@agi-fans/dsh-tui 0.20.0 → 0.22.0

package/lib/CHANGELOG.md

@@ -6,7 +6,251 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 ## [Unreleased]
 
-## [0.20.0]
+## [0.22.0] - 2026-10-31
+
+### Added
+
+- `previewFormat` on a prompt option, and `disabled` on a row. The first ends a real ambiguity: the same `preview` field was rendered as markdown by the tree page and as plain text by the composer card, so an option read differently depending on which surface opened it — markdown is now opt-in and plain is the only default. The second is for a row that groups others: focusable, dimmed, and carrying no answer, so Enter on it stays put instead of closing the surface with a value nobody chose.
+
+- Reaching a `/trajectory` detail pane no longer costs the scroll: `↑`/`↓` and the mouse wheel scroll the open pane instead of moving the record selection under the reader.
+
+- `/trajectory` opens with a timing overview: one bar per lane — model, tools, other — showing where the wall clock went, with each lane's share and duration. The numbers were already in the ledger, but a reader asking why a turn took sixteen minutes had to open each record and add them up. It is a fixed-width bar rather than the desktop client's draggable timeline, because the useful reading is a proportion and a proportion needs no interaction; the span is the recorded activity, not the session wall clock, so idle time between turns cannot shrink every lane.
+
+- Four named prompt intents — `ask`, `choose`, `confirm`, and `read` — alongside the existing `prompt` service. `TuiPrompt` had grown to forty-six optional fields, so every new surface added one: a caller wanting free text had to know that omitting `options` means input and that `allowCustom: false` is what makes a list non-editable. The intents are measured from the 196 existing call sites (109 free text, 45 lists, 14 document readers) and compile to the same request, so the escape hatch stays for the surfaces that genuinely combine several. Call sites migrate as they are touched: 28 so far (worktree, attach, session search and labels, reminders, credentials, access selection, code review, plugin management).
+
+- `Alt+Enter` queues the composer draft behind the running turn, and `Alt+Up` recalls the latest queued message for editing. `Enter` keeps meaning "next turn".
+
+- `Ctrl+L` opens model and reasoning selection, `Shift+Tab` cycles the reasoning effort, and `Ctrl+T` shows or hides thinking across the transcript. Thinking is visible by default and collapses to a one-line `Thinking: …` summary that keeps its first line.
+
+- `Ctrl+Shift+F` searches the current transcript. `Ctrl+F` still does when the composer is empty and keeps moving the caret when it is not.
+
+- `Ctrl+G` edits the prompt in the configured editor, alongside the existing `Ctrl+X`.
+
+- A `system` theme derives its surfaces and text color from the colors the terminal reports about itself, so the TUI sits on the terminal's own background and follows a light terminal. It is selectable in Settings; `dark` stays the default. On terminals that support color-scheme notifications, `system` also follows a light/dark switch mid-session.
+
+- On terminals that support the Kitty keyboard protocol, omdsh enables unambiguous key reporting so `Alt` and `Ctrl` shortcuts are recognized reliably, including inside full-screen overlays.
+
+- The composer's activity reports a pending provider retry (`Retrying in 4s`) and how long a compaction has been running.
+
+- `Alt+M` opens the newest image in the conversation — a pasted attachment or a `read_image` result — in the full-screen preview when the composer has no draft image.
+
+- Inline image detection recognizes Herdr, Rex, Ghostty, WezTerm, Warp and iTerm2, `OMDSH_IMAGE_PROTOCOL=kitty|iterm2|none` overrides detection, and `omdsh doctor` reports the detected protocol.
+
+### Changed
+
+- `/trajectory` now reads as three levels — turn, step, record — the shape the desktop client settled on, instead of one flat list. A turn rule states how many steps it folded and how long it took, a step header marks one model request and lists the tools a folded `c` hid, and each record ends with what it cost: `12.4K→812` and `4.3s` for a model request, duration for everything else. The `T1·1` location column is gone, since the headers now say where a row is.
+
+- The ledger header states turns, steps and wall time instead of `12 records · 6 requests · 9 calls`, and counts errors and warnings only when there are some.
+
+- The timing overview appears once a run has more than one step, and hides while searching. Two rows restating the single request below them was the chrome this view exists to replace.
+
+- A record's detail section list is derived from the record: only sections with content are offered, so `Tab` no longer steps through `No tool schema recorded.`. The reader's last section is remembered and restored when returning to that record, and the active one is marked with `›` so it stays identifiable on a terminal without colour.
+
+- Detail sections are drawn for what they hold instead of everything being printed as code. Facts are label/value rows, a model's answer and a user's message are rendered as Markdown — its reasoning under a `Thinking` label, its answer under `Answer` — and payloads and tool results stay code with syntax highlighting. Timing and token usage moved from their own section into the summary, where a reader looks first.
+
+- Code in the detail pane is numbered only once a line is too long for the pane, and the numbers count source lines: a wrapped continuation leaves the column blank instead of claiming to be another line.
