@deepseek-harness-tui/dsh-tui 0.12.0 → 0.14.0

package/guide/dsh-tui-guide/configuration.md

@@ -64,6 +64,15 @@ Config；旧版仍使用 `~/.dsh/settings.yaml`。不要把旧文件路径当成
 | `splashFont` | `daily` | 开屏大字字体：`daily` 按本地日期轮换（默认），其余取字体 id（`bold` / `square` / `bevel` / `wide` / `dot` / `stencil` / `classic` / `slab`）pin 住那一款；非法值回落 `daily`。也可经 `/settings` 修改 |
 | `whaleGirl` | `false` | 把标题的像素鲸鱼换成女仆娘：**最优先**真图（Kitty/Sixel）；不支持时回落字符画版女仆娘 |
 | `minimal` | `false` | 极简界面（Minimal UI）：精简标题装饰与配色。**这是界面显示开关**，与下面 `preset` 里的内核「极简模式」预设完全是两件事（那个才决定模型能用哪些工具） |
+| `sidePanel.splitEnabled` | `true`（布尔） | 分栏总开关：开启时 `Ctrl+B` 与 `/panel` 在聊天右侧展开侧栏；关闭时两者都不再分栏，`/jobs` 等仍走整屏面板。立即生效 |
+| `sidePanel.open` | `false`（布尔） | 启动时侧栏是否已展开；默认关闭，升级后布局与原来一致。会话内的 `Ctrl+B` / `/panel toggle` 不写回这里。立即生效 |
+| `sidePanel.ratio` | `0.68`（数值，0.1–0.95） | 聊天列占内容宽度的比例；侧栏有焦点时 `+`/`-` 在当前会话内实时微调（不写回）。立即生效 |
+| `sidePanel.panels` | `todo,jobs,agents,info,trajectory,workspace,btw,companion`（逗号分隔文本） | 默认启用全部 8 个内置面板；这里控制面板 id 与顺序。格式合法但暂无面板认领的 id 会留在标签栏等插件注册，格式非法的条目被拒绝。面板栏右端的 `⤢` 把当前面板放大成整屏（只对声明了整屏形态的面板出现）。立即生效 |
+ | `companion.skin` | `deepy` | 宠物面板的皮肤：`deepy`（默认，deepy 小鲸鱼素材包）、`whaleGirl`（鲸娘表情包，22 个动画含互动反应）或 `whale`（与开屏同款分层像素鲸鱼）；面板默认启用，可在 `sidePanel.panels` 调整。立即生效 |
+| `btw.contextTurns` | `4`（数值，1–8） | `/btw` 追问时带上的最近已完成问答组数；更早的组不进请求，线程和面板里仍保留。立即生效 |
+| `btw.contextBudget` | `24000`（数值，1000–200000） | `/btw` 追问携带的最近问答总字符数上限，超出时从最旧的一组开始丢。立即生效 |
+| `codeFrameStyle` | `light` | 回复里代码块的边框：`light` 只有顶部标签和左侧竖线，不多占行；`full` 是封闭的框。终端太窄时总是用纯文本 fence。立即生效 |
+| `turnUsageRow` | `false`（布尔） | 每回合末尾显示一行右对齐的用量（输入/输出、缓存、耗时、重试）；关闭时 `/tokens`、`/status` 和底栏悬停照样能看到这些数字 |
 | `modes` | 内置三档 | Shift+Tab 会话模式循环（plan/sandbox/approval 原子组合）；缺省为 默认 → 计划 → 完全访问 |
 | `activity` | `true` | 是否显示实时工作状态行 |
 | `activityFrames` | `moon8` | 工作状态动画预设；也可通过 `/activity` 修改。旧配置值 `claude` 读取时映射为 `moon8`，选择器不再显示该旧预设 |
@@ -72,6 +81,7 @@ Config；旧版仍使用 `~/.dsh/settings.yaml`。不要把旧文件路径当成
 | `terminalImages` | `true` | 允许在支持的终端预览图片；`false` 保留文字信息，跳过图片探测与预览解码。修改后重启生效 |
 | `preset` | 名册默认 `standard` | 新会话 Agent preset；显式配置优先于持久化偏好 |
 | `sessionId` | 未设置 | 要恢复的会话 ID，通常由 Windows `--resume` 启动器注入 |
+| `backend` | 未设置（`/kernel` 记住的选择，否则 `dsh`） | 会话后端：`dsh`，或实验性的 `claude` / `codex`（不区分大小写，未知值按 `dsh`）。profile 行读取 `DSH_TUI_BACKEND`，`dsh-tui --backend <id>` 会设置它。见 [Claude 后端](claude-backend.md) |
 
