@chanlerdev/scorel 0.0.3 → 0.0.5

package/docs/CHANGELOG.md

@@ -2,6 +2,100 @@
 
 ## Unreleased
 
+## 0.0.5 - 2026-06-19
+
+### Highlights
+
+- New CLI commands `scorel version`, `scorel update`, and `scorel upgrade` for software lifecycle management.
+- Oversized Bash tool output is now archived to session artifacts, returning compact head/tail projections to the model.
+- GUI auto-update support with macOS DMG/ZIP packaging and incremental updates.
+
+### Changes
+
+- GUI and daemon now honor the selected chat model when sending messages.
+- GUI settings are more resilient: ignore stale device responses, error boundaries on settings sections, and fixed state reset when switching devices.
+- `scorel host serve` and `scorel host start` no longer idle-timeout by default; only convenience daemons (GUI auto-start, `scorel up`) enforce a 15-minute idle timeout.
+- GUI auto-start uses an ephemeral port to avoid conflicts with user-started daemons.
+
+### Fixes
+
+- GUI provider model selection now persists correctly across profile refreshes and session creation.
+- Daemon lifecycle hardened: foreground daemon stays alive until Ctrl+C/SIGTERM.
+
+### Verification
+
+- Unit tests for update helpers (semver comparison, npm check/install, auto-update gate).
+- Unit tests for GUI main process (electron-updater import, manual update item, tray setup).
+- Integration test for release asset collection and version lockstep.
+- Tests for oversized Bash archive and projection logic.
+- Tests for daemon idle timeout behavior.
+- Tests for GUI settings resilience (stale data, error boundary, state reset).
+- Tests for model selection fallback and normalization.
+
+### Internal
+
+- Update SHIP.md to clarify that small bug fixes may skip spec requirement; only changes affecting stable contracts or user-visible direction need a spec.
+- Oversized Bash results are written to session-scoped artifacts, excluded from diagnostics and Relay.
+
+- Add `scorel version`, `scorel update`, and `scorel upgrade`.
+- Add hourly Host auto-update checks gated by active work state.
+- Add GUI macOS release packaging and Electron updater metadata to the release path.
+- Add GUI application menu and macOS status bar menu entries for manual update checks and common app actions.
+- Document unsigned macOS GUI quarantine bypass command.
+
+## 0.0.4 - 2026-06-14
+
+### Highlights
+
+- Config is now device-scoped only; project-level config is no longer read or written.
+- GUI settings are device-scoped with relay device rename and project scope selector.
+- Local daemon is a singleton background process with idle shutdown and shared state root.
+- RTK token saving settings available in GUI for Bash execution.
+
+### Changes
+
+- GUI connection settings default to official Relay URL; editing requires explicit click.
+- Pairing button label changed to 'Get Pair Code'.
+- Paired Relay devices can be renamed locally; name persists across refresh.
+- Provider delete button moved to a danger zone at bottom of settings panel.
+- Token-saving statistics labels changed to Chinese (Bash 输出 Token / 已节省 Token).
+- RTK token saving can be enabled/disabled in GUI settings, persisted in project config.
+- Cumulative RTK savings stats are maintained across sessions and projects.
+- RTK is detected from default shell; can be installed via Homebrew if missing.
+
+### Fixes
+
+- Glob results are now sorted by workspace-relative path for deterministic ordering across platforms.
+
+### Breaking Changes
+
+- Runtime no longer reads project `.scorel/config.toml`; existing project configs are ignored.
+- GUI local projects and sessions are now stored under `~/.scorel/` instead of `~/.scorel/gui/`; old state is not migrated automatically.
+
+### Verification
+
+- Core config tests prove project config is ignored and device config is used.
+- Daemon embedded tests prove settings writes with projectId write device config only.
+- GUI rendering tests confirm device-scoped selector, provider delete placement, and Chinese token labels.
+- New local-host test verifies device config writes to ~/.scorel/config.toml.
+- E2E CDP script validates shared state paths and daemon lifecycle.
+- Unit tests cover RTK detection, Bash execution with RTK, and runtime stats recording.
+
+### Internal
+
+- `scorel host start` launches a singleton background daemon; `scorel host serve` gains `--idle-timeout-ms` flag.
+- `scorel up` ensures daemon is running but no longer owns its lifecycle.
+- GUI attaches to singleton daemon instead of running embedded Host.
+- gui-store.json lives at `~/.scorel/gui-store.json`.
+
+- Add `scorel host start` for background singleton Host startup; `scorel up` now leaves the singleton Host running when WebUI exits.
+- GUI local Host state now uses the shared `~/.scorel` root for Projects and Sessions, with `gui-store.json` stored at `~/.scorel/gui-store.json`.
+- GUI starts and attaches to the singleton local daemon instead of starting a second local Host writer.
+- Local daemon now idle-shuts down when there are no clients, no active work, and no active IM extensions; active IM keeps it alive until explicit stop.
+- GUI connection settings now default to the official Relay, hide Relay URL editing behind an edit action, show `Get Pair Code`, support paired-device rename/details, and use a device-scoped settings selector.
+- GUI Provider settings now place `删除提供商` in the Provider configuration block, token-saving stats use clear Chinese labels, and Relay device rows expose expand/edit affordances.
+- Config loading now uses the device config only; Project `.scorel/config.toml` is no longer a runtime or Settings config source.
+
 ## 0.0.3 - 2026-06-12
 