+
+- Record durations use the status line's precision, so the overview can no longer read `0s` beside a row that says `0.4s`.
+
+- `c` folds the tool calls inside every step, not only subtool calls.
+
+- The Codex and Claude Code subagent bundles stay disabled until explicitly enabled, and the documentation now says why: the Codex bundle pins its own `@openai/codex` at 0.153.4, independent of the CLI on `PATH` and unchanged by any DSH release, and it has no human approval channel. Enabling an external agent is a deliberate act, not a default.
+
+- The pinned DeepSeek Harness cohort moves from `0.2.1-rc.3` to `0.2.1-rc.5` across all 145 runtime packages, and the `examples/hello` fixture follows it. No API changes reached this codebase: typecheck, the full suite, and all three PTY smokes pass unchanged. The one real adjustment was the fixture itself — the compatibility check refused it while it still declared `rc.3`, which is the check doing its job.
+
+- The `/copy` picker is the same composer card as every other list. It had been the last bespoke overlay with its own key model: nine hotkey rows of its own, and a filter that stayed inactive until `/` — so a typed letter did nothing and `Space` copied instead of typing a space. Typing filters now, `Enter` copies, and the selected row's payload is the preview.
+
+- A finished `/btw` answer folds into the transcript when its pane closes, as one `/btw <question>` line with the answer behind `Ctrl+O`. Closing the pane used to be the only way to reclaim the screen height, and it cost the text; now the reader never has to choose. A consultation left before it answers records nothing, and the block is local presentation — the session log is untouched, so a resumed session does not carry it, exactly like any other command output.
+
+- The Session Tree opens as a block above the composer instead of taking the whole screen. Double-Esc is a rewind gesture, and the conversation being rewound — the thing the reader needs to see while choosing a point in it — used to disappear behind the tree. It is bounded to a little over half the terminal, matching how pi mounts its tree selector. `Ctrl+↑`/`Ctrl+↓` now scroll the preview they always claimed to.
+
+- `/btw <question>` asks at once and answers in its own pane docked above the composer, streaming as it arrives, scrolled with the arrow keys, and closed with Esc — which also stops the consultation instead of leaving it running unseen. The exchange belongs to a conversation that is not this one, so it occupies the pane rather than a row of the conversation being read, and closing it returns the session exactly as it was. A bare `/btw` prints `Usage: /btw <your question>` instead of opening a prompt: a second way to ask the same command would need learning as well. Gone with the pane are the topic library, the progress card, and the five-item menu.
+
+- The finished `/btw` answer appears in the `/copy` picker as `Side answer`, with the question as its label. The pane is not a transcript row, so without this the answer could be read but not taken anywhere.
+
+- `/help`, `/tools` and `/changelog` are transcript results again, and any command result longer than twelve rows folds behind one line with the rest on `Ctrl+O`. They had been moved into a reader to stop sixty rows landing in immutable scrollback; that traded one interruption for another, since the conversation disappeared while you looked something up. Folding keeps both: one line in the conversation, the whole page behind the key.
+
+- Six more reports stopped opening a surface: saved recovery reports, the file-recovery result, integration status, session content search, approval-rule details, and agent composition. They print into the transcript and fold when long, so reading a status no longer covers the menu it was opened from.
+
+- Approvals and plan review stay on the card that asks for the decision: the requested action, its reason, the exact matching rule and the plan itself are the card's detail, so the decision no longer sits behind a full-screen page. Scope confirmation for a remembered rule keeps its preview on the same card.
+
+### Removed
+
+- The `@agi-fans/oh-my-dsh/advisor` export, which pointed at a module the advisor removal had already deleted, and an unreferenced launcher file left beside it. A published export that resolves to nothing is a crash for anyone who imports it.
+
+### Removed
+
+- `TuiPrompt.presentation`'s `fullscreen-list` became `fullscreen-tree`'s sibling `card`. A list stopped taking the screen when the composer card learned to window its rows, filter by typing and preview the selected row, so the value described a behaviour it no longer had — in an API whose whole point is being readable at the call site.
+
+- `TuiPrompt.optionLayout` and the `choose` intent's `fullscreen` and `spacious` options are gone. `optionLayout` was written in eight places and read in none; `fullscreen` and `spacious` only ever existed to set it, so their two branches could not do anything either.
+
+- The Agent Hub is gone, and its one irreplaceable action moved into the subagent roster: `↓` on an empty composer selects a row, `↑`/`↓` moves, and `Enter` opens that child's transcript. The hub existed because it was the only trigger for `#openInspect` — a missing key binding, not a layout requirement — and paid for it with a full screen, its own nine-row key table, `Alt+A`, a `T` tree toggle and a wide/narrow two-pane layout. Everything it was the only view of now has a home: the roster is the list, an external child (which keeps no local transcript) prints its status and recent activity as a fold-able result, and recorded workflow runs appear as a line at the top of the roster.