 ### 优先级与强制关闭
 
@@ -127,7 +137,7 @@ Config；旧版仍使用 `~/.dsh/settings.yaml`。不要把旧文件路径当成
 | --- | --- | --- |
 | `standard` | 标准模式（默认） | 编辑、Shell、检索、Skills、计划、Goals、子代理与工作流 |
 | `ptc`（0.1.2）/ `code`（旧 0.1.1） | PTC 模式 | 标准能力，加 PTC SDK 呈现工具，可用 TypeScript 组合多步操作；两个名字可跨版本兼容解析 |
-| `minimal` | 极简模式 | 内核 Agent 预设：只暴露一个持久 shell 工具（POSIX 为 bash，Windows 为 pwsh），不带 compaction、计划模式与运行时上下文。`str_replace_editor` 自 0.1.3-alpha.2 起是 opt-in，该预设不含它 |
+| `minimal` | 极简模式 | 内核 Agent 预设：只暴露一个持久 shell 工具（POSIX 为 bash，Windows 为 pwsh），不带 compaction、计划模式与运行时上下文。`str_replace_editor` 自 0.1.3-alpha.2 起是 opt-in，该预设不含它。代价也如实说：没有压缩、也不剪枝工具结果（长会话可能撞上下文上限，超长工具输出整段留在上下文里），`/compact` 与问卷在该预设下不可用——Help 与 `/` 补全标注「不可用」，进入/恢复该预设时提示一次 |
 | `cordis` | 创造模式 | 标准能力，加运行时检查与插件实验工具 |
 | `liangshen` | 梁神模式 | 主 Agent 与子 Agent 首轮均保持极简模式的最小工具面，首次工具调用后开放完整目录，压缩后重新锚定 |
 
@@ -224,6 +234,8 @@ Profile 模式不再使用旧的 `DSH_TUI_COMPACT_RATIO`、`DSH_TUI_COMPACT_RETA
 | `DSH_TUI_DISABLE_TERMINAL_IMAGES` | 设为 `1` 时强制关闭 Kitty/Sixel 探测、预览读取/解码与终端图片渲染，优先于 config 和 /settings；保留文字信息 |
 | `DSH_TUI_IMAGE_PROTOCOL` | `auto`（默认）、`kitty`、`sixel` 或 `none`；覆盖协议选择，但不绕过图片预览偏好、禁用开关、非全屏、无障碍和多路复用器限制 |
 | `DSH_TUI_RESUME_SESSION` | 启动时恢复指定会话，通常由启动器设置 |
+| `DSH_TUI_BACKEND` | 会话后端（`dsh` / `claude`），通常由 `dsh-tui --backend` 设置 |
+| `DSH_TUI_CLAUDE_PERMISSION_MODE` | Claude 后端的起始权限模式（`default`/`acceptEdits`/`plan`/`dontAsk`/`bypassPermissions`），优先于 `/permission` 记住的选择 |
 | `DSH_TUI_WORKSPACE_TARGET` | 启动时解析的工作区路径或 URI，通常由 `dsh-tui <目标>` 设置 |
 | `DSH_TUI_SESSION_ROOT` | 覆盖 JSONL 会话根目录；profile 默认 `$DSH_HOME/sessions`，裸 `cordis.yml` 默认 `~/.dsh-tui/sessions` |
 | `DSH_PERMISSION_MODE` | 非 Windows 平台覆盖 sandbox policy，例如 `workspace-write` 或 `danger-full-access` |

package/guide/dsh-tui-guide/getting-started.en.md

@@ -276,13 +276,16 @@ pnpm build
 pnpm smoke
 ```
 
-The repository has two submodules; `vendor/dsh-std` is required to install:
+The repository has a single submodule, and it is required to install:
 
 - `vendor/dsh-std`: its `packages/*` are listed as workspace packages in
   `pnpm-workspace.yaml`.
-- `dsh-ecosystem-spec`: the ecosystem specification used by contract checks.
 
-Without `--recurse-submodules` these directories stay empty and
+The TUI Profile (plugin admission and private protocol definitions) lives in
+`tui-profile/` as **plain files** (no longer a submodule); it is checked out and
+revised together with this repository and is what the contract checks read.
+
+Without `--recurse-submodules` that directory stays empty and
 `pnpm install --frozen-lockfile` fails outright. For a checkout that was
 already cloned:
 

package/guide/dsh-tui-guide/getting-started.md

@@ -268,11 +268,13 @@ pnpm build
 pnpm smoke
 ```
 
