@deepseek-harness-tui/dsh-tui 0.13.0 → 0.14.0

package/guide/dsh-tui-guide/interaction.en.md

@@ -6,7 +6,7 @@
 
 | Key | Behavior |
 | --- | --- |
-| `Enter` | Send while idle; steer text into the running turn at its next step boundary; confirm an open menu |
+| `Enter` | Send while idle; run a known `/` command (with or without arguments — while a turn runs its own gate decides); steer the remaining text into the running turn at its next step boundary; confirm an open menu |
 | `Tab` | Complete a `/` command or `@` file; while the model is working, queue non-empty input as a post-turn follow-up |
 | `Ctrl+Enter` | Interrupt the running turn and process the input immediately |
 | `Shift+Enter` / `Ctrl+J` | Insert a newline at the caret; `Ctrl+J` (LF) is the fallback when the terminal cannot report the Shift modifier; macOS Terminal.app uses `Option+Enter` |
@@ -16,11 +16,11 @@
 | `Ctrl+V` / `Alt+V` | Insert clipboard text or files; images are sent as durable attachments. Use `Alt+V` when the terminal intercepts `Ctrl+V` |
 | `Ctrl+G` | Edit the current input in an external editor (`$VISUAL` → `$EDITOR`); saving and quitting fills it back, `:cq`/non-zero exit keeps the draft; with neither variable set the TUI asks you to configure one (no `vi` fallback) |
 | `Ctrl+Shift+E` | Expand the fullscreen draft editor (or click the `⛶` affordance at the end of the input row): line numbers + current-line highlight + live line/char stats<br>`Enter` inserts a newline, `Ctrl+Enter` or the Send button sends, `Esc` or the Collapse button keeps the draft and returns<br>wheel-scrolls freely; click/drag/double-click selection work as in the inline prompt; remappable via `/settings` |
-| `Esc` | Ladder: close help → close the image preview → close the command menu → close the file menu (only the current `@` token)<br>→ **with a selection in the prompt input: only clear it (text untouched)** → interrupt the turn and redeliver pending messages → clear non-empty input → double-tap on empty input = rewind<br>in fullscreen, an active mouse selection is cleared first (not copied) |
+| `Esc` | Ladder: close help → close the image preview → close the command menu → close the file menu (only the current `@` token)<br>→ **with a selection in the prompt input: only clear it (text untouched)** → with the held-queue selector open: only leave the selector → interrupt the turn and hold the queued messages (no automatic re-send, see "Message delivery semantics") → clear non-empty input → double-tap on empty input = rewind<br>in fullscreen, an active mouse selection is cleared first (not copied) |
 | `Ctrl+Z` | Undo the prompt draft's last word-level edit (text, caret and images together). Draft-only: a submit, a history recall (`Ctrl+R`/`↑`) or a session switch ends the history; it is NOT the message/conversation rewind behind `Esc Esc`. Remappable via `/settings` |
 | `Esc` / `Ctrl+C` / `Enter` while an image preview is open | Close the preview and restore the surface underneath; other keys are not passed through |
 | `Left` / `Right` in the image modal | Previous / next image, no wrapping; caret peeks keep arrows with the prompt |
-| `←` (empty input) | Background this session and open the session-management screen (same as `/bg`) |
+| `←` (empty input) | Open the session manager (same as `/bg`); DSH backgrounds the current session first, while Claude/Codex keep it attached |
 | `Ctrl+C` | Interrupt while working; press again while the interrupt is still settling to force-exit<br>clear non-empty idle input; **while idle with a selection in the prompt input, copy it to the clipboard (selection kept for editing)**; press twice on empty input to exit |
 | `Ctrl+D` | Same ladder as `Ctrl+C`: interrupt while working (press again to force-exit if the interrupt stalls); press twice while idle to exit |
 | `Ctrl+O` | Toggle transcript/verbose detail, including full reasoning and tool arguments/output; also the escape hatch for the **long-line fold** (a single line over 1000 chars is clipped to 1000 with a `… N chars folded` marker — see the user guide §5). Clicking the folded row (or the tool card face) toggles it too |
@@ -79,9 +79,11 @@ results back to the chat screen and add no new behavior.
 - **Launchpad**: printable input goes into the input box (the prefix turns from `❯` to `⌘` when the line
   starts with `/`), `Backspace`/`Delete`/`←`/`→`/`Home`/`End` edit it; the caret is an **inverse block
   sitting on the current character** (inverse on that one character; an inverse blank cell at end of
-  line), blinking is a pure style toggle (inverse ↔ regular, ~550ms per phase) and never occupies an
-  extra cell or eats a character; `Alt+R` continues the most recent session (= the first entry row slot,
-  bound only on this screen, no-op when there is nothing to continue, remappable in `/settings`);
+  line — a theme that declares the `cursor` key paints a solid fill with a contrasting glyph instead,
+  see [Themes](themes.en.md)), blinking is a pure style toggle (inverse ↔ regular, ~550ms per phase)
+  and never occupies an extra cell or eats a character; `Alt+R` continues the most recent session
+  (= the first entry row slot, bound only on this screen, no-op when there is nothing to continue,
+  remappable in `/settings`);
   a leading `/` opens the
   **command palette** (the same data source and component as the chat composer: `↑`/`↓` move the selection,
   `Enter`/`Tab`/click **run** the selected command, `Esc` dismisses only the palette and keeps the draft);
@@ -98,9 +100,18 @@ results back to the chat screen and add no new behavior.