+
+- The advisor is gone: `consult_advisor`, `/advisor`, its Integrations setting, and the 810 lines that composed them. It reached the same ACP transport as a Codex or Claude Code subagent, but handed the second model only a question the primary agent wrote plus a context slice it chose — so the advisor answered from a summary of the problem rather than the problem. Claude Code's advisor reads the full conversation because it runs server-side; a local version would have to serialize that itself, at the cost of choosing what to drop. What it did uniquely — ask for an opinion without giving away the ability to act — stays reachable by delegating a read-only subagent instead.
+
+- `/steer` and `/todo` are gone. Steering is `Alt+S` on the draft, which is the same handler without typing a six-character prefix; the todo list is already drawn live above the composer, and printing a copy into immutable scrollback produced a list that was stale the moment it appeared.
+
+- `/copy text|code|cmd|output` lost its kinds. `text` meant "the default", so it was a no-op parameter, and the other three named a row the picker already shows with its content, language and size: the reader had to recall a word to skip a keystroke. `/copy` opens the picker; `Alt+C` still copies a selection when there is one.
+
+- `/tree` is gone: double `Esc` already opened the same Session Tree controller, so the command was a second name for a gesture the shortcut list already documents. Reach it with `Esc` twice on an empty composer.
+
+- `/review`. It resolved a Git target and injected a fixed prompt — the resolution was its only real work, and the prompt itself is something every reader who reviews code already has their own version of, either as a Skill or as habit. A fixed template cannot be better than the reader's own, and by the scope principle in `docs/design/philosophy.md` a capability whose need is not demonstrated is maintenance cost. `/diff` remains: it shows the changes, which is the part a terminal uniquely owns.
+
+- `/rate` and the `dsh-message-feedback` service behind it. The feedback it recorded was log-only: nothing read it, exported it, or sent it anywhere, so a reader who filed a judgment took a four-step flow to write a record with no consumer. This is the scope principle in `docs/design/philosophy.md` applied — a capability with no path to being used is maintenance cost, not a feature.
+
+- `Notifications → Terminal activity`, the opt-in OSC 9 busy/idle indicator. It reported the same lifecycle as Terminal status through a weaker protocol that carried no state, and it cost a keepalive write on every second of a running turn. A terminal tab that answers OSC 7501 already shows what omdsh is doing.
+
+- `/attachments`. `/attach` without a path now opens the same list with an **Add a file** entry at the top, so reviewing what this session attached and attaching something new are one surface rather than two commands to keep apart. A `/attach <path>` invocation and a bare `/attach` in a pipe both behave as before.
+
+### Fixed
+
+- `verbose` gives the session's totals a third footer line — Time on the left, Activity on the right — so the line above it no longer has to shed them on a narrow terminal. The line appears only once the line above is whole: priority is still global, so nothing below a dropped latency appears above it.
+
+- Turning Telemetry off now reclaims its rows instead of leaving them blank; a session without projected stats yet keeps the reserved line, so the composer does not step up when the first numbers arrive.
+
+- The status footer puts occupancy back on the left and cost on the right. `Ctx` and `Cache` hold the left edge; Tokens, Latency, Time and Activity answer from the right, so the same number sits in the same place from session to session instead of the whole row running from the left margin.
+
+- The densities are cumulative again. `minimal` is occupancy (Context and Cache), `standard` adds latency (`TTFT · tok/s`), and `verbose` adds Tokens, Time and Activity with long labels and the detailed context form. On a narrow terminal the visible set is now a prefix of that order: Activity goes before Time, and Time before Latency, rather than a wider group being skipped so a narrower one behind it could fit.
+
+- `Space` on a footer part no longer changes a different part's behaviour. Toggling one took the rendered footer and stored everything it did not show as an explicit hiding, so afterwards `verbose` showed exactly what `standard` had — one switch silently freezing another. Hiding is now a delta from the density, and adding a part the density omits is its own delta, so `Space` on a part the density leaves out finally does something.
+
+- A footer switch no longer flips back on its own. The preferences handed to the settings rows carried the density alone, so any session refresh that reseeded the overlay — which happens on every projection update — redrew the parts the reader had just hidden as `shown`. The document now travels whole, deltas included.
+
+- The `Path` row in Settings is labelled `Path` again instead of printing its own description at full width across the row.
+
+- Diff line numbers no longer step sideways down a hunk. The gutter carried the old and the new number in two sub-columns, so a removal printed its number in the left one and the addition under it in the right one; with one digit each that read as a rendering fault. Each row now states one number on one column — the side it belongs to.
+
+- A step's duration stays on its own line. The padding was counted in string length, so a CJK step label — one character, two cells — pushed the duration onto the next row.
+
+- The Session Tree page draws each option's description and its badge in the option's own tone. Both were dropped when tree rows moved onto this renderer, so a full-screen tree lost an agent's phase colour and its elapsed time — the two things that tell two similar-looking nodes apart.