-本仓库有两个子模块，其中安装必需的是 `vendor/dsh-std`：
+本仓库只有一个子模块，且安装必需：
 
 - `vendor/dsh-std`：`pnpm-workspace.yaml` 把 `vendor/dsh-std/packages/*` 列为
   workspace 包。
-- `dsh-ecosystem-spec`：生态适配规范，供契约检查使用。
+
+TUI Profile（插件准入与私有协议定义）在 `tui-profile/`，是**普通文件**（不再是
+子模块），随本仓库代码一起检出与修订，供契约检查使用。
 
 漏掉 `--recurse-submodules` 会让这些目录为空，
 `pnpm install --frozen-lockfile` 直接失败。已经克隆过的检出补一条：

package/guide/dsh-tui-guide/interaction.en.md

@@ -6,7 +6,7 @@
 
 | Key | Behavior |
 | --- | --- |
-| `Enter` | Send while idle; steer text into the running turn at its next step boundary; confirm an open menu |
+| `Enter` | Send while idle; run a known `/` command (with or without arguments — while a turn runs its own gate decides); steer the remaining text into the running turn at its next step boundary; confirm an open menu |
 | `Tab` | Complete a `/` command or `@` file; while the model is working, queue non-empty input as a post-turn follow-up |
 | `Ctrl+Enter` | Interrupt the running turn and process the input immediately |
 | `Shift+Enter` / `Ctrl+J` | Insert a newline at the caret; `Ctrl+J` (LF) is the fallback when the terminal cannot report the Shift modifier; macOS Terminal.app uses `Option+Enter` |
@@ -16,14 +16,17 @@
 | `Ctrl+V` / `Alt+V` | Insert clipboard text or files; images are sent as durable attachments. Use `Alt+V` when the terminal intercepts `Ctrl+V` |
 | `Ctrl+G` | Edit the current input in an external editor (`$VISUAL` → `$EDITOR`); saving and quitting fills it back, `:cq`/non-zero exit keeps the draft; with neither variable set the TUI asks you to configure one (no `vi` fallback) |
 | `Ctrl+Shift+E` | Expand the fullscreen draft editor (or click the `⛶` affordance at the end of the input row): line numbers + current-line highlight + live line/char stats<br>`Enter` inserts a newline, `Ctrl+Enter` or the Send button sends, `Esc` or the Collapse button keeps the draft and returns<br>wheel-scrolls freely; click/drag/double-click selection work as in the inline prompt; remappable via `/settings` |
-| `Esc` | Ladder: close help → close the image preview → close the command menu → close the file menu (only the current `@` token)<br>→ **with a selection in the prompt input: only clear it (text untouched)** → interrupt the turn and redeliver pending messages → clear non-empty input → double-tap on empty input = rewind<br>in fullscreen, an active mouse selection is cleared first (not copied) |
+| `Esc` | Ladder: close help → close the image preview → close the command menu → close the file menu (only the current `@` token)<br>→ **with a selection in the prompt input: only clear it (text untouched)** → with the held-queue selector open: only leave the selector → interrupt the turn and hold the queued messages (no automatic re-send, see "Message delivery semantics") → clear non-empty input → double-tap on empty input = rewind<br>in fullscreen, an active mouse selection is cleared first (not copied) |
+| `Ctrl+Z` | Undo the prompt draft's last word-level edit (text, caret and images together). Draft-only: a submit, a history recall (`Ctrl+R`/`↑`) or a session switch ends the history; it is NOT the message/conversation rewind behind `Esc Esc`. Remappable via `/settings` |
 | `Esc` / `Ctrl+C` / `Enter` while an image preview is open | Close the preview and restore the surface underneath; other keys are not passed through |
 | `Left` / `Right` in the image modal | Previous / next image, no wrapping; caret peeks keep arrows with the prompt |
-| `←` (empty input) | Background this session and open the session-management screen (same as `/bg`) |
+| `←` (empty input) | Open the session manager (same as `/bg`); DSH backgrounds the current session first, while Claude/Codex keep it attached |
 | `Ctrl+C` | Interrupt while working; press again while the interrupt is still settling to force-exit<br>clear non-empty idle input; **while idle with a selection in the prompt input, copy it to the clipboard (selection kept for editing)**; press twice on empty input to exit |
 | `Ctrl+D` | Same ladder as `Ctrl+C`: interrupt while working (press again to force-exit if the interrupt stalls); press twice while idle to exit |
 | `Ctrl+O` | Toggle transcript/verbose detail, including full reasoning and tool arguments/output; also the escape hatch for the **long-line fold** (a single line over 1000 chars is clipped to 1000 with a `… N chars folded` marker — see the user guide §5). Clicking the folded row (or the tool card face) toggles it too |
 | `Ctrl+P` | Toggle the loaded-context panel shown at startup (while it is on screen) |
+| `Ctrl+B` | Side panel, three states: closed → open and focus the right column; open with the chat focused → focus the right column; panel focused → close and return to the chat. Splits only under `fullscreen` at a content width of ≥93 columns; on narrow terminals and in inline mode the key does nothing (`/jobs` & co. keep their full-screen panels — see the user guide §2.8) |
+| `Alt+Z` | Zoom the active side panel (the chat column keeps its minimum width); press again to restore |
 | `Ctrl+T` | Open the trajectory scene (same as `/trace`); `q`/`Esc` returns to the conversation |
 | `Ctrl+R` | Open input-history search; repeat or press `Down` for the next result |
 | `Ctrl+L` | Clear and force a physical terminal redraw |
@@ -33,8 +36,8 @@
 | `Shift+Up` | Enter message selection; arrows move, `Enter` expands one row, `Esc` exits |
 
