@chanlerdev/scorel 0.0.3 → 0.0.4

package/docs/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## Unreleased
 
+## 0.0.4 - 2026-06-14
+
+### Highlights
+
+- Config is now device-scoped only; project-level config is no longer read or written.
+- GUI settings are device-scoped with relay device rename and project scope selector.
+- Local daemon is a singleton background process with idle shutdown and shared state root.
+- RTK token saving settings available in GUI for Bash execution.
+
+### Changes
+
+- GUI connection settings default to official Relay URL; editing requires explicit click.
+- Pairing button label changed to 'Get Pair Code'.
+- Paired Relay devices can be renamed locally; name persists across refresh.
+- Provider delete button moved to a danger zone at bottom of settings panel.
+- Token-saving statistics labels changed to Chinese (Bash 输出 Token / 已节省 Token).
+- RTK token saving can be enabled/disabled in GUI settings, persisted in project config.
+- Cumulative RTK savings stats are maintained across sessions and projects.
+- RTK is detected from default shell; can be installed via Homebrew if missing.
+
+### Fixes
+
+- Glob results are now sorted by workspace-relative path for deterministic ordering across platforms.
+
+### Breaking Changes
+
+- Runtime no longer reads project `.scorel/config.toml`; existing project configs are ignored.
+- GUI local projects and sessions are now stored under `~/.scorel/` instead of `~/.scorel/gui/`; old state is not migrated automatically.
+
+### Verification
+
+- Core config tests prove project config is ignored and device config is used.
+- Daemon embedded tests prove settings writes with projectId write device config only.
+- GUI rendering tests confirm device-scoped selector, provider delete placement, and Chinese token labels.
+- New local-host test verifies device config writes to ~/.scorel/config.toml.
+- E2E CDP script validates shared state paths and daemon lifecycle.
+- Unit tests cover RTK detection, Bash execution with RTK, and runtime stats recording.
+
+### Internal
+
+- `scorel host start` launches a singleton background daemon; `scorel host serve` gains `--idle-timeout-ms` flag.
+- `scorel up` ensures daemon is running but no longer owns its lifecycle.
+- GUI attaches to singleton daemon instead of running embedded Host.
+- gui-store.json lives at `~/.scorel/gui-store.json`.
+
+- Add `scorel host start` for background singleton Host startup; `scorel up` now leaves the singleton Host running when WebUI exits.
+- GUI local Host state now uses the shared `~/.scorel` root for Projects and Sessions, with `gui-store.json` stored at `~/.scorel/gui-store.json`.
+- GUI starts and attaches to the singleton local daemon instead of starting a second local Host writer.
+- Local daemon now idle-shuts down when there are no clients, no active work, and no active IM extensions; active IM keeps it alive until explicit stop.
+- GUI connection settings now default to the official Relay, hide Relay URL editing behind an edit action, show `Get Pair Code`, support paired-device rename/details, and use a device-scoped settings selector.
+- GUI Provider settings now place `删除提供商` in the Provider configuration block, token-saving stats use clear Chinese labels, and Relay device rows expose expand/edit affordances.
+- Config loading now uses the device config only; Project `.scorel/config.toml` is no longer a runtime or Settings config source.