+
+- A filterable card now draws the query it is filtering on, with what it kept (`⌕ build · 1/1`); a query that matches nothing says so and stops advertising `Enter`; a truncated preview ends with `… N more lines`; and `Esc` clears an active filter before it closes the list, which only the session tree used to do. All four were lost when lists stopped being full-screen pages — the page printed the query, the empty state and the paged preview, and the card did not.
+
+- A run the reader stops stays open instead of folding under them. Interrupting is an action taken while watching that work, so collapsing it at that moment took the rows out from under the reader — and, because a fold shortens the document, left the live viewport starting inside rows already committed to native history. Those rows cannot be repainted, so the screen began with a band of empty rows and, when the boundary landed inside the startup header, a `Tips:` line with no logo above it. The run now keeps its rows until the next submission, which is the point at which the reader has moved on; a turn that ended on its own conclusion still folds immediately, because its summary describes something that finished.
+
+- A short conversation sits next to the composer instead of the top of the screen, and the header stays where it is. The slack now lives between the header and the conversation: a fold shortens the conversation into that slack, so neither the header nor the newest rows move. The first attempt put the slack above the whole frame, which kept the newest rows still but dragged the header to the bottom the moment a message arrived. The transcript used to hug the top and leave its spare rows between the last line and the composer, so folding a run — which shortens the transcript — opened a wide gap in the middle of the screen and shifted nothing the reader was actually looking at. The spare rows are now above the document, which keeps the newest rows where they were when something above them folds. A session with no conversation yet still opens with the header at the top, because with nothing to anchor to the composer the header is the first thing to read.
+
+- A successful tool card on the `system` theme no longer turns pale green. Its fill was a fixed-weight mix of the terminal's own green into the background, so the card's lightness was the terminal's choice: a terminal reporting a bright green produced a fill at 11.7% relative luminance instead of the shipped 4.4%, and dimmed text on it fell to 3.33:1. The three state fills are now held at a target luminance and take only their hue from the terminal, capped so a card stays a surface rather than a swatch. On the same terminal the successful fill lands at 4.48% with every card ink at or above 4.6:1.
+
+- The pending card on the `system` theme was the lightest of the three, inverting the state order. It is now the quietest fill, and it keeps the background's own tint instead of flattening to the foreground's grey.
+
+- A `system` theme on a light terminal no longer washes out its secondary text. `dim` and `muted` were mixed from the foreground toward the background at a fixed weight, which brightens the ink on a dark host but fades it toward the page on paper: `dim` on a light terminal's cards measured 1.75:1, and on a white one 1.64:1. `dim` is now solved against the card fills it is actually drawn on, reproducing the hierarchy the shipped palettes reached (3.64:1 on light where they reach 3.59:1, 3.30:1 on dark where they reach 3.30:1). `muted` simply inherits the palette's swatch, which both shipped themes already set equal to `toolOutput`.
+
+- A `system` theme keeps its card fills light on a light terminal, and the alternating successful surface is a slight step above the primary one instead of jumping to a brightness no card should reach.
+
+- A running turn keeps the access level on the composer's right corner. The activity row was assembled from `fillWidth + 4`, a constant left over from the four-cell corner pair this composer no longer draws, so every running frame was one cell too wide; the renderer truncated the overflow, which is the right-hand rule, and the badge printed as `workspace write…`. The frame is now measured from the pieces it actually prints.
+
+- A `!` command's card shows only what that line produced and carries a state fill. It used to render the whole persistent-shell scrollback, so the command's own echo appeared a second time under the `$ command` header, output from earlier `!` lines was replayed, and the trailing prompt the shell paints after every line stayed in the card. The card now projects from a line-count baseline taken before the command is sent, drops the trailing prompt, and uses the composer's Shell ink with the pending/success/failure fills a tool card uses.
+
+- The `@` mention menu no longer flashes while typing or deleting. Every keystroke cleared it because its search is debounced, so the list vanished for the whole debounce-plus-search interval and reappeared afterwards. The rows already on screen describe the token being extended, so they now stay until a real result replaces them.
+
+- A wrapped line keeps its style on every row. `wrapText` attached escape sequences to the following glyph but never reopened them after a line break, so a long bold command showed its ink on the first row and plain text on the rest. Every painted wrap now uses the restabilizing variant, which tracks the active foreground, weight, slant, underline, inverse, and hyperlink across the break.
+
+- A tool card now shows its state on every terminal, not only on a truecolor one. Pending, successful, and failed cards had three near-black fills that 256-color and 16-color terminals quantized onto the same entry, so a failed call looked exactly like a successful one. The three fills are resolved as a group now, and the failing card keeps a fill of its own.
+
+- A tool card's output is syntax highlighted, and its command line is not. The command stays one bold ink so the reader recognizes their own intent at a glance; the colour belongs to the output they actually have to read. Output used to be coloured one line at a time, so a multi-line payload kept only its first row highlighted, and tokens the highlighter had no colour for fell back to the terminal's default ink, which made a highlighted block read as mostly plain text. Both are fixed: the payload is highlighted as one block, and every token is painted.