 ### Highlights

package/docs/ROADMAP.md

@@ -303,7 +303,7 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 - `scorel daemon serve` 全部 flag 有合理默认;token 在 `~/.scorel/daemon.json` 持久化,跨重启复用。
 - `~/.scorel/daemon.json` 不再每次启动删除;通过 pid liveness + `stoppedAt` 判存活。
 - WebUI Settings 页面通过 `/api/local-daemon` server route 自动发现本地 daemon,一键添加 device。
-- `scorel up` 同时拉起 daemon serve + webui,Ctrl+C 一并退出。
+- `scorel up` 确保 singleton daemon 可用并启动 WebUI；退出 `scorel up` 不关闭后台 daemon；无 client/无 active work/无 active IM 后 idle 自动退出。
 - 全部改动通过自动测试,真实 LLM 手工烟雾通过。
 
 **Steps**:
@@ -315,7 +315,7 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 **Not in M5.6**:
 
 - WebUI 多 daemon 切换 UI;每用户单 daemon 假设。
-- 自动 supervisor / restart;仍需手工 `scorel daemon stop && serve`。
+- restart-on-crash supervisor;仍需手工 `scorel host stop && start`。
 - Windows 专属 PID 语义。
 - TLS / OAuth / 公网隧道。
 
@@ -592,6 +592,14 @@ M5 WebUI 的正式产品方向记录在 [`S0030`](spec/ship/S0030-webui-product-
 | M9.F1.16 | [`S0087`](spec/ship/S0087-gui-ui-polish-sweep.md) | Codex-inspired GUI visual pass：学习 Codex 的比例、层级和克制风格，并把 GUI tool blocks 收敛为低噪声执行证据流 | Done |
 | M9.F1.17 | [`S0088`](spec/ship/S0088-gui-streaming-thinking-contract.md) | Streaming thinking contract：补 thinking/content delta，使 thinking 在 turn 运行中按序显示，而不是最终 assistant_message 后才插入 | Done |
 | M9.F1.18 | [`S0089`](spec/ship/S0089-memory-reliability-and-dream-trigger.md) | Memory reliability：修复 AppendDaily 调用质量、dreaming 触发与可观测性，让 M9 后半段聚焦真实使用中的质量优化 | Done |
+| M9.F1.19 | [`S0097`](spec/ship/S0097-rtk-token-saving-settings.md) | GUI Token 节省设置 + RTK Bash output proxy + runtime config | Done |
+| M9.F1.20 | [`S0098`](spec/ship/S0098-local-daemon-singleton-unified-state.md) | 统一本机 Host state root、后台 singleton start、GUI/CLI auto-start + attach、idle shutdown、active IM 保活 | Done |
+| M9.F1.21 | [`S0099`](spec/ship/S0099-gui-connection-device-settings.md) | GUI 连接设置默认官方 Relay、配对设备命名/详情、Settings scope 初版 | Done |
+| M9.F1.22 | [`S0100`](spec/ship/S0100-gui-provider-danger-zone.md) | GUI Provider 删除按钮位置初版 | Done |
+| M9.F1.23 | [`S0101`](spec/ship/S0101-gui-device-settings-polish.md) | GUI Settings 改为设备级配置，修正 Provider 删除位置、Token 文案、设备展开/重命名交互 | Done |
+| M9.F1.24 | [`S0102`](spec/ship/S0102-device-only-config.md) | Config 彻底收敛为设备级唯一配置，移除 Project config 运行时语义 | Done |
+| M9.F1.25 | [`S0103`](spec/ship/S0103-daemon-lifecycle-and-settings-resilience.md) | Daemon 生命周期按入口区分，并修复 GUI Settings remote 切换黑屏风险 | Done |
+| M9.F1.26 | [`S0105`](spec/ship/S0105-cli-update-and-gui-release.md) | CLI 命令面统一补齐、NPM 手动/自动更新、GUI release 打包和增量更新框架 | Done |
 