+
 ## 0.0.3 - 2026-06-12
 
 ### Highlights

package/docs/ROADMAP.md

@@ -303,7 +303,7 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 - `scorel daemon serve` 全部 flag 有合理默认;token 在 `~/.scorel/daemon.json` 持久化,跨重启复用。
 - `~/.scorel/daemon.json` 不再每次启动删除;通过 pid liveness + `stoppedAt` 判存活。
 - WebUI Settings 页面通过 `/api/local-daemon` server route 自动发现本地 daemon,一键添加 device。
-- `scorel up` 同时拉起 daemon serve + webui,Ctrl+C 一并退出。
+- `scorel up` 确保 singleton daemon 可用并启动 WebUI；退出 `scorel up` 不关闭后台 daemon；无 client/无 active work/无 active IM 后 idle 自动退出。
 - 全部改动通过自动测试,真实 LLM 手工烟雾通过。
 
 **Steps**:
@@ -315,7 +315,7 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 **Not in M5.6**:
 
 - WebUI 多 daemon 切换 UI;每用户单 daemon 假设。
-- 自动 supervisor / restart;仍需手工 `scorel daemon stop && serve`。
+- restart-on-crash supervisor;仍需手工 `scorel host stop && start`。
 - Windows 专属 PID 语义。
 - TLS / OAuth / 公网隧道。
 
@@ -592,6 +592,12 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 | M9.F1.16 | [`S0087`](spec/ship/S0087-gui-ui-polish-sweep.md) | Codex-inspired GUI visual pass：学习 Codex 的比例、层级和克制风格，并把 GUI tool blocks 收敛为低噪声执行证据流 | Done |
 | M9.F1.17 | [`S0088`](spec/ship/S0088-gui-streaming-thinking-contract.md) | Streaming thinking contract：补 thinking/content delta，使 thinking 在 turn 运行中按序显示，而不是最终 assistant_message 后才插入 | Done |
 | M9.F1.18 | [`S0089`](spec/ship/S0089-memory-reliability-and-dream-trigger.md) | Memory reliability：修复 AppendDaily 调用质量、dreaming 触发与可观测性，让 M9 后半段聚焦真实使用中的质量优化 | Done |
+| M9.F1.19 | [`S0097`](spec/ship/S0097-rtk-token-saving-settings.md) | GUI Token 节省设置 + RTK Bash output proxy + runtime config | Done |
+| M9.F1.20 | [`S0098`](spec/ship/S0098-local-daemon-singleton-unified-state.md) | 统一本机 Host state root、后台 singleton start、GUI/CLI auto-start + attach、idle shutdown、active IM 保活 | Done |
+| M9.F1.21 | [`S0099`](spec/ship/S0099-gui-connection-device-settings.md) | GUI 连接设置默认官方 Relay、配对设备命名/详情、Settings scope 初版 | Done |
+| M9.F1.22 | [`S0100`](spec/ship/S0100-gui-provider-danger-zone.md) | GUI Provider 删除按钮位置初版 | Done |
+| M9.F1.23 | [`S0101`](spec/ship/S0101-gui-device-settings-polish.md) | GUI Settings 改为设备级配置，修正 Provider 删除位置、Token 文案、设备展开/重命名交互 | Done |
+| M9.F1.24 | [`S0102`](spec/ship/S0102-device-only-config.md) | Config 彻底收敛为设备级唯一配置，移除 Project config 运行时语义 | Done |
 
 **Not in M9 Follow-up**:
 
@@ -761,6 +767,13 @@ HTTP adapter 必须映射已有 Host use cases，不复制领域逻辑。
 | [`S0093`](spec/ship/S0093-gui-im-settings-platform-layout.md) | GUI IM Settings platform layout | Done |
 | [`S0094`](spec/ship/S0094-im-inbound-runtime.md) | IM inbound runtime receive paths | Done |
 | [`S0095`](spec/ship/S0095-gui-im-session-list-refresh.md) | GUI IM session list refresh | Done |
+| [`S0096`](spec/ship/S0096-glob-stable-order.md) | Glob stable cross-platform ordering | Done |
+| [`S0097`](spec/ship/S0097-rtk-token-saving-settings.md) | RTK token saving settings and Bash output proxy | Done |
+| [`S0098`](spec/ship/S0098-local-daemon-singleton-unified-state.md) | Local daemon singleton and unified state | Done |
+| [`S0099`](spec/ship/S0099-gui-connection-device-settings.md) | GUI connection device settings | Done |
+| [`S0100`](spec/ship/S0100-gui-provider-danger-zone.md) | GUI Provider danger-zone placement | Done |
+| [`S0101`](spec/ship/S0101-gui-device-settings-polish.md) | GUI device-scoped Settings polish | Done |