+
+- A Markdown heading's level is visible again: `#` and `##` carry weight and an underline, deeper levels keep their marker. Block quotes and horizontal rules use their own `mdQuoteBorder` and `mdHr` inks instead of borrowing the component border colour, and quoted prose is set in italic.
+
+- Image preview and the Harness attachment store load the same `sharp`, so a duplicate libvips warning no longer appears in the middle of the screen.
+
+- Terminal replies that arrive together no longer leak fragments such as `[?62;22c` into the composer, and an unrecognized control sequence is discarded whole.
+
+- A background job's settlement line is separated from the command output by a blank row.
+
+- Every terminal mode omdsh enables — bracketed paste, focus and mouse reporting, and the keyboard protocol — is given back while `Ctrl+Z` or an external editor owns the terminal, and when the process exits without shutting down cleanly, so the shell and the editor receive their usual input.
+
+- Closing the terminal window shuts omdsh down cleanly — the session is saved and terminal handlers run — instead of the process being killed by SIGHUP.
+
+## [0.21.0] - 2026-10-19
+
+### Added
+
+- Standard, PTC, and Cordis presets mount the upstream `dsh-time-context` clock (Minimal does not), so date-sensitive requests no longer depend on the model guessing the current time; transcript exports skip clock and plugin snapshots.
+- The DeepSeek account route (`deepseek-account`) is mounted beside the API-key route. `/login` can start the DeepSeek browser sign-in through a loopback-only callback host, reuse a grant established by DSH Web/Desktop, report account state, and sign out; `/model` lists the account route.
+
+- Optional File recovery snapshots in Settings → Tools retain durable Turn file contents. Session Tree’s Alt+R selects and previews files, confirms confined restoration, preserves later edits, and reports partial results and backups without rewinding messages or the Git index.
+
+- Approval prompts can remember an exact invocation decision for a session or workspace; `/permission` previews and revokes rules while Harness retains approval audit, cancellation and independent protections.
+
+- `/btw` opens tool-free side consultations from a fixed conversation snapshot. Saved topics support follow-ups and separate request usage; responses stay outside the primary model context until explicitly handed back with **Share to conversation** or **Quote to composer**, and cancelling the reader leaves the main Turn running.
+
+- `omdsh exec --json` runs prompts through an independent script consumer, with versioned NDJSON events, a final result, durable resume, Harness telemetry, explicit exit codes and managed-child draining. Human questions and approvals fail closed, while diagnostics stay on stderr.
+
+- Composer `!command` opens a session-owned persistent Shell with live output, an interrupt hint and explicit separation from model context, while `!!command` (or pressing `S` / **Share to conversation** in `/terminal`) posts the shell output to the main transcript and session context. Marked pasted commands remain message text, Esc detaches, and Ctrl+C interrupts without cancelling an unrelated model Turn.
+
+- Tool cards and Changed files open current file previews and the configured Editor through right-click; `Alt+V` also previews a tool’s declared files. Paths retain their invocation or summary directory, text selections keep right-click copying, and approvals take priority over previews.
+- `omdsh doctor` provides read-only local diagnostics with text or versioned JSON output, explicit failed/unconfigured/unchecked states, secret-free reports and actionable fixes.
+- Settings configures terminal titles and program status, sharing the root lifecycle with Herdr and keeping pending-input, completion and failure states visible without exporting prompt bodies.
+- `/review` selects current changes, a base branch or one commit (either interactively or directly via `/review changes`, `/review base <branch>` or `/review [commit] <rev>`) and steers a review request to the current Agent, retaining its model, Access and Plan state.
+- `/advisor` and `consult_advisor` request independently attributed Codex or Claude Code opinions with read-only workspace inspection, rendering a live `Advisor · Codex` or `Advisor · Claude Code` subagent card with streaming inspection progress in the transcript, tracking the external run and its live activity in the subagent bar and Agent Hub (`Alt+A`), offering one-step interactive bundle enablement when a shipped provider is disabled, and recording completed advice into the session context for follow-up turns. Consultations reuse managed child lifecycles, isolate native processes from workspace writes via outer OS confinement, support `Ctrl+C` cancellation, and can be disabled for model calls in Settings.
+- The `working_directory` tool changes the session’s current directory. File browsing, diffs, attachments, completion, new terminals and the footer follow it while the original project and Access remain unchanged.
+- `/plugins` offers Install and Reinstall for official on-demand bundles at the running Harness version, retaining installation consent, cancellation and build-script approval.
+- `/worktree` creates, enters and switches retained Git checkouts, or returns to the session’s original directory. Creation uses the optional Git Worktrees bundle, off by default, and preserves the current Access policy and source changes.
+- Native Codex and Claude Code bundles offer model and permission settings plus profile diagnostics in Settings, with the same form accessible from `/plugins`. Guidance explains their bundled runtimes, native authentication and independent permission policies.
