execute it in-browser. Run the code through the stub SDK; whatever
@@ -446,7 +463,7 @@ const App: Component = () => {
         const out = await runUserCode({
           profileId: profile().id,
           code: sdkCode(),
-          baseUrl: baseUrl().replace(/\/+$/, ''),
+          baseUrl: normalized().base,
           apiKey: apiKey(),
         });
         next = out.result;
@@ -539,7 +556,7 @@ const App: Component = () => {
     setActiveHistoryId(entry.id);
     const fmt = FORMAT_BY_ID[restoredFormatId] ?? FORMATS[0]!;
     setResult({
-      url: entry.url ?? `${entry.baseUrl.replace(/\/+$/, '')}${fmt.path}`,
+      url: entry.url ?? normalizeBaseUrl(entry.baseUrl, fmt.path).requestUrl,
       status: entry.status,
       statusText: entry.statusText,
       ok: entry.ok,
@@ -646,6 +663,9 @@ const App: Component = () => {
             onResetHeaders={resetHeaders}
             blockedHeaders={blockedHeaderNames()}
             baseUrl={baseUrl()}
+            requestUrl={normalized().requestUrl}
+            baseUrlNote={normalized().note}
+            baseUrlProblem={normalized().problem}
             baseUrlPlaceholder={format().placeholderBaseUrl ?? 'https://your-manifest.example.com'}
             apiKey={apiKey()}
             apiKeyPlaceholder={provider().apiKeyPlaceholder}
diff --git a/src/components/AssistantMessage.tsx b/src/components/AssistantMessage.tsx
index 6da1c8a..67b88f2 100644
--- a/src/components/AssistantMessage.tsx
+++ b/src/components/AssistantMessage.tsx
@@ -1,6 +1,7 @@
 import { createSignal, For, Show, type Component } from 'solid-js';
 import type { SendResult } from '../send';
 import type { ApiFormat } from '../formats';
+import { describeFailure } from '../services/diagnostics';
 import CodeView from './CodeView.jsx';
 
 interface Props {
@@ -39,8 +40,11 @@ const StatusPill: Component<{ status: number; ok: boolean; statusText: string }>
     if (props.status >= 500) return 'error';
     return 'warn';
   };
+  // Status 0 means the request never reached a server, so there's no code to
+  // show — but the reason varies (rejected before sending, blocked, refused),
+  // and `statusText` carries it.
   const label = () => {
-    if (props.status === 0) return 'Network error';
+    if (props.status === 0) return props.statusText || 'Network error';
     return `${props.status} ${props.statusText}`.trim();
   };
   return (
@@ -96,6 +100,11 @@ const AssistantMessage: Component<Props> = (props) => {
   };
   const usage = () => (props.result ? props.format.extractUsage(props.result.responseJson) : null);
   const model = () => (props.result ? props.format.extractModel(props.result.responseJson) : null);
+  // A user-cancelled request needs no explanation.
+  const failureKind = () => {
+    const kind = props.result?.errorKind;
+    return kind && kind !== 'aborted' ? kind : null;
+  };
 
   return (
     <div class="assistant-msg">
@@ -157,6 +166,17 @@ const AssistantMessage: Component<Props> = (props) => {
               <div class="assistant-msg__error">{r.error}</div>
             </Show>
 
+            {/* `Failed to fetch` on its own tells the user nothing — and the
+                two failures a browser-only tool hits most (an HTTPS page
+                reaching a local gateway, plain-HTTP mixed content) are not
+                fixable on the server, which is where an unqualified "CORS"
+                guess used to send people. */}
+            <Show when={failureKind()}>
+              {(kind) => (
+                <div class="assistant-msg__hint">{describeFailure(kind(), r.url).detail}</div>
+              )}
+            </Show>
+
             <div class="tab-strip" role="tablist" aria-label="Response panes">
               <For each={TABS}>
                 {(t) => (
diff --git a/src/components/Composer.tsx b/src/components/Composer.tsx
index a0df6cf..6cb9f6e 100644
--- a/src/components/Composer.tsx
+++ b/src/components/Composer.tsx
@@ -31,6 +31,12 @@ interface Props {
   onResetHeaders: () => void;
   blockedHeaders: string[];
   baseUrl: string;
+  /** Where a send actually POSTs, after normalising the base URL. */
+  requestUrl: string;
+  /** What normalising changed (a stripped `/v1`, an added scheme), if anything. */
+  baseUrlNote?: string;
+  /** Why the typed base URL is unusable, if it is. */
+  baseUrlProblem?: string;
   apiKey: string;
   model: string;
   baseUrlPlaceholder: string;
@@ -143,6 +149,10 @@ const EyeOffIcon: Component = () => (
 
 const HealthBadge: Component<{ status: HealthStatus }> = (p) => {
   const status = () => p.status;
+  const isError = () =>
+    status().kind === 'failed' ||
+    status().kind === 'invalid' ||
+    status().kind === 'http-error';
   return (
     <Show when={status().kind !== 'idle'}>
       <span
@@ -150,10 +160,7 @@ const HealthBadge: Component<{ status: HealthStatus }> = (p) => {
         classList={{
           'health-badge--ok': status().kind === 'ok',
           'health-badge--warn': status().kind === 'checking',
-          'health-badge--err':
-            status().kind === 'cors' ||
-            status().kind === 'network' ||
-            status().kind === 'http-error',
+          'health-badge--err': isError(),
         }}
         title={healthTitle(status())}
       >
@@ -169,10 +176,10 @@ function healthLabel(s: HealthStatus): string {
       return `reachable · ${s.latencyMs}ms`;
     case 'checking':
       return 'checking…';
-    case 'cors':
-      return 'CORS blocked';
-    case 'network':
-      return 'unreachable';
+    case 'invalid':
+      return 'invalid URL';
+    case 'failed':
+      return s.label;
     case 'http-error':
       return `HTTP ${s.status}`;
     default:
@@ -180,18 +187,21 @@ function healthLabel(s: HealthStatus): string {
   }
 }
 
+// The badge only ever proves the health endpoint answered — it says nothing
+// about the endpoint a send targets. Naming the probed URL keeps a green badge
+// from being read as "your request will work".