+| [`S0102`](spec/ship/S0102-device-only-config.md) | Device-only config | Done |
 
 ---
 

package/docs/SHIP.md

@@ -35,7 +35,7 @@ open https://scorel.chanler.dev
 pnpm scorel pair <pair-code>
 ```
 
-`scorel host serve` 会启动本机 Host、注册当前目录为初始 Project，并默认连接官方 Relay。`scorel up` / `pnpm dev` 只作为本地开发便利入口：本地 Host + 本地 WebUI。
+`scorel host serve` 会以前台调试模式启动本机 Host、注册当前目录为初始 Project，并默认连接官方 Relay。`scorel host start` 会启动或复用后台 singleton Host，并返回到 shell；`scorel host stop` 显式关闭它。`scorel up` / `pnpm dev` 只作为本地开发便利入口：确保后台 Host 可用，然后启动本地 WebUI，但不拥有 Host 生命周期。后台 Host 无 client、无 active work、无 active IM 时会按 idle timeout 自动退出；active IM 会保持 Host 存活。
 
 ---
 

package/docs/spec/extensions.md

@@ -152,11 +152,12 @@ class PromptBuilder {
 
 **格式**：TOML
 
-**读取顺序**（高 → 低）：
-1. `.scorel/config.toml`（项目级）
-2. `~/.scorel/config.toml`（用户级）
+**读取路径**：
+1. `~/.scorel/config.toml`（用户级 / 设备级唯一 config）
 
-`~/.scorel` 是固定用户级根目录；`~/.scorel/config.toml` 是固定用户级配置文件；JSONL session 默认固定写入 `~/.scorel/sessions`。这些路径是产品约定，不作为可配置字段暴露。测试和内部嵌入场景可以通过代码注入临时 session 目录，但这不是用户配置面。
+一个设备只有一份 config。Project 是 workspace/session 对象，不拥有 Provider、Model、Memory、Runtime 或 Extension 配置；运行时不会读取项目目录下的 `.scorel/config.toml`。
+
+`~/.scorel` 是固定用户级根目录；`~/.scorel/config.toml` 是固定用户级配置文件；JSONL session 默认固定写入 `~/.scorel/sessions`。这些路径是产品约定，不作为可配置字段暴露。测试和内部嵌入场景可以通过代码注入临时 `scorelHomeDir` / session 目录，但这不是用户配置面。
 
 环境变量不参与通用配置覆盖，只通过 `apiKeyEnv` 指向具体密钥。CLI 参数也不复制完整 config schema；只有明确属于交互控制的参数才进入 CLI。
 
@@ -244,7 +245,7 @@ auxiliary = "aux"
 
 `available_models.*` 是 Scorel 的 available model / use pool。它们从 `provider_models.*` 里引用少量真正允许 Scorel 使用的模型；Runtime、GUI composer 和未来 subagent selection 只能选择 pool 内模型，不能直接选择 provider catalog 或 provider model 里的任意条目。
 
-GUI 的 provider/model 写入必须 merge 到现有 `.scorel/config.toml`：同一 provider 下追加第二个 provider model，或把 provider model 加入 available models 时，不能删除已存在 provider、provider model、available model 或 role assignment，除非用户明确覆盖对应字段。
+GUI 的 provider/model 写入必须 merge 到现有设备级 `config.toml`：同一 provider 下追加第二个 provider model，或把 provider model 加入 available models 时，不能删除已存在 provider、provider model、available model 或 role assignment，除非用户明确覆盖对应字段。
 
 Scorel 仍处在开发阶段，没有存量配置兼容要求。旧 `[models.*]` section 不再支持；遇到旧 section 必须按未知 section 报错。
 

package/docs/spec/ship/S0060-relay-hosted-webui-e2e-validation.verification.md

@@ -38,7 +38,7 @@ The verifier starts:
 - a real local Relay process with durable file store
 - a real local Host daemon process connected outbound to Relay
 - a real WebUI Next dev server
-- a temporary real Project with project-level `.scorel/config.toml`
+- a temporary real Project using the device-level `~/.scorel/config.toml`
 - a Relay Entry using `RelayTransport` and `DaemonClient`
 
 The verifier then:

package/docs/spec/ship/S0073-provider-model-profile-contract.md

@@ -103,12 +103,12 @@ The response must be display-safe:
 - if the target Project has no model profile config yet, `list_models` returns an empty
   model list instead of surfacing config-not-found as a user-facing error.
 
-Expose a Host API for adding/updating a Project's provider/model profile. GUI must use
-this Host-owned path for both local and Relay Projects; renderer code must not write
-`.scorel/config.toml` directly.
+Expose a Host API for adding/updating the device provider/model profile. GUI must use
+this Host-owned path for both local and Relay devices; renderer code must not write
+`~/.scorel/config.toml` directly.