+- `/import <archive.zip>` imports a portable `/export archive` bundle into local storage, remapping attachment references, rejecting session ID collisions or oversized archives, and resuming the imported root session.
+- `Ctrl+S` (`stash-draft`) stashes or swaps the current composer draft and automatically restores it after sending an intervening message; `Ctrl+-` restores a draft cleared with `Ctrl+C`, and `Alt+Up` recalls the latest queued message into the composer even when an unsent draft is present.
+- Source and diff readers add a `Quote` (`Q`) action that inserts `@path:line` at the current reading line into the composer, `/terminal` adds `Share to conversation` (`S`), `Quote to composer` (`Q`) and `Copy output` (`Y`), `/mcp` renders formatted Markdown tables directly in the main transcript, and Plan Review supports `Ctrl+X` to edit multiline revision feedback in the configured external editor.
+- Interactive Keybindings in `/settings` (**Interface → Input → Keybindings**) remaps or unbinds shortcuts and reloads `keybindings.json` without restarting.
+- `@` autocomplete offers `@diff`, `@staged` and `@git` workspace context shortcuts to insert all modified or staged Git file mentions at once, `/copy` supports live type-to-filter search and `/copy output` (`out`) for tool outputs, and `/files` supports workspace-wide fuzzy search via `Shift+F` or `/files <query>`.
+- `/rate` records per-reply feedback for a finalized Assistant message: positive or negative, a fixed category and an optional note, or clears an existing rating. Ratings are versioned log-only Session records that never enter model context; version conflicts retry once against the current value.
+- `/schedule` lists this session's durable reminders, opens retained delivery records, renames or re-instructs one, and deletes it after confirmation; creating and retiming reminders stays with the model's `schedule_*` tools. Due reminders deliver as follow-up messages after restart, resuming a cold session in the background without switching the visible one.
+- The composer shows an empty-state hint (`Ask anything · / commands · @ files`), while an unconnected session points at `/login` in both the composer and the welcome card instead of leaving only a cursor.
+
+### Changed
+
+- `/login` now stores a DeepSeek API key under the upstream `DEEPSEEK_API_KEY` reference instead of `OMDSH_DEEPSEEK_API_KEY`; an existing product-era key is migrated once, and an environment-owned reference is never overwritten. Web search and fetch share the same reference and prefer the account token on a `deepseek-account` session.
+
+- Web search and page fetch use DeepSeek's Search and Fetch APIs by default and share the upstream `DEEPSEEK_API_KEY` reference, or the account token on a `deepseek-account` session; the Messages search and local HTTP fetch providers remain selectable fallbacks. This removes the separate search key requirement and the fake-IP DNS rejection in page fetch.
+
+- `/resume` now opens the Session Library, searches durable session content with a query, or resumes an id directly; the duplicate `/sessions` entry point is removed.
+
+- Multi-question prompts support `Alt+Left` to step back to the previous question and rescue any unsent custom answer draft into the composer if cancelled or timed out. Approval prompts guard against accidental confirmation for 500ms after opening and add **Reject with note** to deny an action and steer the next model step in one flow.
+- Per-turn `Changed files` summaries are persisted as ignorable session records so resumed sessions retain changed-file cards, file previews and `/diff turn` navigation; terminal transcripts also emit `OSC 133;A` semantic prompt markers on user turns.
+- Command discovery prioritizes common tasks, searches description keywords and groups help by task. Session Library content search retains pin, rename and archive actions.
+- Allowed subagent models use a searchable, preselected multi-select list instead of JSON. Native integration Model and Permissions open directly, and Installation status explicitly reports registration only. Worktree creation can be enabled from its own picker.
+- Approval readers preserve multi-line tool input and reasons without compressing them into one row. MCP diagnostics distinguish plugin registration from available tools and do not infer connection health.
+- Settings adds cross-category search, visible narrow-screen category navigation, current-value preselection and prefilled input with readable duration and byte units. Agent links reuse model, Access and preset selectors and return to `/settings` with refreshed values; integration summaries show registration state and help explains dependencies and effect scope.
+- Settings saves only edited preference fields and offers confirmed restoration of inherited values, including individual status colors or the complete footer layout. Searching and editing retain the selected result.
+- Settings groups built-in capabilities under Interface, Agent, Tools, Status line and Integrations, with native-provider enablement and configuration. Advanced retains unclaimed fields and installed plugins, honors automatic-form policy, and omits duplicate and deprecated controls. Common switches and Hook compatibility show their current values and change directly; returning from forms preserves the selected row as available settings change. Bash and PowerShell share the Shell form, and Web search keeps connection and credential fields in Advanced.
+- Bundle management offers a confirmed Uninstall for profile-owned packages and explains why shipped integrations use Disable instead.
+- Codex and Claude Code bundles ship with omdsh, disabled until enabled in Integration settings; package availability and profile enablement are shown separately.