 **Remapping shortcuts**: paste, history search, external editor, `Ctrl+O/T/P/R/L`,
-subagent dashboard, show-all, and todo fold are remappable in `/settings` → `dsh-tui` →
-`Shortcuts`.
+side panel (`Ctrl+B`/`Alt+Z`), subagent dashboard, show-all, and todo fold are remappable in
+`/settings` → `dsh-tui` → `Shortcuts`.
 
 - Enter combos like `alt+v`; comma-separate several; leave blank to restore defaults. Saves apply live.
 - Combos that clash with the fixed editing keys or another action are rejected.
@@ -68,6 +71,81 @@ subagent dashboard, show-all, and todo fold are remappable in `/settings` → `d
 - Plugins provide the keyboard path for the same action through a slash command or `tuiShortcuts`.
 - A refused rich registration returns `undefined`; an admitted one returns a disposer that removes both the view and its Cordis effect.
 
+### Launchpad and first-run guide
+
+The startup **launchpad** and the **first-run wizard** each own the keyboard; both only hand
+results back to the chat screen and add no new behavior.
+
+- **Launchpad**: printable input goes into the input box (the prefix turns from `❯` to `⌘` when the line
+  starts with `/`), `Backspace`/`Delete`/`←`/`→`/`Home`/`End` edit it; the caret is an **inverse block
+  sitting on the current character** (inverse on that one character; an inverse blank cell at end of
+  line — a theme that declares the `cursor` key paints a solid fill with a contrasting glyph instead,
+  see [Themes](themes.en.md)), blinking is a pure style toggle (inverse ↔ regular, ~550ms per phase)
+  and never occupies an extra cell or eats a character; `Alt+R` continues the most recent session
+  (= the first entry row slot, bound only on this screen, no-op when there is nothing to continue,
+  remappable in `/settings`);
+  a leading `/` opens the
+  **command palette** (the same data source and component as the chat composer: `↑`/`↓` move the selection,
+  `Enter`/`Tab`/click **run** the selected command, `Esc` dismisses only the palette and keeps the draft);
+  with the palette dismissed, `Enter` **sends** the line straight away (a leading `/` line — including
+  plugin/registry commands — goes through the chat page's merged command table and never reaches the model);
+  `↑`/`↓`/`Tab` walk the focus ring (input box → the four param segments under the box → the quick
+  actions → the Tips line) and `Enter` activates the focused one (`Enter` on the Tips line rotates the
+  tip), while typing returns focus to the input box; `Esc` clears
+  a non-empty line and opens sessions when empty, and `Ctrl+C` on an empty line takes the exit funnel.
+- **Launchpad param row** (under the box: model · effort · mode · permission; model shows the bare model
+  name and mode shows the agent preset's display name — Standard/PTC/minimal…): each segment is
+  **clickable** and opens the very same picker the chat page uses (`/model` · `/effort` · `/preset` ·
+  `/permission`); the picker renders **above** the launchpad and owns the keyboard
+  (`Esc` closes it back onto the launchpad), the picked value updates the row in place and the typed draft
+  is untouched; clicking inside the picker selects, **clicking elsewhere closes it and clicking another
+  segment switches to that picker**.
+ All four segments **stay on the row**: they are drawn verbatim
+  when they fit; when they do not, only the **over-long segments** are truncated at the tail with a
+  trailing `…` (the permission segment is **never truncated**), and hovering a truncated segment
+  shows its **full name** in a card after ~600ms (mouse tracking is always on for the launchpad
+  screen, inline mode included); only when the **full permission name does not fit the budget** —
+  widening the terminal past 76 columns changes nothing, while a narrower terminal or a longer
+  permission name triggers it earlier — does the row fall back to dropping **whole segments from
+  the tail** (permission → mode → effort → model), which also drops them from the focus ring.
+- **Entry row**: `Continue "…"` (Alt+R; the slot is absent when
+  there is nothing to continue) · `Sessions & workspaces` (`/home` — history and workspaces merged into
+  one entry) · `Settings` (`/settings`) · `Kernel · <current kernel>` (`/kernel`, opens the kernel
+  picker, see the commands section) · a **conditional slot** (priority: background jobs running → `Background
+  jobs`; update detected → `Update available`; usage milestone reached and never starred → `Feed us a
+  star`; fallback `Help`). Full screens opened from the launchpad (sessions & workspaces / settings /
+  background jobs / the family tree / the wizard) render **above the launchpad** — `Esc` closes them
+  back onto the launchpad (draft, params and focus intact); **the only way off the launchpad into the
+  chat is submitting a non-command line with Enter**. Overlays on the launchpad side (pickers, the