 
 Saving a provider/model profile is a config edit, not a provider call. It must validate
-shape and merge into the existing Project config, but it must not require the target
+shape and merge into the existing device config, but it must not require the target
 Host process to already have the provider API key env var set. Missing credentials
 should block runtime use, not saving.
 
@@ -186,8 +186,8 @@ This spec does not implement a new subagent execution engine.
   - using the selected model's context window.
 - Daemon/client tests cover:
   - model profile summary is exposed without API keys;
-  - a Project with no model config returns an empty model profile summary;
-  - adding/updating a provider/model profile writes a valid `.scorel/config.toml`
+  - a device with no model config returns an empty model profile summary;
+  - adding/updating a provider/model profile writes a valid `~/.scorel/config.toml`
     without requiring API key env vars;
   - adding a second model under the same provider preserves the existing provider and
     model entries;

package/docs/spec/ship/S0074-gui-model-provider-settings-split.md

@@ -56,7 +56,7 @@ page hierarchy.
 ### 4. Existing Host contract
 
 Continue using the Host-owned `list_models` and `upsert_model_profile` path. Renderer
-code must not write `.scorel/config.toml` directly.
+code must not write `~/.scorel/config.toml` directly.
 
 This spec can reuse the S0073 data model and does not need a new protocol message unless
 the UI needs one for clean implementation.

package/docs/spec/ship/S0076-provider-modal-search-and-direct-key.md

@@ -37,7 +37,7 @@ selecting a draft provider.
 Provider config supports either:
 
 - `apiKeyEnv`, resolved from environment variables; or
-- `apiKey`, stored directly in `.scorel/config.toml`.
+- `apiKey`, stored directly in the device `~/.scorel/config.toml`.
 
 GUI never receives direct API key values when listing providers. Editing an existing
 direct-key provider shows only that a direct key is configured. Saving a provider with

package/docs/spec/ship/S0086-auto-compact-and-session-memory.md

@@ -69,7 +69,7 @@ GUI Settings Memory section exposes:
 - session memory toggle;
 - auto compact threshold select.
 
-These controls use the existing project-scoped memory config path.
+These controls use the device-scoped memory config path; memory status and persisted memory artifacts remain project-aware activity data.
 
 ## Not In Scope
 

package/docs/spec/ship/S0096-glob-stable-order.md

@@ -0,0 +1,32 @@
+# S0096: Glob Stable Order
+
+## Goal
+
+Make the `Glob` tool return deterministic results across local macOS and Linux CI.
+
+## Scope
+
+- Sort `Glob` file results by workspace-relative path before applying `head_limit` / `offset`.
+- Preserve existing `Grep` behavior and pagination shape.
+
+## Not In Scope
+
+- Changing ripgrep invocation.
+- Changing Grep content/count ordering.
+
+## Acceptance Criteria
+
+- `Glob` result limiting does not depend on filesystem or ripgrep output order.
+- Existing coding tool tests pass on Linux and macOS.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/core test -- src/tools/coding-tools.test.ts
+pnpm typecheck
+pnpm test
+```
+
+## Status
+
+Done.

package/docs/spec/ship/S0097-rtk-token-saving-settings.md

@@ -0,0 +1,61 @@
+# S0097: RTK Token Saving Settings
+
+## Goal
+
+Add an opt-in GUI setting that enables RTK-backed token saving for Scorel Bash tool execution without changing session replay, model prompts, or existing tool input contracts.
+
+RTK here means Rust Token Killer: a CLI command rewriter/filter that compresses shell command output before it reaches the LLM context.
+
+## Scope
+
+- Add device-scoped `[runtime] tokenSavingRtk = boolean` config.
+- Add GUI Settings page `Token 节省` with an RTK enable toggle and status.
+- When the user enables the setting, Host ensures the `rtk` binary is available:
+  - first detect `rtk` on PATH;
+  - if missing on macOS/Linux with Homebrew available, attempt `brew install rtk`;
+  - if install fails, keep the setting but report RTK as unavailable.
+- Bash tool execution and RTK discovery use the user's default shell path (`options.defaultShell` where provided, then `SHELL`, then OS user shell, then `/bin/sh` fallback), not a hard-coded `/bin/bash`.
