diff --git a/gui/components/modelSelector.vue b/gui/components/modelSelector.vue
index 9b410f1..72120f2 100644
--- a/gui/components/modelSelector.vue
+++ b/gui/components/modelSelector.vue
@@ -53,10 +53,14 @@
 
       <div class="field">
         <label class="label">Max Tokens</label>
-        <input class="input" type="number" v-model.number="local.max_tokens" />
+        <input class="input" type="number" min="1" v-model.number="local.max_tokens" />
         <p class="help">Shared with <strong>Global Model Config</strong>.</p>
       </div>
 
+      <p v-if="validationError" class="help is-danger" role="alert">
+        {{ validationError }}
+      </p>
+
       <div class="field">
         <label class="checkbox">
           <input type="checkbox" v-model="local.offline" /> Offline mode
@@ -97,6 +101,7 @@
  * Imports
  * ============================================================ */
 import { computed, reactive, ref, watch } from 'vue'
+import { request } from '../composables/request.js'
 
 /* ============================================================
  * Props / Emits
@@ -130,11 +135,22 @@ const resolvedModel = computed(
 const resolvedApiBase = computed(
   () => props.backendConfig?.resolved_api_base || 'not set'
 )
-const isValid = computed(
-  () => local.temperature === null || local.temperature === undefined
-    ? true
-    : local.temperature >= 0 && local.temperature <= 1
-)
+// An emptied number input yields '', and '' >= 0 && '' <= 1 is true, so a
+// cleared box passed validation and saved a blank into the shared llm
+// profile, which has no empty-value guard of its own.
+const blank = v => v === '' || v === null || v === undefined
+
+const validationError = computed(() => {
+  const t = local.temperature
+  const m = local.max_tokens
+  if (blank(t)) return 'Temperature is required.'
+  if (!Number.isFinite(t) || t < 0 || t > 1) return 'Temperature must be between 0 and 1.'
+  if (blank(m)) return 'Max Tokens is required.'
+  if (!Number.isFinite(m) || m < 1) return 'Max Tokens must be 1 or more.'
+  return ''
+})
+
+const isValid = computed(() => !validationError.value)
 
 
 /* ============================================================
@@ -154,6 +170,14 @@ watch(
   { deep: true, immediate: true }
 )
 
+// The success message described the values as they were sent, so any edit
+// after it retires it rather than letting it vouch for unsaved changes.
+watch(
+  () => ({ ...local }),
+  () => { if (saveState.value?.tone === 'has-text-success') saveState.value = null },
+  { deep: true }
+)
+
 /* ============================================================
  * Persist
  * ============================================================ */
@@ -166,7 +190,7 @@ async function save() {
   try {
     // Only the fields this panel edits. conf/local.yml is deep-merged over
     // default.yml, so omitted keys keep their shipped defaults.
-    const res = await fetch('/plugin/mcp/set_config', {
+    await request('Save failed', '/plugin/mcp/set_config', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({
@@ -188,12 +212,12 @@ async function save() {
       })
     })
 