+  command palette) are a **clean cutout** — every cell in the overlay rect is space-filled (host
+  glyphs never bleed through), yet no background color is emitted (no white block; Kitty splash
+  art still shows through the terminal-default cells; the chat page's pickers are unaffected).
+- **Tips line**: click to rotate (three tips cycle; the first-run tip has top priority and never rotates);
+  keyboard path = focus ring + `Enter`; it also **auto-rotates** (~10s per tip; a manual
+  rotate resets the timer) — the switch changes only the text, never the row height or centering.
+- **Corner plates**: the bottom-left working directory is **clickable** — it opens the existing
+  `/workspace` menu (rendered above the launchpad; `Esc` returns to the launchpad), keyboard path =
+  the focus ring's last slot + `Enter`, hover/focus = text highlight; the bottom-right plate starts
+  with `dsh-tui v<TUI>`, followed by one row for each of the two kernels:
+  `▸ DSH · dsh-core v<kernel>` / `Claude · claude-code v<CLI>`. `▸` marks the current kernel and the
+  other row stays dim; an unavailable kernel adds the reason after its version (such as *Not installed*
+  or *Not signed in*), a row whose version cannot be read shows just the name, and *Checking…* shows
+  while the probe runs. The whole block is clickable and opens the same kernel picker (keyboard path =
+  focus ring + `Enter`). Rows are right-aligned, the cwd plate is top-aligned to the first row, and
+  narrow terminals truncate per the existing truncate-middle contract.
+- **Wizard**: `←`/`→` change step (except the effort slider in step 3 and a drilled-in model list, where the
+  horizontal keys belong to the child control), `Tab` switches between the language/theme and
+  model/effort/workspace panes, `↑`/`↓` move the selection; `Enter` runs the step (step 1 = re-check
+  connectivity, step 3 = drill into a provider / switch model / open the workspace picker — **effort is not
+  on Enter**, it is `←`/`→` only and applies as you move); the theme pane previews on cursor move while the
+  **language pane applies on `Enter`**; `Enter` on the last step finishes and records the guide when the
+  focused card is a shortcut card, and tries the command when it is a command card; `Esc` skips
+  (**not recorded**, asked again next launch).
+- **Mouse** (mouse tracking is always on for this screen): the launchpad's quick actions (hover = the
+  label turns accent-blue and bold, leaving restores the dim look), param segments, command palette,
+  Tips line, the wizard's "Try it" cards and the workspace picker are clickable, and a click lands on
+  the same command path as the keyboard.
+
 ## Editing keys
 
 | Key | Behavior |
@@ -116,7 +194,8 @@ text and newlines, and is never mistaken for an Enter key. To keep rendering, cl
 mapping, and selection geometry consistent:
 
 - Terminal ANSI controls are stripped on entry.
-- A multi-line paste no longer leaves a stray `_`: when a Windows terminal delivers the paste as win32-input-mode records, the residue (`ESC[Vk;Sc;Uc;Kd;Cs;Rc_`, or the ESC-less tail left by a split record) is stripped whole on entry. Only the five-separator record grammar matches, so genuine underscores and bracket text that merely resembles a record are untouched.
+- A multi-line paste no longer leaves a stray `_`, and no longer drops characters: when a Windows terminal delivers the paste as win32-input-mode records, the key records that leak into the payload (`ESC[Vk;Sc;Uc;Kd;Cs;Rc_`, or the ESC-less tail left by a split record) are decoded back into the characters their `Uc` field encodes — newlines included, through the same CR+LF fold — which is why the chip's line count equals the paste's real line count. **The decode needs evidence**: only a *transition pair* (the same `Uc` pressed and released) is decoded back into characters; a **lone** record — with no pair to prove it is a record stream rather than literal text in the payload — is still stripped whole as a protocol token and its `Uc` is **not** restored, as are records with no character meaning (a `Uc=0` synthesized record, a key record with no text). The promise is therefore "no character is dropped silently **once the bytes are proven to be a record stream**", not "every record shape is decoded back".
+- Both stripping and decoding need evidence: complete records are consumed before ESC-less tails (so a record is never sliced open and its orphan ESC never eats the payload character behind it), and a tail must stand alone as its own token — a record-shaped run welded into the payload's own word is kept byte-for-byte (visible residue beats silent loss). Only the five-separator record grammar matches, so genuine underscores and bracket text that merely resembles a record are untouched.
 - Pasted CRLF collapses: a CR+LF pair produces one newline instead of two; LF-only and lone CR keep their previous behavior.
 - Tabs are expanded to spaces on entry.
 