 function healthTitle(s: HealthStatus): string {
   switch (s.kind) {
     case 'ok':
-      return 'Health check succeeded';
+      return `Health check succeeded — probed ${s.probedUrl}`;
     case 'checking':
-      return 'Pinging /api/v1/health…';
-    case 'cors':
+      return 'Checking the gateway health endpoint…';
+    case 'invalid':
+      return s.message;
+    case 'failed':
       return s.message;
-    case 'network':
-      return `Network error: ${s.message}`;
     case 'http-error':
-      return `Health endpoint returned ${s.status} ${s.statusText}`;
+      return `${s.probedUrl} returned ${s.status} ${s.statusText}`;
     default:
       return '';
   }
@@ -273,6 +283,21 @@ const Composer: Component<Props> = (props) => {
                   spellcheck={false}
                   autocomplete="off"
                 />
+                {/* The endpoint the base URL resolves to. Pasting a full
+                    endpoint or a base ending in `/v1` is the single most
+                    common way to get a 404 out of a healthy gateway, so show
+                    the result before the user hits Send rather than after. */}
+                <Show
+                  when={!props.baseUrlProblem}
+                  fallback={<span class="composer-field__hint composer-field__hint--err">{props.baseUrlProblem}</span>}
+                >
+                  <span class="composer-field__hint">
+                    POST <code>{props.requestUrl}</code>
+                    <Show when={props.baseUrlNote}>
+                      {(note) => <em class="composer-field__hint-note">{note()}</em>}
+                    </Show>
+                  </span>
+                </Show>
               </label>
               <label class="composer-field">
                 <span>Model</span>
diff --git a/src/send.ts b/src/send.ts
index fabc1a7..fd914b9 100644
--- a/src/send.ts
+++ b/src/send.ts
@@ -1,5 +1,6 @@
 import type { AuthScheme, StreamParser } from './formats/types';
 import { readSse } from './services/sse';
+import { classifyFetchFailure, type FailureKind } from './services/diagnostics';
 
 export interface SendInput {
   url: string;
@@ -22,7 +23,7 @@ export interface SendResult {
   responseBody: string;
   responseJson: unknown | null;
   error?: string;
-  errorKind?: 'network' | 'cors' | 'mixed-content' | 'aborted' | 'unknown';
+  errorKind?: FailureKind;
   /** True when the request was sent with stream:true and read as SSE. */
   isStream?: boolean;
   /** Assistant text assembled from the stream (streamed requests only). */
@@ -241,25 +242,6 @@ function errorResult(
     responseBody: '',
     responseJson: null,
     error: err instanceof Error ? err.message : String(err),
-    errorKind: classifyError(err, input.url),
+    errorKind: classifyFetchFailure(err, input.url),
   };
 }
-
-function classifyError(err: unknown, url: string): SendResult['errorKind'] {
-  if (err instanceof DOMException && err.name === 'AbortError') return 'aborted';
-  const msg = err instanceof Error ? err.message : String(err);
-  // Mixed content: page is HTTPS but the target URL is HTTP
-  try {
-    if (typeof window !== 'undefined' && window.location.protocol === 'https:') {
-      const target = new URL(url);
-      if (target.protocol === 'http:') return 'mixed-content';
-    }
-  } catch {
-    /* malformed URL handled below */
-  }
-  // `TypeError: Failed to fetch` covers DNS, connection refused, AND CORS
-  // preflight rejection. We can't distinguish them from JS, so default to
-  // "network" — the UI explains both possibilities.