-    if (!res.ok) throw new Error(`HTTP ${res.status}`)
-
     saveState.value = { message: 'Saved', tone: 'has-text-success' }
     emit('saved')
   } catch (e) {
-    saveState.value = { message: `Save failed: ${e.message}`, tone: 'has-text-danger' }
+    // request() already phrases this for the operator, including the expired
+    // session that used to report a green "Saved" for a save that never ran.
+    saveState.value = { message: e.message, tone: 'has-text-danger' }
   } finally {
     saving.value = false
   }
diff --git a/gui/composables/request.js b/gui/composables/request.js
new file mode 100644
index 0000000..d7951a1
--- /dev/null
+++ b/gui/composables/request.js
@@ -0,0 +1,58 @@
+/* ============================================================
+ * PLUGIN REQUESTS
+ *
+ * Caldera gates plugin routes per handler, and check_permissions answers an
+ * expired session by raising HTTPFound('/login'). fetch follows that
+ * redirect, so the reply arrives as a 200 carrying the login page: res.ok is
+ * true, res.json() throws on the HTML, and the operator was left looking at
+ * an empty table with nothing to explain it. Every caller goes through these
+ * so no call site can forget the check.
+ * ============================================================ */
+
+export const SESSION_EXPIRED =
+  'Session expired. Sign in to CALDERA again, then reload this page.'
+
+function isLoginPage(res) {
+  return res.redirected && new URL(res.url).pathname.startsWith('/login')
+}
+
+/**
+ * Call a plugin endpoint and return the response.
+ *
+ * Rejects with a message written for the operator, so callers report
+ * `e.message` rather than assembling their own.
+ *
+ * @param {string} what how to name the failure: "Could not load the list"
+ */
+export async function request(what, url, options) {
+  let res
+  try {
+    res = await fetch(url, options)
+  } catch (e) {
+    throw new Error(`Could not reach the server: ${e.message}`)
+  }
+
+  // A non-default login handler answers 401/403 instead of redirecting.
+  if (isLoginPage(res) || res.status === 401 || res.status === 403) {
+    throw new Error(SESSION_EXPIRED)
+  }
+
+  if (!res.ok) {
+    // The API states its own refusals in an "error" key; a 500 has none.
+    let detail = ''
+    try { detail = (await res.json()).error || '' } catch { /* non-JSON body */ }
+    throw new Error(`${what} (${res.status})${detail ? ': ' + detail : ''}.`)
+  }
+
+  return res
+}
+
+/** As `request`, decoding the body that every endpoint but download returns. */
+export async function requestJson(what, url, options) {
+  const res = await request(what, url, options)
+  try {
+    return await res.json()
+  } catch {
+    throw new Error(`${what}: the server sent a reply this page cannot read.`)
+  }
+}
diff --git a/gui/views/cti.vue b/gui/views/cti.vue
index 96bd4b7..d5d9211 100644
--- a/gui/views/cti.vue
+++ b/gui/views/cti.vue
@@ -75,8 +75,21 @@
             </button>
           </div>
 
-          <div v-if="ctiStatus" class="notification is-info mt-4">
-            {{ ctiStatus }}
+          <!-- One banner for progress, success and failure, so the tone
+               picks the Bulma class and the operator can close it. -->
+          <div
+            v-if="ctiStatus.text"
+            class="notification mt-4"
+            :class="`is-${ctiStatus.tone}`"
+            :role="ctiStatus.tone === 'danger' ? 'alert' : 'status'"
+            :key="ctiStatus.tone"
+          >
+            <button
+              class="delete"
+              aria-label="Dismiss status"
+              @click="clearCtiStatus"
+            />
+            {{ ctiStatus.text }}
           </div>
         </div>
 
@@ -176,7 +189,7 @@
       <div class="buttons">
         <button
           class="button is-primary is-small"
-          :disabled="!selectedRaw.size"
+          :disabled="!selectedRaw.size || pipelineRunning"
           @click="runPipelineForSelected"
         >
           Run Pipeline
@@ -326,9 +339,10 @@
 /* ============================================================
  * Imports
  * ============================================================ */
-import { computed, onMounted, reactive, ref } from 'vue'
+import { computed, onMounted, onUnmounted, reactive, ref } from 'vue'
 import StixViewerModal from '../components/stixViewer.vue'
 import McpModelConfigPanel from '../components/modelSelector.vue'
+import { SESSION_EXPIRED, request, requestJson } from '../composables/request.js'
 
 /* ============================================================
  * State (Alphabetical)
@@ -339,7 +353,8 @@ const ctiFileInput = ref(null)
 const isDragging = ref(false)
 const dragDepth = ref(0)
 const ctiDropError = ref('')
-const ctiStatus = ref('')
+const ctiStatus = reactive({ text: '', tone: 'info' })
+const pipelineRunning = ref(false)
 const expandedDirs = ref({})
 const rawFiles = ref([])
 const selectedRaw = reactive(new Set())
@@ -377,6 +392,57 @@ const visibleRows = computed(() => {
   return rows
 })
 