 **Not in M9 Follow-up**:
 
@@ -761,6 +769,16 @@ HTTP adapter 必须映射已有 Host use cases，不复制领域逻辑。
 | [`S0093`](spec/ship/S0093-gui-im-settings-platform-layout.md) | GUI IM Settings platform layout | Done |
 | [`S0094`](spec/ship/S0094-im-inbound-runtime.md) | IM inbound runtime receive paths | Done |
 | [`S0095`](spec/ship/S0095-gui-im-session-list-refresh.md) | GUI IM session list refresh | Done |
+| [`S0096`](spec/ship/S0096-glob-stable-order.md) | Glob stable cross-platform ordering | Done |
+| [`S0097`](spec/ship/S0097-rtk-token-saving-settings.md) | RTK token saving settings and Bash output proxy | Done |
+| [`S0098`](spec/ship/S0098-local-daemon-singleton-unified-state.md) | Local daemon singleton and unified state | Done |
+| [`S0099`](spec/ship/S0099-gui-connection-device-settings.md) | GUI connection device settings | Done |
+| [`S0100`](spec/ship/S0100-gui-provider-danger-zone.md) | GUI Provider danger-zone placement | Done |
+| [`S0101`](spec/ship/S0101-gui-device-settings-polish.md) | GUI device-scoped Settings polish | Done |
+| [`S0102`](spec/ship/S0102-device-only-config.md) | Device-only config | Done |
+| [`S0103`](spec/ship/S0103-daemon-lifecycle-and-settings-resilience.md) | Daemon lifecycle and Settings resilience | Done |
+| [`S0104`](spec/ship/S0104-tool-result-artifacts.md) | Tool result artifacts for oversized Bash output | Done |
+| [`S0105`](spec/ship/S0105-cli-update-and-gui-release.md) | CLI update and GUI release | Done |
 
 ---
 

package/docs/SHIP.md

@@ -25,6 +25,8 @@
 ```bash
 pnpm install
 pnpm scorel       # 在当前目录进入交互式项目会话
+pnpm scorel --version
+pnpm scorel update
 ```
 