-  if (/fetch/i.test(msg) || err instanceof TypeError) return 'network';
-  return 'unknown';
-}
diff --git a/src/services/baseUrl.test.ts b/src/services/baseUrl.test.ts
new file mode 100644
index 0000000..311cb32
--- /dev/null
+++ b/src/services/baseUrl.test.ts
@@ -0,0 +1,155 @@
+import { describe, expect, it } from 'vitest';
+import { hasValidHostname, isLoopbackHost, isPrivateHost, normalizeBaseUrl } from './baseUrl';
+
+const CHAT = '/v1/chat/completions';
+const MESSAGES = '/v1/messages';
+
+describe('normalizeBaseUrl', () => {
+  it('appends the format path to a bare origin', () => {
+    const r = normalizeBaseUrl('https://app.manifest.build', CHAT);
+    expect(r.valid).toBe(true);
+    expect(r.requestUrl).toBe('https://app.manifest.build/v1/chat/completions');
+    expect(r.note).toBeUndefined();
+  });
+
+  it('ignores trailing slashes', () => {
+    expect(normalizeBaseUrl('https://app.manifest.build///', CHAT).requestUrl).toBe(
+      'https://app.manifest.build/v1/chat/completions',
+    );
+  });
+
+  // The reported bug: a base ending in /v1 produced /v1/v1/chat/completions and
+  // a 404 that read as "the gateway is broken".
+  it('strips a duplicated /v1 segment', () => {
+    const r = normalizeBaseUrl('https://staging.manifest.build/v1', CHAT);
+    expect(r.requestUrl).toBe('https://staging.manifest.build/v1/chat/completions');
+    expect(r.note).toMatch(/duplicate/i);
+  });
+
+  it('strips a duplicated /v1 segment with a trailing slash', () => {
+    expect(normalizeBaseUrl('https://staging.manifest.build/v1/', CHAT).requestUrl).toBe(
+      'https://staging.manifest.build/v1/chat/completions',
+    );
+  });
+
+  it('strips a fully pasted endpoint', () => {
+    const r = normalizeBaseUrl('https://api.openai.com/v1/chat/completions', CHAT);
+    expect(r.requestUrl).toBe('https://api.openai.com/v1/chat/completions');
+    expect(r.note).toMatch(/v1\/chat\/completions/);
+  });
+
+  it('strips a pasted endpoint belonging to another format', () => {
+    expect(normalizeBaseUrl('https://api.anthropic.com/v1/messages', MESSAGES).requestUrl).toBe(
+      'https://api.anthropic.com/v1/messages',
+    );
+  });
+
+  it('strips /v1 for the Anthropic format too', () => {
+    expect(normalizeBaseUrl('http://localhost:3001/v1', MESSAGES).requestUrl).toBe(
+      'http://localhost:3001/v1/messages',
+    );
+  });
+
+  // Providers whose base URL legitimately carries a path must survive intact.
+  it.each([
+    ['https://api.groq.com/openai', 'https://api.groq.com/openai/v1/chat/completions'],
+    ['https://openrouter.ai/api', 'https://openrouter.ai/api/v1/chat/completions'],
+    [
+      'https://api.fireworks.ai/inference',
+      'https://api.fireworks.ai/inference/v1/chat/completions',
+    ],
+    [
+      'https://dashscope.aliyuncs.com/compatible-mode',
+      'https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions',
+    ],
+  ])('keeps the provider path in %s', (base, expected) => {
+    const r = normalizeBaseUrl(base, CHAT);
+    expect(r.requestUrl).toBe(expected);
+    expect(r.note).toBeUndefined();
+  });
+
+  it('keeps a gateway mounted under its own prefix', () => {
+    expect(normalizeBaseUrl('https://gw.example.com/api/v1', CHAT).requestUrl).toBe(
+      'https://gw.example.com/api/v1/chat/completions',
+    );
+  });
+
+  it('trims surrounding whitespace instead of building an unparseable URL', () => {
+    const r = normalizeBaseUrl('  https://app.manifest.build  ', CHAT);
+    expect(r.valid).toBe(true);
+    expect(r.requestUrl).toBe('https://app.manifest.build/v1/chat/completions');
+  });
+
+  it('infers http:// for a schemeless loopback host', () => {
+    const r = normalizeBaseUrl('localhost:52154', CHAT);
+    expect(r.valid).toBe(true);
+    expect(r.requestUrl).toBe('http://localhost:52154/v1/chat/completions');
+    expect(r.note).toMatch(/http:\/\//);
+  });
+
+  it('infers https:// for a schemeless public host', () => {
+    expect(normalizeBaseUrl('app.manifest.build', CHAT).requestUrl).toBe(
+      'https://app.manifest.build/v1/chat/completions',
+    );
+  });
+
+  it('normalises an uppercase scheme', () => {
+    expect(normalizeBaseUrl('HTTP://localhost:3001', CHAT).requestUrl).toBe(
+      'http://localhost:3001/v1/chat/completions',
+    );
+  });
+
+  it('drops a query string rather than mangling the endpoint', () => {
+    const r = normalizeBaseUrl('https://app.manifest.build?debug=1', CHAT);
+    expect(r.requestUrl).toBe('https://app.manifest.build/v1/chat/completions');
+    expect(r.note).toMatch(/query/i);
+  });
+
+  // Left unguarded, `fetch` resolved these against Wingman's own origin and
+  // shipped the user's API key there.