+- Shell invocation preserves the command string and uses shell-compatible command flags (`-lc` for sh/bash/zsh-like shells, `-c` for csh/tcsh/fish-like shells).
+- When enabled and available, the Bash tool asks RTK to rewrite the original command and executes the rewritten command, while preserving the original tool input contract and cwd semantics.
+- Bash tool result details expose RTK application state plus estimated output/saved tokens for Scorel-owned UI/diagnostics.
+- Runtime Settings summarizes RTK token savings from a maintained Scorel runtime stats file across projects on the current host.
+- Chat transcript rendering continues to display the original Bash tool-call command, not the RTK rewritten execution command.
+- Session JSONL and persistent events keep the same tool result shape; no prompt or input assembly contract changes.
+
+## Not In Scope
+
+- Changing model message assembly.
+- Compressing Read / Grep / Glob built-in tool results.
+- Provider-specific token accounting.
+- A per-session savings breakdown view.
+- Global shell hook installation through `rtk init`.
+- Silent install at app startup.
+
+## Acceptance Criteria
+
+- `tokenSavingRtk = false` keeps Bash behavior equivalent to the current path.
+- `tokenSavingRtk = true` uses RTK rewrite for Bash command execution when RTK is available, without changing the tool-call input command string.
+- Tool results sent back into model context include only the user-visible content, not RTK execution metadata or rewritten command details.
+- GUI Bash tool blocks display the original tool-call command even when RTK rewrites the command at execution time.
+- RTK detection and first-enable install checks run in the same default shell environment as command execution, so zsh-configured PATH entries are visible.
+- Runtime creation resolves the RTK executable whenever `tokenSavingRtk` is enabled, so saved settings affect actual Bash tool execution, not only the Settings UI.
+- Runtime Settings token totals come from Scorel-maintained RTK stats updated when Scorel persists tool results, so other agents' RTK usage in the same project is not counted.
+- GUI Settings can enable/disable RTK token saving and shows available/unavailable status.
+- Config parsing rejects unknown `[runtime]` keys.
+- RTK install is only attempted after the user enables the setting.
+- Existing tests, typecheck, and full test suite pass.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/core test -- src/config/config.test.ts src/tools/coding-tools.test.ts
+pnpm --filter @scorel/daemon test -- src/embedded/embedded.test.ts
+pnpm --filter @scorel/app-gui test -- src/renderer/gui-shell.test.tsx
+pnpm verify:m9-gui # service-level local/relay plus Electron CDP settings + prompt smoke
+pnpm typecheck
+pnpm test
+```
+
+## Status
+
+Done.

package/docs/spec/ship/S0098-local-daemon-singleton-unified-state.md

@@ -0,0 +1,96 @@
+# S0098: Local Daemon Singleton And Unified State
+
+## Goal
+
+Make the local Scorel Host a single user-level daemon with one local state root, so CLI, GUI, WebUI, IM, and Relay clients attach to the same Project registry, Session JSONL, runtime stats, and config.
+
+## Scope
+
+- Use `~/.scorel` as the only local Host state root:
+  - `daemon.json`
+  - `projects.json`
+  - `sessions/*.jsonl`
+  - `runtime-stats.json`
+  - `config.toml`
+  - `gui-store.json`
+- Remove GUI-local Host state ownership:
+  - no new `~/.scorel/gui/projects.json`;
+  - no new `~/.scorel/gui/sessions`;
+  - GUI still has GUI UI state, but it lives at `~/.scorel/gui-store.json`.
+- Add `scorel host start`, a background daemon start path that starts the singleton local daemon without tying daemon lifetime to the CLI process that launched it.
+- Make local GUI attach to the singleton daemon when available.
+- Make local GUI start the singleton daemon in the background when no live daemon exists, then attach to it.
+- Make `scorel up` ensure the singleton daemon is running, register the current cwd as a Project, and launch/serve UI without owning daemon lifetime.
+- Keep foreground `scorel host serve` for debugging; Ctrl-C on foreground serve still stops that foreground process.
+- Daemon lifecycle:
+  - daemon is not killed when one client exits;
+  - explicit `scorel host stop` stops it;
+  - if no IM extensions are active, daemon idle-shuts down after no connected clients and no active work for the configured timeout;
+  - if any IM extension is active, daemon remains alive until explicit stop.