@@ -215,13 +294,33 @@ While the model is working, three paths have different placement:
 
 | Action | Placement |
 | --- | --- |
-| `Enter` | Steer: deliver to the running turn at its next step boundary |
+| `Enter` | known `/` command (with or without arguments) → run it, its own gate decides; anything else → steer: deliver to the running turn at its next step boundary |
 | `Tab` | Follow-up: wait until the current turn finishes |
 | `Ctrl+Enter` | Interrupt: stop the turn and deliver immediately |
 
+**While a turn is running, a command is always a command; only two kinds of input steer: plain text that is not a command, and a direct skill gesture (`/skill-name …`).** The completion overlay groups commands by their impact on the current conversation: the harmless ones stay on top in their normal style, while gated, interrupting, replacing or steering commands sink to the bottom in the theme's grey (`subtle`, no header row) — where they stay selectable.
+
 - Undelivered messages appear above the editor.
 - `Alt/Option+Up` retrieves the latest one.
-- Pressing `Esc` while pending messages exist interrupts and redelivers them immediately.
+- Pressing `Esc` while the model works interrupts the turn and holds the queued
+  messages above the input instead of re-sending them; the hint row reads
+  `Press ↑ to edit queued messages, ⏎ to send now`. DSH and Claude behave the same.
+  - With messages held and idle, `↑` on an empty input opens the queued-message
+    selector: `↑`/`↓` move, `⏎` takes the selected message back into the input
+    for editing, `Esc` leaves the selector. You can also click a held message
+    (takes it back for editing; with a draft in the input the two swap, and
+    `Ctrl+Z` swaps them back) or click the hint row (sends everything).
+  - `⏎` on an empty input sends all held messages in order, exactly once; with a
+    draft in the input `⏎` sends only the draft and the held messages stay, so
+    they are never bundled with it.
+  - `Ctrl+Enter` (with a draft) interrupts the turn and sends the held messages together
+    with the draft right away.
+  - When a turn ends normally, queued messages still flow into the next turn;
+    `Ctrl+C` keeps the queue.
+  - Only messages the backend confirmed as withdrawn are held. With an older
+    Claude CLI that cannot withdraw them, or when the withdrawal request fails,
+    the backend still runs them next turn; dsh-TUI stops holding them, says so,
+    and never sends them twice.
 
 ## Session workflows
 
@@ -321,9 +420,10 @@ On Windows, `dsh-tui.cmd --resume` uses the session ID last written to `~/.dsh-t
 
 ### Background sessions
 
-`/bg` (alias `/background`) moves the current session to the background and keeps it
+On DSH, `/bg` (alias `/background`) moves the current session to the background and keeps it
 running, switches the terminal to a fresh session, and opens the session-management screen;
-`←` on an empty prompt does the same.
+`←` on an empty prompt does the same. On Claude/Codex, both entries open the session manager
+without backgrounding the attached session.
 
 - While a background session waits on you, the prompt footer shows `← N agents`.
 - A background session awaiting approval shows as **needs input**, and the approval panel labels which session it comes from.
@@ -399,6 +499,79 @@ A full-screen scene (no scrollback pollution) over the whole session timeline:
 
 See [Configuration](configuration.en.md#agent-presets).
 