+  it.each([
+    ['', /empty/i],
+    ['not a url at all', /valid URL/i],
+    ['ftp://files.example.com', /not a supported scheme/i],
+    ['mailto:someone@example.com', /not a supported scheme/i],
+  ])('rejects %s', (input, problem) => {
+    const r = normalizeBaseUrl(input, CHAT);
+    expect(r.valid).toBe(false);
+    expect(r.requestUrl).toBe('');
+    expect(r.problem).toMatch(problem);
+  });
+});
+
+// `new URL()` disagrees across engines: Chrome percent-encodes a space in a
+// host and returns a URL, Node and jsdom throw. These cases are the ones
+// Chrome would hand back, so they must be rejected by our own check rather
+// than by the parser.
+describe('hasValidHostname', () => {
+  it.each(['localhost', 'app.manifest.build', '127.0.0.1', '[::1]', 'my_host.internal'])(
+    'accepts %s',
+    (h) => expect(hasValidHostname(h)).toBe(true),
+  );
+  it.each(['', 'not%20a%20url%20at%20all', 'a b', 'a|b', 'héllo.example.com'])(
+    'rejects %s',
+    (h) => expect(hasValidHostname(h)).toBe(false),
+  );
+});
+
+describe('isLoopbackHost', () => {
+  it.each(['localhost', 'LOCALHOST', '127.0.0.1', '::1', 'api.localhost'])('%s is loopback', (h) =>
+    expect(isLoopbackHost(h)).toBe(true),
+  );
+  it.each(['app.manifest.build', '8.8.8.8', 'localhost.example.com'])('%s is not loopback', (h) =>
+    expect(isLoopbackHost(h)).toBe(false),
+  );
+});
+
+describe('isPrivateHost', () => {
+  it.each(['127.0.0.1', '10.1.2.3', '192.168.1.10', '172.16.0.1', '172.31.255.1', '169.254.1.1'])(
+    '%s is private',
+    (h) => expect(isPrivateHost(h)).toBe(true),
+  );
+  it.each(['8.8.8.8', '172.32.0.1', '11.0.0.1', 'app.manifest.build'])('%s is public', (h) =>
+    expect(isPrivateHost(h)).toBe(false),
+  );
+});
diff --git a/src/services/baseUrl.ts b/src/services/baseUrl.ts
new file mode 100644
index 0000000..75744c2
--- /dev/null
+++ b/src/services/baseUrl.ts
@@ -0,0 +1,158 @@
+// Turning what a user types into the URL Wingman actually POSTs to.
+//
+// Wingman's convention is that the Base URL carries no endpoint path — the
+// selected `ApiFormat` appends it (`/v1/chat/completions`, `/v1/messages`,
+// `/v1/responses`). People reasonably paste the thing their provider's docs
+// show them, which is usually the full endpoint or a base ending in `/v1`.
+// Concatenating blindly then produced `…/v1/v1/chat/completions` and a 404 that
+// reads like the gateway is broken. Normalising here means the common pastes
+// all resolve to the same request.
+
+/** Hosts the browser treats as the local machine (loopback address space). */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]']);
+
+/** Every endpoint path a format may append, longest first so the greedy match wins. */
+const FORMAT_PATHS = ['/v1/chat/completions', '/v1/messages', '/v1/responses'] as const;
+
+export interface NormalizedBaseUrl {
+  /** Base URL with no trailing slash and no duplicated endpoint path. */
+  base: string;
+  /** `base` + the format path — the URL a request is actually sent to. */
+  requestUrl: string;
+  /** False when the input can't be turned into an absolute http(s) URL. */
+  valid: boolean;
+  /** Why it's unusable, shown to the user instead of a raw fetch TypeError. */
+  problem?: string;
+  /** What normalisation changed, so a surprising request URL is explainable. */
+  note?: string;
+}
+
+/** True for a URL (or bare host) that points at the machine the browser runs on. */
+export function isLoopbackHost(hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  return LOOPBACK_HOSTS.has(host) || host.endsWith('.localhost');
+}
+
+/**
+ * Private / link-local IPv4 ranges plus IPv6 unique-local. Together with
+ * loopback these are the "local network" address spaces browsers now gate
+ * behind a user permission when the page itself is public.