 Hosted WebUI 路径：
@@ -35,7 +37,7 @@ open https://scorel.chanler.dev
 pnpm scorel pair <pair-code>
 ```
 
-`scorel host serve` 会启动本机 Host、注册当前目录为初始 Project，并默认连接官方 Relay。`scorel up` / `pnpm dev` 只作为本地开发便利入口：本地 Host + 本地 WebUI。
+`scorel host serve` 会以前台调试模式启动本机 Host、注册当前目录为初始 Project，并默认连接官方 Relay；前台 Host 默认一直存活，直到 Ctrl+C / SIGTERM，除非显式传入 `--idle-timeout-ms`。`scorel host start` 会启动或复用后台 singleton Host，并返回到 shell；直接后台启动的 CLI Host 默认一直存活，直到 `scorel host stop` 或进程退出。`scorel up` / `pnpm dev` 只作为本地开发便利入口：确保后台 Host 可用，然后启动本地 WebUI，但不拥有 Host 生命周期。GUI / CUI 自动拉起的后台 Host 无 client、无 active work、无 active IM 时会按 15 分钟 idle timeout 自动退出；active IM 会保持 Host 存活。
 
 ---
 
@@ -102,7 +104,7 @@ docs/spec/ship/S####-slug.md
 - 影响文件 / 包
 - 风险与边界
 
-没有 S spec，不开始实现。Bug fix 也需要 S spec，可以很短。
+没有 S spec，不开始实现。局部 bug fix 可以不创建 S spec；如果修复会改变稳定契约、配置/协议/数据边界或用户可见产品方向，就先补 S spec。
 
 ### 3. Ship
 
@@ -140,7 +142,7 @@ S####: <type>: <description>
 
 规则：
 
-- 一个 PR 对应一个 S spec。
+- 一个 PR 对应一个 S spec；局部 bug fix 可以不对应 S spec。
 - Commit message 使用 title-only semantic commit：只写标题，不写正文。
 - 按业务含义拆 commit，不把无关实现混在一起。
 - 文档、实现、测试可以拆 commit，但 PR title 必须带 S 编号。
@@ -205,9 +207,11 @@ pnpm release patch --no-generate-notes
 - 检查 working tree
 - 执行 check
 - 执行 WebUI production build
+- 执行 GUI production build
 - 构建 public `scorel` npm package
 - 执行 `npm pack` 安装烟雾测试
 - bump 所有 package version
+- 构建 GUI macOS dmg / zip release assets，并生成 `latest-mac.yml` 与 blockmap 增量更新 metadata
 - 默认用 DeepSeek V4 Flash 从上一个 `v*` tag 之后的 commits 生成 changelog notes
 - 更新 changelog；只有显式 `--no-generate-notes` 时才写入最小版本标题
 - commit `release: vX.Y.Z`
@@ -215,11 +219,11 @@ pnpm release patch --no-generate-notes
 - publish root `scorel` package to npm
 - push branch + tag
 - create GitHub Release from the same generated changelog notes
-- upload the same-version `npm pack` tarball as the only GitHub Release asset
+- upload the same-version `npm pack` tarball and GUI macOS release assets to the GitHub Release
 
 Release notes 使用 `DEEPSEEK_API_KEY` 调用 DeepSeek 官方 API，默认 endpoint 为 `https://api.deepseek.com/v1`，默认模型为 `deepseek-v4-flash`。Dry-run 在缺少 key 或 API 失败时可打印 deterministic fallback preview；正式 release 默认要求 AI notes 成功，除非显式传入 `--no-generate-notes`。
 
-GitHub Actions 提供手动触发入口，默认执行 `patch` dry-run。正式 release 使用 `GITHUB_TOKEN` 创建 GitHub Release；正式 publish 需要仓库 secret `NPM_TOKEN`，对应 npm 账号当前为 `chanlerdev`。AI release notes 需要仓库 secret `DEEPSEEK_API_KEY`。
+GitHub Actions 提供手动触发入口，默认执行 `patch` dry-run。正式 release 使用 `GITHUB_TOKEN` 创建 GitHub Release；正式 publish 需要仓库 secret `NPM_TOKEN`，对应 npm 账号当前为 `chanlerdev`。AI release notes 需要仓库 secret `DEEPSEEK_API_KEY`。GUI macOS 产物当前以 unsigned build 发布，workflow 设置 `CSC_IDENTITY_AUTO_DISCOVERY=false`；有 Apple Developer 账号后再补 signing/notarization。
 
 ---
 

package/docs/spec/extensions.md

@@ -152,11 +152,12 @@ class PromptBuilder {
 
 **格式**：TOML
 
-**读取顺序**（高 → 低）：
-1. `.scorel/config.toml`（项目级）
-2. `~/.scorel/config.toml`（用户级）
+**读取路径**：
+1. `~/.scorel/config.toml`（用户级 / 设备级唯一 config）
 
-`~/.scorel` 是固定用户级根目录；`~/.scorel/config.toml` 是固定用户级配置文件；JSONL session 默认固定写入 `~/.scorel/sessions`。这些路径是产品约定，不作为可配置字段暴露。测试和内部嵌入场景可以通过代码注入临时 session 目录，但这不是用户配置面。
+一个设备只有一份 config。Project 是 workspace/session 对象，不拥有 Provider、Model、Memory、Runtime 或 Extension 配置；运行时不会读取项目目录下的 `.scorel/config.toml`。
+
+`~/.scorel` 是固定用户级根目录；`~/.scorel/config.toml` 是固定用户级配置文件；JSONL session 默认固定写入 `~/.scorel/sessions`。这些路径是产品约定，不作为可配置字段暴露。测试和内部嵌入场景可以通过代码注入临时 `scorelHomeDir` / session 目录，但这不是用户配置面。
 
 环境变量不参与通用配置覆盖，只通过 `apiKeyEnv` 指向具体密钥。CLI 参数也不复制完整 config schema；只有明确属于交互控制的参数才进入 CLI。
 
@@ -244,7 +245,7 @@ auxiliary = "aux"
 
 `available_models.*` 是 Scorel 的 available model / use pool。它们从 `provider_models.*` 里引用少量真正允许 Scorel 使用的模型；Runtime、GUI composer 和未来 subagent selection 只能选择 pool 内模型，不能直接选择 provider catalog 或 provider model 里的任意条目。
 
-GUI 的 provider/model 写入必须 merge 到现有 `.scorel/config.toml`：同一 provider 下追加第二个 provider model，或把 provider model 加入 available models 时，不能删除已存在 provider、provider model、available model 或 role assignment，除非用户明确覆盖对应字段。
+GUI 的 provider/model 写入必须 merge 到现有设备级 `config.toml`：同一 provider 下追加第二个 provider model，或把 provider model 加入 available models 时，不能删除已存在 provider、provider model、available model 或 role assignment，除非用户明确覆盖对应字段。
 
 Scorel 仍处在开发阶段，没有存量配置兼容要求。旧 `[models.*]` section 不再支持；遇到旧 section 必须按未知 section 报错。
 

package/docs/spec/ship/S0060-relay-hosted-webui-e2e-validation.verification.md

@@ -38,7 +38,7 @@ The verifier starts:
 - a real local Relay process with durable file store
 - a real local Host daemon process connected outbound to Relay
 - a real WebUI Next dev server