+### Channel profiles (/channel, Claude only)
+
+Relay channels often route a request to a different model while keeping a Claude
+tier name (such as Opus 5.5 (1M)). A channel profile records each channel's model
+mappings and connection, in `~/.dsh-tui/backends/claude/channels.json`:
+
+```json
+{
+  "active": "zhipu",
+  "channels": [
+    {
+      "id": "zhipu",
+      "name": "Zhipu",
+      "baseUrl": "https://open.bigmodel.cn/api/anthropic",
+      "tokenRef": "CHANNEL_ZHIPU_TOKEN",
+      "models": { "claude-opus-5-5[1m]": "glm-5.3[1M]" },
+      "tiers": { "opus": "glm-5.3[1M]", "haiku": "glm-5.3-flash" }
+    }
+  ]
+}
+```
+
+- `models` is an exact map: exact match first, then a match that strips the `[1m]`
+  suffix and ignores case. `tiers` matches tier keywords (`haiku`/`opus`/`sonnet`/
+  `fable`); the reserved `default` matches every other model (like
+  `ANTHROPIC_MODEL`). Both fields are optional.
+- The `id` is derived from `name` (lowercase, non-alphanumerics folded into `-`);
+  importing again updates the channel with the same id.
+- The model name shown is taken in this order: the active channel's `models` > its
+  `tiers` > the legacy `model-names.json` > the tier variables in the Claude
+  settings `env` > the raw id. Without an active channel it is as if the file did
+  not exist.
+- `baseUrl`, `tokenRef` and a channel-private `env` are the connection; all are
+  optional. The active channel decides where the session connects and outranks the
+  dsh-auth subscription sign-in. The token is stored in `~/.dsh/.credentials.yaml`
+  (0600, the same credential store `/provider` uses, referenced as
+  `CHANNEL_<ID>_TOKEN` by default); `channels.json` keeps only the reference, never
+  the token.
+- The connection reaches the CLI twice: in the child environment and through the
+  SDK `settings` option (the CLI's `--settings` layer, which outranks the `env` of
+  `~/.claude/settings.json`, so values a tool such as cc-switch wrote there cannot
+  override the channel). `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN` issued for a
+  different endpoint are never carried to the new host.
+
+`/channel` opens the picker, in this order:
+
+- The channels (the active one ticked, the sub-row shows the mapping counts).
+  `Enter` switches the active channel. Between channels with the same connection
+  the switch is in place and the footer and `/model` names refresh at once; a
+  different connection restarts into a new session (a running CLI cannot change
+  its connection).
+- *Import from settings.json*: names the channel after the `ANTHROPIC_BASE_URL`
+  host, takes `ANTHROPIC_DEFAULT_{HAIKU,OPUS,SONNET,FABLE}_MODEL` and
+  `ANTHROPIC_MODEL` as `tiers` (exact `models` are never guessed), and takes the
+  `baseUrl` and `ANTHROPIC_AUTH_TOKEN` too (the token goes to the credential store
+  as above). Importing again updates the same-id channel and keeps hand-written
+  `models`.
+- *Add a channel* and *Manage channels*: open the same question panel `/provider`
+  uses. Adding asks for the name, base URL, token (input hidden), mapping source
+  (take the tiers from the settings or skip) and whether to switch now; managing
+  edits the base URL or token, refreshes the mappings from the settings, or deletes
+  the channel along with its stored token.
+- *View mappings*: prints the active channel's `models` and `tiers` as a local
+  transcript block. To edit single entries, edit `channels.json`; the display
+  follows the order above live.
+
+A corrupt file reads as empty, a failed write only reaches the debug log, and
+writes go through a same-directory temporary file and an atomic rename. dsh-tui
+never edits `~/.claude/settings.json`; when its `ANTHROPIC_BASE_URL` or credentials
+conflict with the active channel, the session start shows one notice that this
+session connects per the channel profile. The command appears only in Claude
+sessions.
+
 ### Workspaces
 
 - `/workspace resume` opens the workspace picker.
@@ -564,10 +737,15 @@ owns the keyboard (when a questionnaire is also pending, approval takes priority
 
 The protocol offers only "allow once / deny" — there is **no "always allow"**.
 
+On the Claude backend the approval comes from the CLI: it adds *allow always*
+when the CLI suggests a rule, and with the focus on the reject row you can type a
+reason; see [Claude backend](claude-backend.en.md#approvals-and-questions).
+
 ## Slash commands
 
 The command menu merges local commands with the DSH command registry. Type `/` to inspect the complete surface available in the current composition.
 
+- **While a turn is running**, the overlay groups commands by their impact on the current conversation: the harmless ones stay on top in their normal style, while gated, interrupting, replacing or steering commands sink to the bottom in the theme's grey (`subtle`, no header row) — and stay selectable there.
 - Command descriptions follow the UI language (`/lang`).
 - Built-in commands and mapped registry commands (`/plan`, `/goal`, `/feedback`) show Chinese translations in zh.
 - Unmapped registry commands fall back to the registry's own text.
@@ -575,7 +753,7 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 **Sessions**
 
 - `/new`, `/resume`, `/home`, `/agentview` — all three open the same session-management screen.
-- `/bg` — alias `/background`, backgrounds the session and opens that screen.
+- `/bg` — alias `/background`, opens the session manager; DSH backgrounds the session first, while Claude/Codex keep it attached.
 - `/rename`.
 - `/recap` — session recap: apply the suggested title in one key; `/settings` can enable an
   auto-summary on session open, on by default — a divider + `Recap:` line appears at the
@@ -591,15 +769,17 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 **Status**
 
 - `/context`, `/status`, `/cost`, `/balance` — official DeepSeek balance: summary row + hover details, click to refresh.
-- `/config`, `/doctor`, `/init`, `/agents`, `/jobs` — background jobs panel: status/elapsed/exit code, `k` kills.
+- `/config`, `/doctor`, `/init`, `/agents`, `/jobs` — background jobs panel: status/elapsed/exit code, `k` kills; with the split layout on and the terminal wide enough it opens as a right-column panel instead (narrow terminals and inline mode keep the full-screen panel).
 - `/settings`.
 