+ */
+export function isPrivateHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (isLoopbackHost(host)) return true;
+  if (/^10\./.test(host)) return true;
+  if (/^192\.168\./.test(host)) return true;
+  if (/^169\.254\./.test(host)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
+  if (/^f[cd][0-9a-f]{2}:/.test(host)) return true;
+  return host === 'localhost' || host.endsWith('.local');
+}
+
+/**
+ * Whether a parsed hostname is one a DNS name, IPv4 literal or bracketed IPv6
+ * literal could produce.
+ *
+ * Don't be tempted to let `new URL()` decide this. Chrome accepts spaces in a
+ * host and percent-encodes them, so `new URL('https://not a url at all')`
+ * resolves to the host `not%20a%20url%20at%20all` instead of throwing — while
+ * Node and jsdom, which follow the spec here, do throw. Validating the host
+ * ourselves is the only way the same input is rejected in the browser and in
+ * the tests.
+ */
+export function hasValidHostname(hostname: string): boolean {
+  if (!hostname) return false;
+  return /^[a-z0-9._\-[\]:]+$/i.test(hostname);
+}
+
+/** Loopback hosts are served over plain http in dev; anything else defaults to https. */
+function inferScheme(raw: string): string {
+  const host = raw.split('/')[0]!.split(':')[0]!;
+  return isLoopbackHost(host) ? 'http://' : 'https://';
+}
+
+/**
+ * Strip an endpoint path the user pasted along with their base URL. Handles the
+ * full endpoint (`…/v1/chat/completions`) and the far more common half-paste of
+ * just the version segment (`…/v1`), which every format path already supplies.
+ */
+function stripEndpointPath(pathname: string, formatPath: string): { path: string; note?: string } {
+  const path = pathname.replace(/\/+$/, '');
+  for (const candidate of FORMAT_PATHS) {
+    if (path.toLowerCase().endsWith(candidate)) {
+      return {
+        path: path.slice(0, -candidate.length),
+        note: `Removed "${candidate}" — the format already appends it.`,
+      };
+    }
+  }
+  // `/v1` on its own: the format path starts with `/v1`, so keeping it would
+  // double the version segment.
+  if (formatPath.startsWith('/v1/') && /\/v1$/i.test(path)) {
+    return { path: path.slice(0, -3), note: 'Removed a duplicate "/v1" segment.' };
+  }
+  return { path };
+}
+
+/**
+ * Normalise a user-typed base URL and resolve the URL a request will be sent
+ * to. Never throws — an unusable input comes back with `valid: false` and a
+ * message, because the alternative was `fetch` throwing a raw TypeError (or,
+ * worse, resolving a schemeless base relative to Wingman's own origin and
+ * quietly sending the user's API key there).
+ */
+export function normalizeBaseUrl(raw: string, formatPath: string): NormalizedBaseUrl {
+  const trimmed = raw.trim();
+  const fail = (problem: string): NormalizedBaseUrl => ({
+    base: trimmed,
+    requestUrl: '',
+    valid: false,
+    problem,
+  });
+
+  if (!trimmed) return fail('Base URL is empty.');
+
+  const notes: string[] = [];
+  let candidate = trimmed;
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(candidate)) {
+    // A schemeless value is not a relative URL here — it's a host the user
+    // didn't finish typing. Guess the scheme rather than letting `fetch`
+    // resolve it against Wingman's origin.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(candidate) && !/^[a-z]+:\d+/i.test(candidate)) {
+      return fail(`"${candidate.split(':')[0]}" is not a supported scheme — use http:// or https://.`);
+    }
+    const scheme = inferScheme(candidate);
+    candidate = scheme + candidate;
+    notes.push(`Added "${scheme}".`);
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    return fail("That isn't a valid URL.");
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    const scheme = parsed.protocol.replace(/:$/, '');
+    return fail(`"${scheme}" is not a supported scheme — use http:// or https://.`);
+  }
+  if (!hasValidHostname(parsed.hostname)) return fail("That isn't a valid URL.");
+
+  if (parsed.search || parsed.hash) {
+    parsed.search = '';
+    parsed.hash = '';
+    notes.push('Dropped the query string.');
+  }
+
+  const { path, note } = stripEndpointPath(parsed.pathname, formatPath);
+  if (note) notes.push(note);
+
+  const base = parsed.origin + path;
+  return {
+    base,
+    requestUrl: base + formatPath,
+    valid: true,
+    note: notes.length > 0 ? notes.join(' ') : undefined,
+  };
+}
diff --git a/src/services/diagnostics.test.ts b/src/services/diagnostics.test.ts
new file mode 100644
index 0000000..caef091
--- /dev/null
+++ b/src/services/diagnostics.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { classifyFetchFailure, describeFailure } from './diagnostics';
+
+/** Point `window.location` at an origin so the address-space branches can run. */
+function setPageOrigin(href: string): void {
+  Object.defineProperty(window, 'location', {
+    value: new URL(href),
+    writable: true,
+    configurable: true,
+  });
+}
+
+const failedToFetch = new TypeError('Failed to fetch');
+
+afterEach(() => setPageOrigin('http://localhost:3002/'));
+
+describe('classifyFetchFailure', () => {
+  it('reports an aborted request', () => {
+    const err = new DOMException('aborted', 'AbortError');
+    expect(classifyFetchFailure(err, 'https://app.manifest.build/v1/chat/completions')).toBe(
+      'aborted',
+    );
+  });
+
+  // The reported failure: hosted HTTPS Wingman in the dashboard drawer calling
+  // a loopback dev gateway. Chrome gates this behind the Local Network Access
+  // permission, so no server-side CORS change can fix it — calling it "CORS"
+  // is what sent people editing allow-lists that were already correct.