+
+## Not In Scope
+
+- Migrating old `~/.scorel/gui/projects.json` or `~/.scorel/gui/sessions` into the unified state. Scorel is pre-1.0; users may remove old GUI-local files manually if needed.
+- System LaunchAgent/login-item installation.
+- Multi-user or system-wide daemon.
+- Remote daemon lifecycle changes.
+- Per-session RTK stats breakdown UI.
+- Restart-on-crash supervisor.
+
+## Acceptance Criteria
+
+- GUI local Projects and Sessions are created under `~/.scorel/projects.json` and `~/.scorel/sessions`, not under `~/.scorel/gui`.
+- `gui-store.json` is stored at `~/.scorel/gui-store.json`.
+- `scorel host start` starts or reuses a background singleton daemon and returns without waiting for daemon shutdown.
+- `scorel up` reuses an existing running daemon instead of spawning a child daemon that dies with `scorel up`.
+- Starting GUI when a daemon is alive attaches to it and does not start a second Host writer.
+- Starting GUI when no daemon is alive starts the background singleton daemon, then attaches to it.
+- If no clients remain, no work is active, and no IM extension is active, daemon exits after its idle timeout.
+- If an IM extension is active, daemon does not idle-exit solely because there are no GUI/CLI clients.
+- Model/tool messages remain unchanged: daemon lifecycle and state unification do not alter tool call args or provider tool result context.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/app-cli test -- src/daemon-cli.test.ts src/up-cli.test.ts
+pnpm --filter @scorel/app-gui test -- src/main/local-host.test.ts
+pnpm --filter @scorel/daemon test -- src/embedded/embedded.test.ts
+pnpm verify:m9-gui
+pnpm typecheck
+pnpm test
+```
+
+Manual/E2E:
+
+- Start GUI from a clean temp HOME through Electron CDP.
+- Verify local Project registration creates `~/.scorel/projects.json`.
+- Verify local Session creation creates `~/.scorel/sessions/*.jsonl`.
+- Verify no `~/.scorel/gui/projects.json` or `~/.scorel/gui/sessions` is created.
+- Verify GUI start from a clean HOME creates `~/.scorel/daemon.json` and attaches to that daemon.
+- Verify `scorel host start` returns while `scorel host status` still reports a running daemon.
+- Verify `scorel up` exit does not stop the singleton daemon it started.
+- Verify short idle timeout stops a daemon with no clients and no active IM.
+- Verify active IM prevents idle shutdown.
+
+## Impacted Files
+
+- `apps/cli/src/daemon-cli.ts`
+- `apps/cli/src/up-cli.ts`
+- `apps/cli/src/index.ts`
+- `apps/gui/src/main.ts`
+- `apps/gui/src/main/local-host.ts`
+- `packages/daemon/src/index.ts`
+- `scripts/verify-m9-gui-cdp-e2e.ts`
+- `docs/SHIP.md`
+- `docs/ROADMAP.md`
+
+## Risks And Boundaries
+
+- Background daemon process management must not leave stale `daemon.json` as a false-positive running daemon.
+- The singleton daemon must remain the only local writer for Project and Session files.
+- Electron GUI starts the daemon through the CLI entrypoint; packaged builds must provide `SCOREL_CLI_ENTRYPOINT` when the source tree is unavailable.
+- Old GUI-local state under `~/.scorel/gui` is intentionally not migrated in this spec.
+
+## Status
+
+Done.

package/docs/spec/ship/S0099-gui-connection-device-settings.md

@@ -0,0 +1,85 @@
+# S0099: GUI Connection And Device Settings
+
+## Goal
+
+Make GUI connection setup match the hosted Relay product path, so users can pair devices, rename paired devices, and inspect connection details.
+
+S0101 supersedes the original settings-scope part of this spec: settings configuration is device-scoped, not Project-scoped.
+
+## Scope
+
+- GUI Relay pairing:
+  - default to the official Relay without showing an editable URL field;
+  - expose Relay URL editing only behind an explicit edit affordance;
+  - rename the pairing action from `Pair` to `Get Pair Code`.
+- GUI paired devices:
+  - allow users to rename a paired Relay Device locally in GUI state;
+  - preserve the Relay-reported label as fallback when no local name exists;
+  - show device details from the generic device view: status, Device ID, IP when available, and Relay URL.