-- a temporary real Project with project-level `.scorel/config.toml`
+- a temporary real Project using the device-level `~/.scorel/config.toml`
 - a Relay Entry using `RelayTransport` and `DaemonClient`
 
 The verifier then:

package/docs/spec/ship/S0064-gui-product-intent-and-boundary.md

@@ -29,7 +29,7 @@ Lock M9 GUI as a Project-first desktop app before implementation. The GUI should
 
 - Do not scaffold Electron in S0064.
 - Do not implement GUI screens.
-- Do not add SSH, direct WS + token, OAuth, account systems, or GUI auto-update.
+- Do not add SSH, direct WS + token, OAuth, account systems, or GUI auto-update in S0064. GUI auto-update is introduced later by S0105 as release infrastructure.
 - Do not publish or package desktop installers.
 - Do not change the public npm CLI package surface.
 

package/docs/spec/ship/S0073-provider-model-profile-contract.md

@@ -76,10 +76,17 @@ Host runtime must use the selected model for each session/turn:
   available model or role;
 - CLI can continue using the default role without exposing a new command flag in this
   spec;
-- GUI composer can choose an available model for new prompts/sessions;
+- GUI composer can choose an available model for the next main chat prompt, including
+  prompts sent into an existing session;
+- background model tasks such as session title generation, session memory, foreground
+  compact, and memory dream use the configured `auxiliary` role unless a later spec
+  defines a more specific routing contract;
 - session metadata records the selected model id and role when known;
 - session header persists enough selected-model metadata to keep resume auditable if
   config later changes;
+- if a restored session references a selected model that no longer exists in the
+  current device config, Host falls back through the persisted role or current
+  `standard` role instead of failing attach/resume;
 - assistant events keep recording actual provider/model metadata from pi-ai.
 
 Tool creation must use the actual selected model's context window, not a global model
@@ -103,12 +110,12 @@ The response must be display-safe:
 - if the target Project has no model profile config yet, `list_models` returns an empty
   model list instead of surfacing config-not-found as a user-facing error.
 
-Expose a Host API for adding/updating a Project's provider/model profile. GUI must use
-this Host-owned path for both local and Relay Projects; renderer code must not write
-`.scorel/config.toml` directly.
+Expose a Host API for adding/updating the device provider/model profile. GUI must use
+this Host-owned path for both local and Relay devices; renderer code must not write
+`~/.scorel/config.toml` directly.
 
 Saving a provider/model profile is a config edit, not a provider call. It must validate
-shape and merge into the existing Project config, but it must not require the target
+shape and merge into the existing device config, but it must not require the target
 Host process to already have the provider API key env var set. Missing credentials
 should block runtime use, not saving.
 
@@ -186,8 +193,8 @@ This spec does not implement a new subagent execution engine.
   - using the selected model's context window.
 - Daemon/client tests cover:
   - model profile summary is exposed without API keys;
-  - a Project with no model config returns an empty model profile summary;
-  - adding/updating a provider/model profile writes a valid `.scorel/config.toml`
+  - a device with no model config returns an empty model profile summary;
+  - adding/updating a provider/model profile writes a valid `~/.scorel/config.toml`
     without requiring API key env vars;
   - adding a second model under the same provider preserves the existing provider and
     model entries;

package/docs/spec/ship/S0074-gui-model-provider-settings-split.md

@@ -56,7 +56,7 @@ page hierarchy.
 ### 4. Existing Host contract
 
 Continue using the Host-owned `list_models` and `upsert_model_profile` path. Renderer
-code must not write `.scorel/config.toml` directly.
+code must not write `~/.scorel/config.toml` directly.
 
 This spec can reuse the S0073 data model and does not need a new protocol message unless
 the UI needs one for clean implementation.

package/docs/spec/ship/S0076-provider-modal-search-and-direct-key.md

@@ -37,7 +37,7 @@ selecting a draft provider.
 Provider config supports either:
 
 - `apiKeyEnv`, resolved from environment variables; or
-- `apiKey`, stored directly in `.scorel/config.toml`.
+- `apiKey`, stored directly in the device `~/.scorel/config.toml`.
 
 GUI never receives direct API key values when listing providers. Editing an existing