+/* ============================================================
+ * Status Banner
+ * ============================================================ */
+// Long enough to read a confirmation without it outliving the action that
+// produced it.
+const CTI_STATUS_FADE_MS = 6000
+
+let ctiStatusTimer = null
+
+/**
+ * Show a status message. Tone is a Bulma modifier: info for work in
+ * flight, success for a finished action, warning for a nudge, danger for
+ * a failure.
+ */
+function setCtiStatus(text, tone = 'info') {
+  clearTimeout(ctiStatusTimer)
+  ctiStatusTimer = null
+  ctiStatus.text = text
+  ctiStatus.tone = tone
+  // Only a success fades on its own. Progress is replaced by its own
+  // outcome, and a failure is the one message the operator needs to read.
+  if (tone === 'success') {
+    ctiStatusTimer = setTimeout(clearCtiStatus, CTI_STATUS_FADE_MS)
+  }
+}
+
+function clearCtiStatus() {
+  clearTimeout(ctiStatusTimer)
+  ctiStatusTimer = null
+  ctiStatus.text = ''
+}
+
+/**
+ * Report a failure without burying a message the operator has not read.
+ *
+ * A list refresh runs on the poll loop's schedule rather than the operator's,
+ * so a background one may only write over an empty banner or a spent success:
+ * progress means work is still in flight, and a failure was left up on
+ * purpose. Without this a single transient refresh error replaced the running
+ * indicator for the rest of the run.
+ */
+function reportFailure(message, { background = false } = {}) {
+  if (background && ctiStatus.text && ctiStatus.tone !== 'success') {
+    // Kept out of the banner, not thrown away: without this a run whose
+    // refreshes all failed left nothing to diagnose from.
+    console.warn('[cti] suppressed background failure:', message)
+    return
+  }
+  setCtiStatus(message, 'danger')
+}
+
 /* ============================================================
  * Helpers
  * ============================================================ */
@@ -425,10 +491,19 @@ function toggleStixSelection(name) {
  * Config
  * ============================================================ */
 async function loadBackendConfig() {
-  const res = await fetch('/plugin/mcp/get_config')
-  if (!res.ok) throw new Error('Failed to load config')
+  let data
+  try {
+    data = await requestJson(
+      'Could not load the extraction model settings',
+      '/plugin/mcp/get_config',
+    )
+  } catch (e) {
+    // Reaches here from mount and from the panel's saved event, so it can
+    // land mid-run; the panel reports its own save outcome either way.
+    reportFailure(e.message, { background: true })
+    return
+  }
 
-  const data = await res.json()
   const cfg = data?.config ?? data ?? {}
   const cti = cfg?.cti ?? {}
   // The server resolves this now: it layers the profiles and applies the env
@@ -458,9 +533,14 @@ async function loadBackendConfig() {
 /* ============================================================
  * API: Raw CTI
  * ============================================================ */
-async function loadRawFiles() {
-  const res = await fetch('/plugin/mcp/cti/raw')
-  const data = await res.json()
+async function loadRawFiles({ background = false } = {}) {
+  let data
+  try {
+    data = await requestJson('Could not load the CTI file list', '/plugin/mcp/cti/raw')
+  } catch (e) {
+    reportFailure(e.message, { background })
+    return
+  }
 
   rawFiles.value = (data.items || []).sort((a, b) => {
     if (a.type !== b.type) return a.type === 'dir' ? -1 : 1
@@ -469,11 +549,17 @@ async function loadRawFiles() {
 }
 
 async function deleteSelectedRaw() {
-  await fetch('/plugin/mcp/cti/raw/delete', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ files: Array.from(selectedRaw) })
-  })
+  try {
+    await request('Could not delete the selected files', '/plugin/mcp/cti/raw/delete', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ files: Array.from(selectedRaw) })
+    })
+  } catch (e) {
+    // The selection survives, so the operator can retry without re-picking.
+    setCtiStatus(e.message, 'danger')
+    return
+  }
 
   selectedRaw.clear()
   loadRawFiles()
@@ -492,6 +578,10 @@ function acceptCtiFile(file) {
     ctiFile.value = null
     return
   }
+  // Only a spent confirmation is retired, and only once the file is really
+  // staged. Clearing unconditionally wiped the running indicator, and the
+  // failure the operator staged this file to retry.
+  if (ctiStatus.tone === 'success') clearCtiStatus()
   ctiFile.value = file
 }
 
@@ -533,20 +623,20 @@ async function uploadCti() {
   const form = new FormData()
   form.append('file', ctiFile.value)
 