+- GUI Settings scope:
+  - superseded by S0101;
+  - the correct product model is device-scoped configuration.
+- Tests and docs:
+  - cover local device rename persistence;
+  - cover the connection section rendering contract;
+  - keep ROADMAP in sync.
+
+## Not In Scope
+
+- Relay protocol changes or IP discovery in Relay V1. The UI may expose an optional IP field, but Relay currently does not guarantee one.
+- SSH Remote Device, remote installation, or SSH stdio proxy.
+- Direct WS + token GUI setup.
+- Account/OAuth identity.
+- Importing every remote Host Project automatically into the GUI Project list.
+- Moving IM extension settings to remote scope; IM settings remain local GUI/Host extension settings in this spec.
+
+## Acceptance Criteria
+
+- Opening GUI Settings -> Connections shows the official Relay as the default endpoint and does not show a Relay URL input until the user chooses edit.
+- The pair action reads `Get Pair Code`.
+- A pair code is still created with the default official Relay when the URL field has not been edited.
+- Paired devices can be renamed from the Connections page, and the local name persists in `~/.scorel/gui-store.json`.
+- Paired device details expose status, Device ID, Relay URL, and an IP row that is populated only when the device view has IP information.
+- Settings nav behavior is governed by S0101: it shows devices, not Projects.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/app-gui test -- src/main/gui-store.test.ts src/renderer/gui-shell.test.tsx
+pnpm typecheck
+pnpm test
+```
+
+Manual:
+
+- Open GUI Settings -> Connections.
+- Confirm the Relay URL input is hidden by default and `Get Pair Code` returns a pair code against the official Relay.
+- Click edit, change Relay URL, and confirm pair/refresh use the edited URL.
+- Pair or seed a Relay Device, rename it, refresh, and confirm the local name remains.
+- Open Settings and confirm the settings selector follows S0101 device-scoped behavior.
+
+## Impacted Files
+
+- `apps/gui/src/main/gui-store.ts`
+- `apps/gui/src/main.ts`
+- `apps/gui/src/preload.ts`
+- `apps/gui/src/shared/ipc.ts`
+- `apps/gui/src/renderer/App.tsx`
+- `apps/gui/src/renderer/settings/SettingsShell.tsx`
+- `apps/gui/src/renderer/settings/SettingsNav.tsx`
+- `apps/gui/src/renderer/settings/sections/ConfigSection.tsx`
+- `apps/gui/src/renderer/styles.css`
+- `apps/gui/src/main/gui-store.test.ts`
+- `apps/gui/src/renderer/gui-shell.test.tsx`
+- `docs/CHANGELOG.md`
+- `docs/ROADMAP.md`
+
+## Risks And Boundaries
+
+- Device rename is GUI-local metadata, not a Relay identity mutation. Refresh must not overwrite a user's local name with a Relay label.
+- Settings scope is device-based as of S0101. Projects are workspace/session objects, not configuration owners.
+- IP is optional because the current Relay protocol does not report it; the UI contract must tolerate absence without inventing a fake value.
+
+## Status
+
+Done.

package/docs/spec/ship/S0100-gui-provider-danger-zone.md

@@ -0,0 +1,57 @@
+# S0100: GUI Provider Danger Zone Placement
+
+## Goal
+
+Move destructive Provider management actions out of the primary Provider edit form, so normal configuration fields remain the first visual focus and deletion is clearly presented as a secondary dangerous action.
+
+S0101 supersedes the final placement: `删除提供商` now lives in the Provider configuration block's lower-right action area instead of a bottom danger row.
+
+## Scope
+
+- In GUI Settings -> Provider:
+  - this spec recorded the first placement pass;
+  - S0101 defines the current placement in the Provider configuration block;
+  - keep the existing `removeModelProvider` behavior unchanged.
+- Add rendering coverage that verifies the destructive action is below normal model-management controls.
+
+## Not In Scope
+
+- Changing Provider deletion semantics, confirmation behavior, or daemon/client APIs.
+- Redesigning the Provider page layout beyond the destructive-action placement.
+- Changing model catalog, model selection, or provider form fields.
+
+## Acceptance Criteria
+
+- Current acceptance is governed by S0101: `删除提供商` appears in the Provider configuration block.
+- Existing Provider add/edit/model actions remain unchanged.