+
+- Upgrade the published DeepSeek Harness packages to `0.2.1-alpha.2` and adapt delegation to runtime-managed activations. External executions show lifecycle state and deliver results to the parent without a local transcript. Pipe-mode exit waits for progressing children; session teardown drains descendants first.
+- The default dark and light palettes now follow the DeepSeek brand blue and cyan from the public site instead of the inherited amber theme, and the welcome logo uses the same brand ramp.
+- Settings → Advanced is empty in a default profile and stays hidden until a plugin exposes unclaimed fields: the shell executor's `cwd` is no longer offered, and Web provider selection plus Web search credentials moved into Integrations → Web search.
+- Upgrade the published DeepSeek Harness packages to `0.2.1-rc.2` with the matching stable Cordis cohort. Plugin compatibility follows a declared `engines.dsh` range before DSH peers, `/plugins` reports why a change needs a restart, and the JSONL persistence backend mounts as a plugin; stored sessions keep the v4 format.
+- Session Library browsing shows migration-required logs without opening or upgrading them. Interactive resume asks before migration; explicit line-input and CLI resume remain supported. Startup no longer migrates the entire stored corpus.
+
+### Removed
+
+- `/feedback`; session-level notes were write-only in the TUI, with no list, export, or delivery path. Reply feedback remains under `/rate`.
+
+- `/workflow`; use `/plan` to enter planning and `/plan off` to leave.
+- `/reasoning` and experimental reasoning translation; reasoning remains available in Turn history.
+
+### Fixed
+
+- Plugin console diagnostics no longer write into the TUI composer; the interactive terminal routes them to `$OMDSH_HOME/omdsh/logs/omdsh.log`.
+
+- The startup welcome card no longer keeps a stale "Not connected · /login" line after signing in; first-run readiness now lives only in the live composer placeholder, which is re-read after startup and updates on credential and account changes.
+
+- The shared DeepSeek account now appears in `/logout` and can be signed out there, instead of only from the `/login` account prompt.
+
+- Herdr agent state reporting ignores user-initiated UI pickers, settings forms, file/diff/terminal readers and idle session rehydrations so opening or closing dialogs no longer triggers false `blocked` or `done` notifications, and advertises `resume_argv` (`omdsh --resume <id>`) for session recovery.
+- File previews recognize invalid UTF-8 as binary and retain source syntax when viewing cached snapshot content.
+
+- Source-reader shortcut hints omit empty separators when a document has no custom actions.
+
+- Terminal input and close dialogs yield to background approvals, and input failures remain visible in the TUI.
+- File shortcuts find visible tools in short expanded turns even when welcome chrome and startup notices remain above the call, instead of falling back to an unrelated workspace diff.
+- Partial TUI preference patches no longer crash the welcome card when the initial model label is omitted. The first session frame uses its effective model and reasoning effort.
+- Redirected output no longer activates raw terminal rendering or emits title and program-state control sequences.
+- Settings show save and integration errors before returning to their forms, restore unsaved preferences, and keep feature switches unchanged on write failure. Unreadable Profile patches are no longer replaced as empty files.
+- Codex and Claude Code status checks stay open in a scrollable reading page until dismissed, then return to their settings or bundle picker.
+- Plugin installation ignores Enter while waiting, preventing accidental cancellation. Failed and cancelled attempts no longer claim enablement, and progress updates stay in one card.
+
+## [0.20.0] - 2026-10-09
 
 ### Added
 
@@ -68,7 +312,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 - Markdown code retains literal HTML tags, entities and emphasis characters. Incomplete formulas remain readable while streaming, and compound exponents no longer convert only their first digit.
 
-- Herdr status follows the root Agent during session updates and subagent inspection, retries failed reports, and waits briefly for release on exit. Background runs and smoke-test terminals no longer claim their caller's Herdr pane.
+- Herdr status follows the root Agent during session updates and subagent inspection, includes `resume_argv` for session restore, retries failed reports, and waits briefly for release on exit. User-initiated settings and command pickers no longer trigger false `blocked` / `done` status transitions or notification sounds, and background runs and smoke-test terminals no longer claim their caller's Herdr pane.
 
 - Pasting a search term into a source reader updates matching lines immediately.
 
@@ -541,7 +785,9 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 - Preserved terminal-cell alignment and right padding for long commands, CJK text, emoji, ANSI styling, and narrow viewports.
 - Stabilized incremental rendering, transcript scrolling, cursor placement, tool-output folding, and queued input during active turns.