 **Model and display**
 
-- `/model`, `/effort`, `/thinking`, `/tokens`, `/activity`, `/preset`, `/theme`, `/color` —
-  session accent color: bare opens the palette picker, `<name>` sets directly, `status`/`reset`;
+- `/model`, `/effort`, `/thinking`, `/tokens`, `/activity`, `/preset`, `/theme`.
+- `/channel` — the channel-profile picker (Claude backend only; see the Channel profiles section).
+- `/color` — session accent color: bare opens the palette picker, `<name>` sets directly, `status`/`reset`;
   input border + session-name chip at the top-right, per-session; chip off by default, enable
   in `/settings`.
+- `/panel` — side panel: toggle / focus / zoom / switch panels (subcommands in the user guide §2.8).
 - `/lang`.
 
 **Account and policy**
@@ -615,6 +795,16 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 
 - `/update`, `/vim` — vim editing mode toggle, see "Editing keys".
 - `/terminal-setup`, `/connect`, `/help`, `/exit` — aliases `/quit`, `/q`.
+- `/kernel` — opens the kernel picker (the current kernel is ticked; every row
+  carries a version and a one-line explanation), on DSH and Claude sessions alike.
+  Picking the other kernel remembers it and restarts into it with a new session;
+  the old session stays in `/resume`, and if the new session fails to start you
+  are back on the old one. A running turn blocks the switch. The launchpad's
+  Kernel entry and its bottom-right kernel block open the same picker. When
+  `--backend` or the config row names a kernel, this restart follows your pick but
+  a later direct launch follows the flag. A fresh launch lands on the launchpad
+  whichever kernel is remembered; a launch with a resume target goes straight
+  into the session.
 
 **Registry**
 
@@ -653,8 +843,24 @@ Additional forms:
   available, it fails loudly instead of sending the input to the model.
 - Exiting plan mode restores the pre-plan atoms first, then the durable preset you were on before plan mode (while the registry still offers it).
 - When the registry service is absent, TUI uses its legacy three-row compatibility roster; a mounted but broken service is unavailable and fails closed.
+- Non-DSH backends (Claude) that declare native permission modes answer
+  `/permission` with that backend's own modes: `default` (ask before each risky
+  action), `acceptEdits` (auto-accept file edits), `plan` (read-only planning),
+  `bypassPermissions` (skip every permission check), plus `auto` where the model
+  supports it, each with a one-line explanation. `bypassPermissions` can only be
+  picked explicitly here; the `Shift+Tab` cycle default → acceptEdits → plan
+  (→ auto) never reaches it. The footer always shows the current mode
+  (`bypassPermissions`/`dontAsk` in the warning colour), except under Minimal UI.
+  A Claude settings file with `defaultMode: bypassPermissions` is downgraded to
+  `default` with a transcript notice, so a cloned repository cannot silently turn
+  every prompt off.
+- The `/permission` pick is saved to `~/.dsh-tui/backends/claude/prefs.json` (the
+  same file as the model and effort picks) and later sessions start on it.
+  Precedence: the `DSH_TUI_CLAUDE_PERMISSION_MODE` environment variable > the
+  remembered pick > Claude settings > `default`. Starting in `bypassPermissions`
+  from the remembered pick is announced in the transcript.
 - `/lang` toggles the interface language (see "Interface language").
-- `/compact` compresses the session history; unavailable under the kernel Minimal agent preset (`minimal`, a single persistent-shell tool) — unrelated to the display-side Minimal UI switch.
+- `/compact` compresses the session history; unavailable under the kernel Minimal agent preset (`minimal`, a single persistent-shell tool), which mounts no compaction and does not prune tool results — a long session can hit the context limit and oversized tool output stays in full (Help and `/` completion mark the entry, and entering the preset says so once) — unrelated to the display-side Minimal UI switch.
 - `/thinking` toggles extended reasoning display; UI state only — **not persisted**.
 - After startup, the TUI checks npm for a newer version in the background and shows a notification when one is available.
 - The check follows the npm registry configuration (`NPM_CONFIG_REGISTRY` or `~/.npmrc`),