+- GUI rendering tests cover the current placement.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/app-gui test -- src/renderer/gui-shell.test.tsx
+pnpm --filter @scorel/app-gui typecheck
+```
+
+Manual:
+
+- Start the GUI with a Project that has a configured Provider.
+- Open Settings -> Provider.
+- Confirm S0101 current behavior: the delete button appears in the Provider configuration block's lower-right action area.
+
+## Impacted Files
+
+- `apps/gui/src/renderer/settings/sections/ProviderSection.tsx`
+- `apps/gui/src/renderer/styles.css`
+- `apps/gui/src/renderer/gui-shell.test.tsx`
+- `docs/CHANGELOG.md`
+- `docs/ROADMAP.md`
+
+## Risks And Boundaries
+
+- The delete action remains destructive and immediate, matching existing behavior. This spec only changes placement.
+- The danger row should not introduce another card nested inside the Provider card; it stays as an inline separated row.
+
+## Status
+
+Done.

package/docs/spec/ship/S0101-gui-device-settings-polish.md

@@ -0,0 +1,66 @@
+# S0101 GUI Device Settings Polish
+
+## Goal
+
+Fix GUI settings so configuration is device-scoped, not Project-scoped, and polish the settings interactions surfaced by the latest Provider / Token / Connection review.
+
+One device has one configuration. The Settings scope selector chooses a device:
+
+- `此电脑` configures the local device.
+- A Relay device configures that remote device.
+- Projects remain workspace/session objects and must not appear as the settings configuration scope.
+
+## Scope
+
+- Settings left scope selector becomes device-based.
+- GUI settings IPC for model profile, Provider catalog/deletion, memory settings, and runtime settings targets only a device.
+- Daemon/client config requests used by GUI are device-level and write the device user config at `~/.scorel/config.toml` for that daemon.
+- Provider deletion moves into the top Provider configuration form area, aligned to the lower-right of the Provider parameter block.
+- Runtime token statistics use understandable Chinese labels and expose both output token total and saved token estimate.
+- Relay device rows have an explicit expand affordance.
+- Relay device rename is inline: a small edit icon next to the device name turns the name into an input.
+
+## Not In Scope
+
+- Changing session/project ownership: sessions still belong to Projects.
+- Redesigning Project registry or remote Project selection.
+- Creating per-Project settings overrides.
+- Reworking IM extension settings beyond existing user-config behavior.
+- Changing RTK savings math.
+
+## Acceptance Criteria
+
+- Settings selector labels are device names only, for example `此电脑` and `Remote Device`; it does not render `此电脑 / ProjectName` or `Device / ProjectName`.
+- Settings Provider/Model/Memory/Runtime mutations do not accept a Project in GUI IPC.
+- Daemon writes GUI settings requests to device-level user config.
+- Provider delete is visually close to Provider credentials/configuration, not in a separate bottom danger row.
+- Runtime token stats are Chinese and self-explanatory.
+- Relay device rows visibly indicate expand/collapse and rename through a name-adjacent edit icon.
+
+## Test Requirements
+
+- Update renderer tests for device settings scope, Provider delete placement, Runtime labels, and inline Relay device rename affordance.
+- Add or update daemon/local-host tests proving projectless settings write `config.toml` under device user config.
+- Run targeted GUI/protocol/daemon tests covering changed paths.
+- Run `pnpm typecheck && pnpm test` before shipping.
+
+## Impacted Files
+
+- `packages/protocol/src/events.ts`
+- `packages/protocol/src/wire.ts`
+- `packages/client/src/index.ts`
+- `packages/daemon/src/index.ts`
+- `apps/gui/src/main.ts`
+- `apps/gui/src/main/local-host.ts`
+- `apps/gui/src/main/relay-service.ts`
+- `apps/gui/src/preload.ts`
+- `apps/gui/src/shared/ipc.ts`
+- `apps/gui/src/renderer/App.tsx`
+- `apps/gui/src/renderer/settings/*`
+- `apps/gui/src/renderer/styles.css`
+- `docs/ROADMAP.md`
+- `docs/CHANGELOG.md`
+
+## Risks And Boundaries
+
+- Memory status is a Project activity/status concept; this spec keeps Settings focused on Memory configuration, not Project activity status.