-  ctiStatus.value = 'Uploading CTI…'
+  setCtiStatus('Uploading CTI…')
 
-  const res = await fetch('/plugin/mcp/cti/upload', {
-    method: 'POST',
-    body: form
-  })
-
-  if (!res.ok) {
-    ctiStatus.value = `Upload failed (${res.status}).`
+  try {
+    await request('Upload failed', '/plugin/mcp/cti/upload', {
+      method: 'POST',
+      body: form
+    })
+  } catch (e) {
+    setCtiStatus(e.message, 'danger')
     return
   }
 
   // Staged only. Nothing is extracted until Run Pipeline.
-  ctiStatus.value = 'File staged. Select it and press Run Pipeline to extract.'
+  setCtiStatus('File staged. Select it and press Run Pipeline to extract.', 'success')
   ctiFile.value = null
   ctiDropError.value = ''
   if (ctiFileInput.value) ctiFileInput.value.value = ''
@@ -557,9 +647,14 @@ async function uploadCti() {
 /* ============================================================
  * API: STIX
  * ============================================================ */
-async function loadStixFiles() {
-  const res = await fetch('/plugin/mcp/stix/list')
-  const data = await res.json()
+async function loadStixFiles({ background = false } = {}) {
+  let data
+  try {
+    data = await requestJson('Could not load the STIX bundle list', '/plugin/mcp/stix/list')
+  } catch (e) {
+    reportFailure(e.message, { background })
+    return
+  }
 
   stixFiles.value = (data.files || [])
     .filter(f => f.filename.endsWith('.json'))
@@ -573,33 +668,59 @@ async function loadStixFiles() {
 }
 
 async function deleteStix() {
-  await fetch('/plugin/mcp/stix/delete', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ files: Array.from(selectedStix) })
-  })
+  try {
+    await request('Could not delete the selected bundles', '/plugin/mcp/stix/delete', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ files: Array.from(selectedStix) })
+    })
+  } catch (e) {
+    setCtiStatus(e.message, 'danger')
+    return
+  }
 
   selectedStix.clear()
   loadStixFiles()
 }
 
 async function downloadStix(files) {
-  for (const filename of files) {
-    const res = await fetch('/plugin/mcp/stix/download', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ filename })
-    })
+  // Unchecked, an expired session saved the login page as the bundle.
+  const failed = []
 
-    const blob = await res.blob()
-    const url = URL.createObjectURL(blob)
-
-    const a = document.createElement('a')
-    a.href = url
-    a.download = filename
-    a.click()
+  for (const filename of files) {
+    // The body is read inside the try: a connection dropped mid-transfer
+    // rejects here, not at request(), and outside it that reached no one.
+    try {
+      const res = await request(`Could not download ${filename}`, '/plugin/mcp/stix/download', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ filename })
+      })
+
+      const url = URL.createObjectURL(await res.blob())
+      const a = document.createElement('a')
+      a.href = url
+      a.download = filename
+      // Attached before the click, and revoked a tick later: a detached
+      // anchor does not download in every browser, and revoking in the same
+      // turn can cancel a transfer that started asynchronously.
+      document.body.appendChild(a)
+      a.click()
+      a.remove()
+      setTimeout(() => URL.revokeObjectURL(url), 0)
+    } catch (e) {
+      // A bundle deleted from disk answers 404, which says nothing about the
+      // rest of the selection. Only an expired session fails all of them.
+      if (e.message === SESSION_EXPIRED) {
+        setCtiStatus(e.message, 'danger')
+        return
+      }
+      failed.push(filename)
+    }
+  }
 
-    URL.revokeObjectURL(url)
+  if (failed.length) {
+    setCtiStatus(`Could not download ${failed.join(', ')}.`, 'danger')
   }
 }
 