 direct-key provider shows only that a direct key is configured. Saving a provider with

package/docs/spec/ship/S0086-auto-compact-and-session-memory.md

@@ -69,7 +69,7 @@ GUI Settings Memory section exposes:
 - session memory toggle;
 - auto compact threshold select.
 
-These controls use the existing project-scoped memory config path.
+These controls use the device-scoped memory config path; memory status and persisted memory artifacts remain project-aware activity data.
 
 ## Not In Scope
 

package/docs/spec/ship/S0096-glob-stable-order.md

@@ -0,0 +1,32 @@
+# S0096: Glob Stable Order
+
+## Goal
+
+Make the `Glob` tool return deterministic results across local macOS and Linux CI.
+
+## Scope
+
+- Sort `Glob` file results by workspace-relative path before applying `head_limit` / `offset`.
+- Preserve existing `Grep` behavior and pagination shape.
+
+## Not In Scope
+
+- Changing ripgrep invocation.
+- Changing Grep content/count ordering.
+
+## Acceptance Criteria
+
+- `Glob` result limiting does not depend on filesystem or ripgrep output order.
+- Existing coding tool tests pass on Linux and macOS.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/core test -- src/tools/coding-tools.test.ts
+pnpm typecheck
+pnpm test
+```
+
+## Status
+
+Done.

package/docs/spec/ship/S0097-rtk-token-saving-settings.md

@@ -0,0 +1,61 @@
+# S0097: RTK Token Saving Settings
+
+## Goal
+
+Add an opt-in GUI setting that enables RTK-backed token saving for Scorel Bash tool execution without changing session replay, model prompts, or existing tool input contracts.
+
+RTK here means Rust Token Killer: a CLI command rewriter/filter that compresses shell command output before it reaches the LLM context.
+
+## Scope
+
+- Add device-scoped `[runtime] tokenSavingRtk = boolean` config.
+- Add GUI Settings page `Token 节省` with an RTK enable toggle and status.
+- When the user enables the setting, Host ensures the `rtk` binary is available:
+  - first detect `rtk` on PATH;
+  - if missing on macOS/Linux with Homebrew available, attempt `brew install rtk`;
+  - if install fails, keep the setting but report RTK as unavailable.
+- Bash tool execution and RTK discovery use the user's default shell path (`options.defaultShell` where provided, then `SHELL`, then OS user shell, then `/bin/sh` fallback), not a hard-coded `/bin/bash`.
+- Shell invocation preserves the command string and uses shell-compatible command flags (`-lc` for sh/bash/zsh-like shells, `-c` for csh/tcsh/fish-like shells).
+- When enabled and available, the Bash tool asks RTK to rewrite the original command and executes the rewritten command, while preserving the original tool input contract and cwd semantics.
+- Bash tool result details expose RTK application state plus estimated output/saved tokens for Scorel-owned UI/diagnostics.
+- Runtime Settings summarizes RTK token savings from a maintained Scorel runtime stats file across projects on the current host.
+- Chat transcript rendering continues to display the original Bash tool-call command, not the RTK rewritten execution command.
+- Session JSONL and persistent events keep the same tool result shape; no prompt or input assembly contract changes.
+
+## Not In Scope
+
+- Changing model message assembly.
+- Compressing Read / Grep / Glob built-in tool results.
+- Provider-specific token accounting.
+- A per-session savings breakdown view.
+- Global shell hook installation through `rtk init`.
+- Silent install at app startup.
+
+## Acceptance Criteria
+
+- `tokenSavingRtk = false` keeps Bash behavior equivalent to the current path.
+- `tokenSavingRtk = true` uses RTK rewrite for Bash command execution when RTK is available, without changing the tool-call input command string.
+- Tool results sent back into model context include only the user-visible content, not RTK execution metadata or rewritten command details.
+- GUI Bash tool blocks display the original tool-call command even when RTK rewrites the command at execution time.
+- RTK detection and first-enable install checks run in the same default shell environment as command execution, so zsh-configured PATH entries are visible.
+- Runtime creation resolves the RTK executable whenever `tokenSavingRtk` is enabled, so saved settings affect actual Bash tool execution, not only the Settings UI.
+- Runtime Settings token totals come from Scorel-maintained RTK stats updated when Scorel persists tool results, so other agents' RTK usage in the same project is not counted.
+- GUI Settings can enable/disable RTK token saving and shows available/unavailable status.
+- Config parsing rejects unknown `[runtime]` keys.