+  it.each([
+    'http://localhost:52154/v1/chat/completions',
+    'http://127.0.0.1:3001/v1/chat/completions',
+    'http://192.168.1.20:3001/v1/chat/completions',
+  ])('flags %s from an HTTPS page as a local-network block', (url) => {
+    setPageOrigin('https://wingman.manifest.build/');
+    expect(classifyFetchFailure(failedToFetch, url)).toBe('local-network');
+  });
+
+  it('flags a public plain-HTTP target from an HTTPS page as mixed content', () => {
+    setPageOrigin('https://wingman.manifest.build/');
+    expect(classifyFetchFailure(failedToFetch, 'http://api.example.com/v1/chat/completions')).toBe(
+      'mixed-content',
+    );
+  });
+
+  it('does not blame the local network for a public HTTPS target', () => {
+    setPageOrigin('https://wingman.manifest.build/');
+    expect(classifyFetchFailure(failedToFetch, 'https://app.manifest.build/v1/chat/completions')).toBe(
+      'network',
+    );
+  });
+
+  // Same address space: loopback page to loopback gateway is allowed, so a
+  // failure here really is "not running, or CORS".
+  it('reports a plain network failure when the page is itself on localhost', () => {
+    setPageOrigin('http://localhost:3002/');
+    expect(classifyFetchFailure(failedToFetch, 'http://localhost:52154/v1/chat/completions')).toBe(
+      'network',
+    );
+  });
+
+  it('gives up rather than guessing on an unparseable URL', () => {
+    expect(classifyFetchFailure(failedToFetch, 'not a url')).toBe('unknown');
+  });
+});
+
+describe('describeFailure', () => {
+  it('names Local Network Access and does not tell the user to fix CORS', () => {
+    setPageOrigin('https://wingman.manifest.build/');
+    const advice = describeFailure('local-network', 'http://localhost:52154/v1/chat/completions');
+    expect(advice.label).toBe('local network blocked');
+    expect(advice.detail).toMatch(/Local Network Access/);
+    expect(advice.detail).toMatch(/localhost:52154/);
+    expect(advice.detail).not.toMatch(/allow-list/);
+  });
+
+  it('offers both causes for an ambiguous network failure', () => {
+    const advice = describeFailure('network', 'http://localhost:59999/v1/chat/completions');
+    expect(advice.label).toBe('unreachable');
+    expect(advice.detail).toMatch(/nothing listening/);
+    expect(advice.detail).toMatch(/CORS/);
+  });
+
+  it('explains mixed content in terms of the page origin', () => {
+    setPageOrigin('https://wingman.manifest.build/');
+    const advice = describeFailure('mixed-content', 'http://api.example.com/v1/chat/completions');
+    expect(advice.detail).toMatch(/https:\/\/wingman\.manifest\.build/);
+    expect(advice.detail).toMatch(/api\.example\.com/);
+  });
+});
diff --git a/src/services/diagnostics.ts b/src/services/diagnostics.ts
new file mode 100644
index 0000000..bef6bbc
--- /dev/null
+++ b/src/services/diagnostics.ts
@@ -0,0 +1,113 @@
+// Why a browser fetch failed, and what the user can actually do about it.
+//
+// `fetch` reports DNS failure, connection refused, a CORS preflight rejection
+// and an address-space block as the same opaque `TypeError: Failed to fetch`.
+// Wingman used to resolve that ambiguity by always blaming CORS, which sent
+// people off to edit an allow-list that was already correct. What we *can*
+// determine from JS is the relationship between the page's origin and the
+// target's: that alone identifies the two failures browsers introduced
+// recently, and it's the difference between an actionable message and a
+// wild goose chase.
+
+import { isPrivateHost } from './baseUrl';
+
+export type FailureKind =
+  | 'network'
+  | 'cors'
+  | 'local-network'
+  | 'mixed-content'
+  | 'aborted'
+  | 'unknown';
+
+export interface FailureAdvice {
+  /** Short badge text. */
+  label: string;
+  /** One or two sentences naming the cause and the fix. */
+  detail: string;
+}
+
+function pageProtocol(): string {
+  if (typeof window === 'undefined') return 'https:';
+  return window.location.protocol;
+}
+
+function pageOrigin(): string {
+  if (typeof window === 'undefined') return '';
+  return window.location.origin;
+}
+
+/**
+ * Classify a rejected fetch. `targetUrl` is the URL that was being requested;
+ * an unparseable one falls back to `unknown` rather than guessing.