@@ -613,13 +734,11 @@ async function viewRaw(row) {
   showRawModal.value = true
 
   try {
-    const res = await fetch('/plugin/mcp/cti/raw/view', {
+    const data = await requestJson(`Could not open ${name}`, '/plugin/mcp/cti/raw/view', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ filename: name })
     })
-    const data = await res.json()
-    if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`)
     Object.assign(rawViewer, {
       kind: data.kind, size: data.size, text: data.text, loading: false,
     })
@@ -629,13 +748,19 @@ async function viewRaw(row) {
 }
 
 async function viewStix(filename) {
-  const res = await fetch('/plugin/mcp/stix/get_stix', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ filename })
-  })
+  let out
+  try {
+    out = await requestJson(`Could not open ${filename}`, '/plugin/mcp/stix/get_stix', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ filename })
+    })
+  } catch (e) {
+    // Returning leaves the modal shut rather than opening it on no data.
+    setCtiStatus(e.message, 'danger')
+    return
+  }
 
-  const out = await res.json()
   stixData.value = out.data
   stixFilename.value = out.filename
   showStixModal.value = true
@@ -645,41 +770,60 @@ async function viewStix(filename) {
  * Pipeline Execution
  * ============================================================ */
 async function runPipelineForSelected() {
-  const count = selectedRaw.size
-  if (!count) {
-    ctiStatus.value = 'Select a file first.'
+  if (pipelineRunning.value) return
+
+  const selected = Array.from(selectedRaw)
+  if (!selected.length) {
+    setCtiStatus('Select a file first.', 'warning')
+    return
+  }
+
+  // cti_run takes bare filenames only, so a directory and a nested child are
+  // both unrunnable. Sending a directory used to extract nothing, move the
+  // reports out of uploads, and still report "Pipeline complete."
+  const isDir = n => rawFiles.value.some(f => f.name === n && f.type === 'dir')
+  const unrunnable = selected.filter(n => isDir(n) || n.includes('/'))
+  if (unrunnable.length) {
+    setCtiStatus(
+      `Cannot run ${unrunnable.join(', ')}: the pipeline takes single ` +
+      'uploaded reports, not folders or their contents. Deselect them and ' +
+      'try again.',
+      'warning',
+    )
     return
   }
 
-  ctiStatus.value = 'Starting pipeline…'
+  const count = selected.length
+  setCtiStatus('Starting pipeline…')
 
-  let res
+  // The handler rejects an empty or malformed file list with a 400, which
+  // this used to report as success.
   try {
-    res = await fetch('/plugin/mcp/cti/run', {
+    await request('Pipeline did not start', '/plugin/mcp/cti/run', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ files: Array.from(selectedRaw), step: 'all' })
+      body: JSON.stringify({ files: selected, step: 'all' })
     })
   } catch (e) {
-    ctiStatus.value = `Could not reach the server: ${e.message}`
-    return
-  }
-
-  // The handler rejects an empty or malformed file list with a 400, which
-  // this used to report as success.
-  if (!res.ok) {
-    let detail = ''
-    try { detail = (await res.json()).error || '' } catch { /* non-JSON body */ }
-    ctiStatus.value = `Pipeline did not start (${res.status})${detail ? ': ' + detail : ''}.`
+    setCtiStatus(e.message, 'danger')
     return
   }
 
   // Accepted, not finished. The run happens in a background executor, so the
   // outcome is polled rather than awaited; without this a failure only ever
   // reached the server log and the row sat on "pending" forever.
-  ctiStatus.value = `Pipeline running on ${count} file${count === 1 ? '' : 's'}…`
+  // Held until the poll settles, so a second click cannot start a run whose
+  // outcome the first poll would swallow: both read one server-wide status.
+  pipelineRunning.value = true
+  setCtiStatus(`Pipeline running on ${count} file${count === 1 ? '' : 's'}…`)
   selectedRaw.clear()
-  pollCtiStatus()
+  // The chain is not awaited, so its failure has to be caught here: an
+  // unexpected throw would otherwise leave the flag set and the button dead
+  // for the rest of the session.
+  pollCtiStatus(0, pollGeneration).catch(e => {
+    pipelineRunning.value = false
+    setCtiStatus(`Lost track of the run: ${e.message}`, 'danger')
+  })
 }
 
 // Bounded so a wedged run stops the poll rather than hitting the endpoint
@@ -687,39 +831,56 @@ async function runPipelineForSelected() {
 const CTI_POLL_INTERVAL_MS = 2000
 const CTI_POLL_LIMIT = 150
 