+- RTK install is only attempted after the user enables the setting.
+- Existing tests, typecheck, and full test suite pass.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/core test -- src/config/config.test.ts src/tools/coding-tools.test.ts
+pnpm --filter @scorel/daemon test -- src/embedded/embedded.test.ts
+pnpm --filter @scorel/app-gui test -- src/renderer/gui-shell.test.tsx
+pnpm verify:m9-gui # service-level local/relay plus Electron CDP settings + prompt smoke
+pnpm typecheck
+pnpm test
+```
+
+## Status
+
+Done.

package/docs/spec/ship/S0098-local-daemon-singleton-unified-state.md

@@ -0,0 +1,96 @@
+# S0098: Local Daemon Singleton And Unified State
+
+## Goal
+
+Make the local Scorel Host a single user-level daemon with one local state root, so CLI, GUI, WebUI, IM, and Relay clients attach to the same Project registry, Session JSONL, runtime stats, and config.
+
+## Scope
+
+- Use `~/.scorel` as the only local Host state root:
+  - `daemon.json`
+  - `projects.json`
+  - `sessions/*.jsonl`
+  - `runtime-stats.json`
+  - `config.toml`
+  - `gui-store.json`
+- Remove GUI-local Host state ownership:
+  - no new `~/.scorel/gui/projects.json`;
+  - no new `~/.scorel/gui/sessions`;
+  - GUI still has GUI UI state, but it lives at `~/.scorel/gui-store.json`.
+- Add `scorel host start`, a background daemon start path that starts the singleton local daemon without tying daemon lifetime to the CLI process that launched it.
+- Make local GUI attach to the singleton daemon when available.
+- Make local GUI start the singleton daemon in the background when no live daemon exists, then attach to it.
+- Make `scorel up` ensure the singleton daemon is running, register the current cwd as a Project, and launch/serve UI without owning daemon lifetime.
+- Keep foreground `scorel host serve` for debugging; Ctrl-C on foreground serve still stops that foreground process.
+- Daemon lifecycle:
+  - daemon is not killed when one client exits;
+  - explicit `scorel host stop` stops it;
+  - if no IM extensions are active, daemon idle-shuts down after no connected clients and no active work for the configured timeout;
+  - if any IM extension is active, daemon remains alive until explicit stop.
+
+## Not In Scope
+
+- Migrating old `~/.scorel/gui/projects.json` or `~/.scorel/gui/sessions` into the unified state. Scorel is pre-1.0; users may remove old GUI-local files manually if needed.
+- System LaunchAgent/login-item installation.
+- Multi-user or system-wide daemon.
+- Remote daemon lifecycle changes.
+- Per-session RTK stats breakdown UI.
+- Restart-on-crash supervisor.
+
+## Acceptance Criteria
+
+- GUI local Projects and Sessions are created under `~/.scorel/projects.json` and `~/.scorel/sessions`, not under `~/.scorel/gui`.
+- `gui-store.json` is stored at `~/.scorel/gui-store.json`.
+- `scorel host start` starts or reuses a background singleton daemon and returns without waiting for daemon shutdown.
+- `scorel up` reuses an existing running daemon instead of spawning a child daemon that dies with `scorel up`.
+- Starting GUI when a daemon is alive attaches to it and does not start a second Host writer.
+- Starting GUI when no daemon is alive starts the background singleton daemon, then attaches to it.
+- If no clients remain, no work is active, and no IM extension is active, daemon exits after its idle timeout.
+- If an IM extension is active, daemon does not idle-exit solely because there are no GUI/CLI clients.
+- Model/tool messages remain unchanged: daemon lifecycle and state unification do not alter tool call args or provider tool result context.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/app-cli test -- src/daemon-cli.test.ts src/up-cli.test.ts
+pnpm --filter @scorel/app-gui test -- src/main/local-host.test.ts
+pnpm --filter @scorel/daemon test -- src/embedded/embedded.test.ts
+pnpm verify:m9-gui
+pnpm typecheck
+pnpm test
+```
+
+Manual/E2E:
+
+- Start GUI from a clean temp HOME through Electron CDP.
+- Verify local Project registration creates `~/.scorel/projects.json`.
+- Verify local Session creation creates `~/.scorel/sessions/*.jsonl`.
+- Verify no `~/.scorel/gui/projects.json` or `~/.scorel/gui/sessions` is created.
+- Verify GUI start from a clean HOME creates `~/.scorel/daemon.json` and attaches to that daemon.
+- Verify `scorel host start` returns while `scorel host status` still reports a running daemon.
+- Verify `scorel up` exit does not stop the singleton daemon it started.
+- Verify short idle timeout stops a daemon with no clients and no active IM.
+- Verify active IM prevents idle shutdown.
+
+## Impacted Files
+