+ */
+export function classifyFetchFailure(err: unknown, targetUrl: string): FailureKind {
+  if (err instanceof DOMException && err.name === 'AbortError') return 'aborted';
+
+  let target: URL;
+  try {
+    target = new URL(targetUrl);
+  } catch {
+    return 'unknown';
+  }
+
+  if (pageProtocol() === 'https:') {
+    // A public HTTPS page reaching into the local network is gated by Chrome's
+    // Local Network Access permission (which replaced Private Network Access:
+    // no server header can satisfy it any more) and blocked outright by
+    // Safari's mixed-content rules. Either way it is not a CORS problem, and
+    // no change to the target server will fix it.
+    if (isPrivateHost(target.hostname)) return 'local-network';
+    if (target.protocol === 'http:') return 'mixed-content';
+  }
+
+  const message = err instanceof Error ? err.message : String(err);
+  if (/fetch/i.test(message) || err instanceof TypeError) return 'network';
+  return 'unknown';
+}
+
+/** User-facing wording for a failure kind. Shared by the health badge and the send result. */
+export function describeFailure(kind: FailureKind, targetUrl: string): FailureAdvice {
+  let host = targetUrl;
+  try {
+    host = new URL(targetUrl).host;
+  } catch {
+    /* keep the raw string */
+  }
+
+  switch (kind) {
+    case 'local-network':
+      return {
+        label: 'local network blocked',
+        detail:
+          `The browser blocked this request: ${pageOrigin()} is a public page and ${host} is on ` +
+          'your local network. Chrome gates that behind the Local Network Access permission and ' +
+          'Safari refuses it outright — no CORS or server-side change will lift it. Run Wingman ' +
+          'on localhost (or open it from your dashboard\'s own origin) to reach a local gateway.',
+      };
+    case 'mixed-content':
+      return {
+        label: 'mixed content',
+        detail:
+          `${pageOrigin()} is served over HTTPS, so the browser refuses to call ${host} over ` +
+          'plain HTTP. Use an https:// base URL, or run Wingman over HTTP alongside the gateway.',
+      };
+    case 'cors':
+      return {
+        label: 'CORS blocked',
+        detail: `${host} answered, but without an Access-Control-Allow-Origin header for ${pageOrigin()}.`,
+      };
+    case 'aborted':
+      return { label: 'cancelled', detail: 'The request was cancelled.' };
+    case 'network':
+      return {
+        label: 'unreachable',
+        detail:
+          `Couldn't reach ${host}. The browser reports connection failures and CORS rejections ` +
+          'identically, so this is one of: nothing listening on that host and port, the wrong ' +
+          `base URL, or a CORS allow-list that doesn't include ${pageOrigin()}. The browser ` +
+          'console shows which.',
+      };
+    default:
+      return { label: 'failed', detail: `The request to ${host} failed.` };
+  }
+}
diff --git a/src/services/healthCheck.ts b/src/services/healthCheck.ts
index a782f57..406fd26 100644
--- a/src/services/healthCheck.ts
+++ b/src/services/healthCheck.ts
@@ -1,63 +1,58 @@
+import { classifyFetchFailure, describeFailure, type FailureKind } from './diagnostics';
+import { normalizeBaseUrl } from './baseUrl';
+
 export type HealthStatus =
   | { kind: 'idle' }
   | { kind: 'checking' }
-  | { kind: 'ok'; latencyMs: number }
-  | { kind: 'cors'; message: string }
-  | { kind: 'network'; message: string }
-  | { kind: 'http-error'; status: number; statusText: string };
+  | { kind: 'ok'; latencyMs: number; probedUrl: string }
+  | { kind: 'invalid'; message: string }
+  | { kind: 'failed'; failure: FailureKind; label: string; message: string; probedUrl: string }
+  | { kind: 'http-error'; status: number; statusText: string; probedUrl: string };
 
+/**
+ * Probe a gateway's health endpoint to give the connection bar a live badge.
+ *
+ * The health path is rooted at the *origin* (`{origin}/api/v1/health` is where
+ * a Manifest gateway serves it), not under whatever path the base URL carries.
+ * That used to be done with `new URL(path, base)`, which silently discarded the
+ * base path — so a base of `…/v1` probed the right health endpoint, went green,
+ * and then the send 404'd against `…/v1/v1/chat/completions`. The badge now
+ * reports the URL it actually probed so a green badge can't imply more than it
+ * checked.