-async function pollCtiStatus(attempt = 0) {
+// Bumped on unmount so an orphaned chain stops instead of polling for five
+// minutes and writing into a component that is gone.
+let pollGeneration = 0
+
+async function pollCtiStatus(attempt = 0, generation = pollGeneration) {
+  const stale = () => generation !== pollGeneration
+  const settle = () => { if (!stale()) pipelineRunning.value = false }
+
   if (attempt >= CTI_POLL_LIMIT) {
-    ctiStatus.value =
+    settle()
+    setCtiStatus(
       'Still running after 5 minutes. Check the server log; the page will not ' +
-      'update further.'
+      'update further.',
+      'warning',
+    )
     return
   }
 
   await new Promise(r => setTimeout(r, CTI_POLL_INTERVAL_MS))
+  if (stale()) return
 
   let data
   try {
-    const res = await fetch('/plugin/mcp/cti/status')
-    if (!res.ok) throw new Error(`HTTP ${res.status}`)
-    data = await res.json()
+    data = await requestJson('Lost contact with the server', '/plugin/mcp/cti/status')
   } catch (e) {
-    ctiStatus.value = `Lost contact with the server: ${e.message}`
+    if (stale()) return
+    settle()
+    setCtiStatus(e.message, 'danger')
     return
   }
 
+  if (stale()) return
+
   if (data.state === 'running') {
-    loadRawFiles()
-    return pollCtiStatus(attempt + 1)
+    loadRawFiles({ background: true })
+    return pollCtiStatus(attempt + 1, generation)
   }
 
+  settle()
+
   if (data.state === 'failed') {
-    ctiStatus.value = `Pipeline failed: ${data.error || 'no detail reported'}`
+    setCtiStatus(`Pipeline failed: ${data.error || 'no detail reported'}`, 'danger')
   } else {
-    ctiStatus.value = 'Pipeline complete.'
+    setCtiStatus('Pipeline complete.', 'success')
   }
 
-  loadRawFiles()
-  loadStixFiles()
+  // Background: the outcome just set above is what the operator is waiting
+  // for, and a refresh error must not take its place.
+  loadRawFiles({ background: true })
+  loadStixFiles({ background: true })
 }
 
 /* ============================================================
@@ -730,6 +891,11 @@ onMounted(() => {
   loadStixFiles()
   loadBackendConfig()
 })
+
+onUnmounted(() => {
+  clearTimeout(ctiStatusTimer)
+  pollGeneration += 1
+})
 </script>
 
 <style scoped>
diff --git a/tests/conftest.py b/tests/conftest.py
index a7306ba..a2e90b3 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -56,11 +56,14 @@ def _preserve_local_yml():
 @pytest.fixture(autouse=True)
 def _sweep_test_uploads():
     yield
-    for sub in ("raw/uploads", "raw/processed", "clean"):
+    for sub in ("raw/uploads", "raw/processed", "clean", "stix_cti",
+                "outputs_stix", "outputs_ir/complete"):
         d = DATA_DIR / sub
         if not d.is_dir():
             continue
-        for f in d.iterdir():
+        # rglob, not iterdir: stage 2 writes its per-report debug copies to
+        # outputs_stix/debug/, which a top-level sweep left behind.
+        for f in d.rglob("*"):
             if f.is_file() and f.name.startswith(_TEST_UPLOAD_PREFIXES):
                 f.unlink(missing_ok=True)
 