+- `apps/cli/src/daemon-cli.ts`
+- `apps/cli/src/up-cli.ts`
+- `apps/cli/src/index.ts`
+- `apps/gui/src/main.ts`
+- `apps/gui/src/main/local-host.ts`
+- `packages/daemon/src/index.ts`
+- `scripts/verify-m9-gui-cdp-e2e.ts`
+- `docs/SHIP.md`
+- `docs/ROADMAP.md`
+
+## Risks And Boundaries
+
+- Background daemon process management must not leave stale `daemon.json` as a false-positive running daemon.
+- The singleton daemon must remain the only local writer for Project and Session files.
+- Electron GUI starts the daemon through the CLI entrypoint; packaged builds must provide `SCOREL_CLI_ENTRYPOINT` when the source tree is unavailable.
+- Old GUI-local state under `~/.scorel/gui` is intentionally not migrated in this spec.
+
+## Status
+
+Done.

package/docs/spec/ship/S0099-gui-connection-device-settings.md

@@ -0,0 +1,85 @@
+# S0099: GUI Connection And Device Settings
+
+## Goal
+
+Make GUI connection setup match the hosted Relay product path, so users can pair devices, rename paired devices, and inspect connection details.
+
+S0101 supersedes the original settings-scope part of this spec: settings configuration is device-scoped, not Project-scoped.
+
+## Scope
+
+- GUI Relay pairing:
+  - default to the official Relay without showing an editable URL field;
+  - expose Relay URL editing only behind an explicit edit affordance;
+  - rename the pairing action from `Pair` to `Get Pair Code`.
+- GUI paired devices:
+  - allow users to rename a paired Relay Device locally in GUI state;
+  - preserve the Relay-reported label as fallback when no local name exists;
+  - show device details from the generic device view: status, Device ID, IP when available, and Relay URL.
+- GUI Settings scope:
+  - superseded by S0101;
+  - the correct product model is device-scoped configuration.
+- Tests and docs:
+  - cover local device rename persistence;
+  - cover the connection section rendering contract;
+  - keep ROADMAP in sync.
+
+## Not In Scope
+
+- Relay protocol changes or IP discovery in Relay V1. The UI may expose an optional IP field, but Relay currently does not guarantee one.
+- SSH Remote Device, remote installation, or SSH stdio proxy.
+- Direct WS + token GUI setup.
+- Account/OAuth identity.
+- Importing every remote Host Project automatically into the GUI Project list.
+- Moving IM extension settings to remote scope; IM settings remain local GUI/Host extension settings in this spec.
+
+## Acceptance Criteria
+
+- Opening GUI Settings -> Connections shows the official Relay as the default endpoint and does not show a Relay URL input until the user chooses edit.
+- The pair action reads `Get Pair Code`.
+- A pair code is still created with the default official Relay when the URL field has not been edited.
+- Paired devices can be renamed from the Connections page, and the local name persists in `~/.scorel/gui-store.json`.
+- Paired device details expose status, Device ID, Relay URL, and an IP row that is populated only when the device view has IP information.
+- Settings nav behavior is governed by S0101: it shows devices, not Projects.
+
+## Test Requirements
+
+```bash
+pnpm --filter @scorel/app-gui test -- src/main/gui-store.test.ts src/renderer/gui-shell.test.tsx
+pnpm typecheck
+pnpm test
+```
+
+Manual:
+
+- Open GUI Settings -> Connections.
+- Confirm the Relay URL input is hidden by default and `Get Pair Code` returns a pair code against the official Relay.
+- Click edit, change Relay URL, and confirm pair/refresh use the edited URL.
+- Pair or seed a Relay Device, rename it, refresh, and confirm the local name remains.
+- Open Settings and confirm the settings selector follows S0101 device-scoped behavior.
+
+## Impacted Files
+
+- `apps/gui/src/main/gui-store.ts`
+- `apps/gui/src/main.ts`
+- `apps/gui/src/preload.ts`
+- `apps/gui/src/shared/ipc.ts`
+- `apps/gui/src/renderer/App.tsx`
+- `apps/gui/src/renderer/settings/SettingsShell.tsx`
+- `apps/gui/src/renderer/settings/SettingsNav.tsx`
+- `apps/gui/src/renderer/settings/sections/ConfigSection.tsx`
+- `apps/gui/src/renderer/styles.css`
+- `apps/gui/src/main/gui-store.test.ts`
+- `apps/gui/src/renderer/gui-shell.test.tsx`
+- `docs/CHANGELOG.md`
+- `docs/ROADMAP.md`
+
+## Risks And Boundaries
+
+- Device rename is GUI-local metadata, not a Relay identity mutation. Refresh must not overwrite a user's local name with a Relay label.
+- Settings scope is device-based as of S0101. Projects are workspace/session objects, not configuration owners.
+- IP is optional because the current Relay protocol does not report it; the UI contract must tolerate absence without inventing a fake value.
+
+## Status
+
+Done.