 
-[Unreleased]: https://github.com/agi-fans/oh-my-dsh/compare/v0.20.0...HEAD
+[Unreleased]: https://github.com/agi-fans/oh-my-dsh/compare/v0.22.0...HEAD
+[0.22.0]: https://github.com/agi-fans/oh-my-dsh/compare/v0.21.0...v0.22.0
+[0.21.0]: https://github.com/agi-fans/oh-my-dsh/compare/v0.20.0...v0.21.0
 [0.20.0]: https://github.com/agi-fans/oh-my-dsh/compare/v0.19.0...v0.20.0
 [0.19.0]: https://github.com/agi-fans/oh-my-dsh/compare/v0.18.0...v0.19.0
 [0.18.0]: https://github.com/agi-fans/oh-my-dsh/compare/v0.17.0...v0.18.0

package/lib/chrome/box.d.ts

@@ -4,8 +4,7 @@
  * @module @agi-fans/dsh-tui
  */
 import { type Theme, type ThemeColor } from './theme.ts';
-import type { MotionMode } from '../session/tui-settings.ts';
-import { type WelcomeTip } from './welcome-tips.ts';
+import { type WelcomeHint } from './welcome-tips.ts';
 /** Visual state that drives border + fill color. */
 export type BoxState = 'idle' | 'info' | 'running' | 'ok' | 'error' | 'warning';
 /** Options for a rounded output block (tool / notice). */
@@ -28,25 +27,32 @@ export interface FramedBlockOptions {
  * OMP `renderOutputBlock`: `╭─── header ────╮` / padded body / `╰────╯`.
  */
 export declare function renderFramedBlock(options: FramedBlockOptions, theme: Theme): string[];
-/** Welcome card inputs. */
+/** Header inputs. */
 export interface WelcomeOptions {
     width: number;
-    model: string;
-    /** Effective reasoning effort for the selected model, painted under the model name. */
+    /** Kept for callers that already resolve it; the compact header does not print it. */
+    model?: string;
+    /** Kept for callers that already resolve it; the compact header does not print it. */
     reasoningEffort?: string;
     version: string;
     appName: string;
-    recentSessions?: readonly {
-        id: string;
-        title: string;
-        createdAt: number;
-        updatedAt?: number;
-    }[];
-    /** Per-process hint sample; defaults to a deterministic catalog prefix for pure callers. */
-    tips?: readonly WelcomeTip[];
+    /** Startup hints; defaults to every entry in the shipped catalog. */
+    hints?: readonly WelcomeHint[];
 }
 /**
- * Two-column welcome card: gradient DeepSeek logo + tips, titled `app vversion`.
+ * Startup header: the DeepSeek mark beside the name, its version, and the
+ * slogan, then one sampled hint.
+ *
+ * It is a lockup rather than a card. The previous header was a thirteen-row
+ * bordered panel with a tips table, a recent-session list, and a second copy of
+ * the model and effort the status footer already shows — most of a screen spent
+ * before the reader has typed anything, and its rows were committed to native
+ * scrollback where they stay. Nothing here repeats what the composer and footer
+ * already say.
+ *
+ * The mark is the brand, so it stays at its source aspect ratio; below the width
+ * that holds the lockup, the wordmark folds underneath rather than the mark
+ * shrinking or the slogan being dropped.
  */
 export declare function renderWelcome(options: WelcomeOptions, theme: Theme): string[];
 /** Editor chrome inputs. */
@@ -58,11 +64,38 @@ export interface EditorOptions {
     /** Optional right-aligned cap on the top border (permission mode). */
     statusRight?: string;
     border: ThemeColor;
+    /**
+     * Activity drawn in the top border instead of as a row above the editor.
+     *
+     * The composer is where the reader is looking while they wait, so a spinner
+     * that sits on its own row above the box costs a line and reads as a separate
+     * component. `label` is empty only when the caller wants the spinner alone,
+     * which is what a narrow terminal degrades to.
+     */
+    activity?: EditorActivity;
+    /** Animation frame, forwarded to the activity's shimmer when it has one. */
+    spinnerFrame?: number;
+    /**
+     * One line of confirmation drawn in the bottom border.
+     *
+     * Replaced rather than appended: what a key just did is a reading of the last
+     * action, not a record of the conversation, so it belongs to the frame that
+     * is already on screen.
+     */
+    note?: string;
     /** Dim ghost text painted after the caret (slash-arg hint). */
     inlineHint?: string;
     /** Paint one wrapped input slice without changing its visible width. */
     paintInput?: (text: string, sourceStart: number) => string;
 }
+/** One in-flight activity shown in the composer's top border. */
+export interface EditorActivity {
+    /** Spinner frame, already resolved by the caller; `-1` stops the animation. */
+    readonly frame: string;
+    readonly label: string;
+    /** Whether the label is painted with the driving shimmer. */
+    readonly shimmer?: boolean;
+}
 /** Editor frame plus a cursor offset relative to the editor's first row. */
 export interface EditorFrame {
     lines: string[];
@@ -78,5 +111,3 @@ export interface EditorFrame {
 export declare function renderEditor(options: EditorOptions, theme: Theme): EditorFrame;
 /** DeepSeek Harness-aligned label shown while the model is driving a turn. */
 export declare const DEEP_DRIVING_LABEL = "Deep Driving";
-/** Activity row that sits above the editor while a turn is in flight. */
-export declare function renderWorking(theme: Theme, spinnerFrame: number, action?: string, width?: number, motion?: MotionMode): string[];