diff --git a/tests/test_cti_view_requests.py b/tests/test_cti_view_requests.py
new file mode 100644
index 0000000..d9aa8f9
--- /dev/null
+++ b/tests/test_cti_view_requests.py
@@ -0,0 +1,97 @@
+"""The CTI view must route every request through its checked helper.
+
+Caldera gates plugin routes per handler, and check_permissions answers an
+expired session by raising HTTPFound('/login'). fetch follows that redirect,
+so the reply reaches the browser as a 200 carrying the login page. Checking
+res.ok is not enough to catch it, and a bare fetch caught nothing at all: the
+tables just rendered empty. These are static guards, because the plugin ships
+no JavaScript test runner.
+"""
+import re
+from pathlib import Path
+
+GUI = Path(__file__).resolve().parents[1] / "gui"
+CTI_VUE = GUI / "views" / "cti.vue"
+MODEL_PANEL = GUI / "components" / "modelSelector.vue"
+REQUEST_JS = GUI / "composables" / "request.js"
+
+SOURCE = CTI_VUE.read_text(encoding="utf-8")
+HELPER = REQUEST_JS.read_text(encoding="utf-8") if REQUEST_JS.exists() else ""
+PANEL = MODEL_PANEL.read_text(encoding="utf-8") if MODEL_PANEL.exists() else ""
+
+
+def _block(pattern):
+    """Return a block of cti.vue, or "" if the tag is no longer recognisable.
+
+    Deliberately not an assert: raising here happens at import, and pytest
+    treats a collection error as fatal to the whole run, so renaming a tag in
+    a .vue file would silence every other suite. The empty string fails the
+    guards below instead, where the message says what went wrong.
+    """
+    match = re.search(pattern, SOURCE, re.S)
+    return match.group(1) if match else ""
+
+
+SCRIPT = _block(r"<script setup>(.*?)\n</script>")
+TEMPLATE = _block(r"<template>(.*?)\n</template>")
+
+
+class TestEveryRequestIsChecked:
+    def test_the_view_still_talks_to_the_server(self):
+        """Guards the two tests below from passing on an empty read."""
+        assert SCRIPT.strip(), "cti.vue has no readable <script setup> block"
+        assert "requestJson(" in SCRIPT
+
+    def test_the_shared_helper_exists(self):
+        """Both CTI-page files import it, so its absence must fail loudly."""
+        assert HELPER.strip(), f"{REQUEST_JS} is missing or empty"
+        assert PANEL.strip(), f"{MODEL_PANEL} is missing or empty"
+
+    def test_no_cti_page_file_calls_fetch_directly(self):
+        """A bare fetch is a call site that forgot the session check. The one
+        real fetch belongs to the shared helper and nowhere else."""
+        for name, src in (("cti.vue", SCRIPT), ("modelSelector.vue", PANEL)):
+            calls = [ln.strip() for ln in src.splitlines() if re.search(r"\bfetch\(", ln)]
+            assert not calls, f"{name} calls fetch outside the helper: {calls}"
+
+        helper_calls = [ln.strip() for ln in HELPER.splitlines() if re.search(r"\bfetch\(", ln)]
+        assert helper_calls == ["res = await fetch(url, options)"], (
+            f"unexpected fetch in the helper: {helper_calls}"
+        )
+
+    def test_both_files_route_through_the_helper(self):
+        """Importing it is what makes the guard above meaningful."""
+        assert "composables/request.js" in SCRIPT, "cti.vue does not import the helper"
+        assert "composables/request.js" in PANEL, "modelSelector.vue does not import the helper"
+
+    def test_the_helper_looks_past_the_status_code(self):
+        """res.ok alone is true for the login page, so the redirect and the
+        explicit refusals both have to be inspected."""
+        assert "res.redirected" in HELPER
+        assert "res.status === 401" in HELPER
+        assert "res.status === 403" in HELPER
+        assert "if (!res.ok)" in HELPER
+
+    def test_the_panel_cannot_report_a_save_that_did_not_happen(self):
+        """An expired session answers 200 with the login page, so the old
+        `if (!res.ok)` let the panel show a green Saved for nothing."""
+        assert "await request(" in PANEL, "the panel does not use the checked helper"
+        assert "if (!res.ok)" not in PANEL, "the panel still trusts res.ok"
+
+
+class TestTheStatusBannerCanBeDismissed:
+    def test_the_banner_is_present(self):
+        """Guards the two tests below from passing on a missing banner."""
+        assert TEMPLATE.strip(), "cti.vue has no readable <template> block"
+        assert 'class="notification mt-4"' in TEMPLATE
+
+    def test_the_banner_has_a_close_control(self):
+        """Matches the delete button stixViewer.vue already uses."""
+        start = TEMPLATE.find('class="notification mt-4"')
+        assert start >= 0, "the status banner is gone"
+        assert 'class="delete"' in TEMPLATE[start:start + 400]
+
+    def test_the_banner_tone_is_not_hardcoded(self):
+        """A failed upload rendered in the same blue box as a success."""
+        assert "notification is-info" not in TEMPLATE
+        assert ":class=\"`is-${ctiStatus.tone}`\"" in TEMPLATE