+ */
 export async function checkHealth(
   baseUrl: string,
   path: string,
+  formatPath: string,
   signal?: AbortSignal,
 ): Promise<HealthStatus> {
-  const trimmed = baseUrl.trim().replace(/\/+$/, '');
-  if (!trimmed) return { kind: 'idle' };
+  if (!baseUrl.trim()) return { kind: 'idle' };
+
+  const normalized = normalizeBaseUrl(baseUrl, formatPath);
+  if (!normalized.valid) {
+    return { kind: 'invalid', message: normalized.problem ?? 'Invalid base URL.' };
+  }
 
-  let url: string;
+  let probedUrl: string;
   try {
-    url = new URL(path, trimmed).toString();
+    probedUrl = new URL(path, normalized.base).toString();
   } catch {
-    return { kind: 'network', message: 'Invalid URL' };
+    return { kind: 'invalid', message: 'Invalid base URL.' };
   }
 
   const started = performance.now();
   let res: Response;
   try {
-    res = await fetch(url, { method: 'GET', signal });
+    res = await fetch(probedUrl, { method: 'GET', signal });
   } catch (err) {
     if ((err as Error)?.name === 'AbortError') return { kind: 'checking' };
-    // Browsers surface CORS preflight failures and DNS / connection errors as
-    // the same `TypeError: Failed to fetch`. We can't reliably tell them apart
-    // from JS, so we report "network" with a hint that points at the most
-    // common cause for hosted Wingman: a missing allow-list entry.
-    const message = err instanceof Error ? err.message : String(err);
-    const looksLikeCors =
-      /failed to fetch|networkerror|load failed/i.test(message) && hasOrigin(trimmed);
-    if (looksLikeCors) {
-      return {
-        kind: 'cors',
-        message: `Couldn't reach ${trimmed}. Likely CORS — your backend must allow ${origin()}.`,
-      };
-    }
-    return { kind: 'network', message };
+    const failure = classifyFetchFailure(err, probedUrl);
+    const advice = describeFailure(failure, probedUrl);
+    return { kind: 'failed', failure, label: advice.label, message: advice.detail, probedUrl };
   }
 
   if (res.ok) {
-    return { kind: 'ok', latencyMs: Math.round(performance.now() - started) };
-  }
-  return { kind: 'http-error', status: res.status, statusText: res.statusText };
-}
-
-function origin(): string {
-  if (typeof window === 'undefined') return '';
-  return window.location.origin;
-}
-
-function hasOrigin(target: string): boolean {
-  try {
-    return new URL(target).origin !== origin();
-  } catch {
-    return false;
+    return { kind: 'ok', latencyMs: Math.round(performance.now() - started), probedUrl };
   }
+  return { kind: 'http-error', status: res.status, statusText: res.statusText, probedUrl };
 }
diff --git a/src/styles.css b/src/styles.css
index 67fa24a..5564994 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -645,6 +645,16 @@ textarea {
   border-left: 3px solid var(--err);
 }
 
+.assistant-msg__hint {
+  font-size: 12.5px;
+  line-height: 1.5;
+  color: var(--text-muted);
+  padding: 8px 12px;
+  background: var(--bg-mute);
+  border-radius: var(--radius-sm);
+  border-left: 3px solid var(--text-faint);
+}
+
 .assistant-msg__pane {
   display: flex;
   flex-direction: column;
@@ -1136,6 +1146,37 @@ textarea {
   color: var(--ok);
 }
 
+/* A URL, not a field label — opt out of the uppercase/letter-spaced treatment
+   `.composer-field span` applies to the labels around it. Qualified with the
+   parent class so it outranks that rule's element+class specificity. */
+.composer-field span.composer-field__hint {
+  font-size: 10.5px;
+  font-weight: 500;
+  text-transform: none;
+  letter-spacing: 0;
+  color: var(--text-faint);
+  line-height: 1.45;
+  overflow-wrap: anywhere;
+}
+
+.composer-field__hint code {
+  font-family: 'JetBrains Mono', monospace;
+  font-size: 10.5px;
+  color: var(--text-muted);
+}
+
+.composer-field span.composer-field__hint--err {
+  color: var(--err);
+}
+
+.composer-field__hint-note {
+  display: block;
+  font-style: normal;
+  text-transform: none;
+  letter-spacing: 0;
+  color: var(--accent);
+}
+
 .composer-field__input-wrap {
   position: relative;
   display: flex;
diff --git a/vite.config.ts b/vite.config.ts
index 5a396df..8dfc447 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,3 +1,4 @@
+/// <reference types="vitest/config" />
 import { defineConfig } from 'vite';
 import solidPlugin from 'vite-plugin-solid';
 
@@ -9,4 +10,11 @@ export default defineConfig({
   build: {
     target: 'esnext',
   },
+  test: {
+    // jsdom, not node: the code under test branches on `window.location`
+    // (page protocol and origin drive the mixed-content / local-network
+    // diagnosis), so it has to run against a document.
+    environment: 'jsdom',
+    include: ['src/**/*.test.ts'],
+  },
 });