   (`Esc` closes it back onto the launchpad), the picked value updates the row in place and the typed draft
   is untouched; clicking inside the picker selects, **clicking elsewhere closes it and clicking another
   segment switches to that picker**.
-- **Entry row (v7, four slots)**: `Continue "…"` (Alt+R; the slot is absent when there is nothing to
-  continue) · `Sessions & workspaces` (`/home` — history and workspaces merged into one entry) ·
-  `Settings` (`/settings`) · a **conditional slot** (priority: background jobs running → `Background
+ All four segments **stay on the row**: they are drawn verbatim
+  when they fit; when they do not, only the **over-long segments** are truncated at the tail with a
+  trailing `…` (the permission segment is **never truncated**), and hovering a truncated segment
+  shows its **full name** in a card after ~600ms (mouse tracking is always on for the launchpad
+  screen, inline mode included); only when the **full permission name does not fit the budget** —
+  widening the terminal past 76 columns changes nothing, while a narrower terminal or a longer
+  permission name triggers it earlier — does the row fall back to dropping **whole segments from
+  the tail** (permission → mode → effort → model), which also drops them from the focus ring.
+- **Entry row**: `Continue "…"` (Alt+R; the slot is absent when
+  there is nothing to continue) · `Sessions & workspaces` (`/home` — history and workspaces merged into
+  one entry) · `Settings` (`/settings`) · `Kernel · <current kernel>` (`/kernel`, opens the kernel
+  picker, see the commands section) · a **conditional slot** (priority: background jobs running → `Background
   jobs`; update detected → `Update available`; usage milestone reached and never starred → `Feed us a
   star`; fallback `Help`). Full screens opened from the launchpad (sessions & workspaces / settings /
   background jobs / the family tree / the wizard) render **above the launchpad** — `Esc` closes them
@@ -110,15 +121,18 @@ results back to the chat screen and add no new behavior.
   glyphs never bleed through), yet no background color is emitted (no white block; Kitty splash
   art still shows through the terminal-default cells; the chat page's pickers are unaffected).
 - **Tips line**: click to rotate (three tips cycle; the first-run tip has top priority and never rotates);
-  keyboard path = focus ring + `Enter`; as of v7 it also **auto-rotates** (~10s per tip; a manual
+  keyboard path = focus ring + `Enter`; it also **auto-rotates** (~10s per tip; a manual
   rotate resets the timer) — the switch changes only the text, never the row height or centering.
-- **Corner plates (v7)**: the bottom-left working directory is **clickable** — it opens the existing
+- **Corner plates**: the bottom-left working directory is **clickable** — it opens the existing
   `/workspace` menu (rendered above the launchpad; `Esc` returns to the launchpad), keyboard path =
-  the focus ring's last slot + `Enter`, hover/focus = text highlight; the bottom-right plate shows
-  **two versions stacked vertically**: `dsh-tui v<TUI>` on the first row, `dsh-core v<kernel>` on
-  the second (the kernel version is read from the host/kernel package manifests; only the TUI row
-  is drawn when neither resolves), both right-aligned with the cwd plate top-aligned to the first
-  row, truncated per the existing truncate-middle contract on narrow terminals.
+  the focus ring's last slot + `Enter`, hover/focus = text highlight; the bottom-right plate starts
+  with `dsh-tui v<TUI>`, followed by one row for each of the two kernels:
+  `▸ DSH · dsh-core v<kernel>` / `Claude · claude-code v<CLI>`. `▸` marks the current kernel and the
+  other row stays dim; an unavailable kernel adds the reason after its version (such as *Not installed*
+  or *Not signed in*), a row whose version cannot be read shows just the name, and *Checking…* shows
+  while the probe runs. The whole block is clickable and opens the same kernel picker (keyboard path =
+  focus ring + `Enter`). Rows are right-aligned, the cwd plate is top-aligned to the first row, and
+  narrow terminals truncate per the existing truncate-middle contract.
 - **Wizard**: `←`/`→` change step (except the effort slider in step 3 and a drilled-in model list, where the
   horizontal keys belong to the child control), `Tab` switches between the language/theme and
   model/effort/workspace panes, `↑`/`↓` move the selection; `Enter` runs the step (step 1 = re-check
@@ -127,9 +141,10 @@ results back to the chat screen and add no new behavior.
   **language pane applies on `Enter`**; `Enter` on the last step finishes and records the guide when the
   focused card is a shortcut card, and tries the command when it is a command card; `Esc` skips
   (**not recorded**, asked again next launch).
-- **Mouse** (fullscreen): the launchpad's quick actions (hover = the label turns accent-blue and bold,
-  leaving restores the dim look), param segments, command palette, Tips line, the wizard's "Try it" cards
-  and the workspace picker are clickable, and a click lands on the same command path as the keyboard.
+- **Mouse** (mouse tracking is always on for this screen): the launchpad's quick actions (hover = the
+  label turns accent-blue and bold, leaving restores the dim look), param segments, command palette,
+  Tips line, the wizard's "Try it" cards and the workspace picker are clickable, and a click lands on
+  the same command path as the keyboard.
 
 ## Editing keys
 
@@ -179,7 +194,8 @@ text and newlines, and is never mistaken for an Enter key. To keep rendering, cl
 mapping, and selection geometry consistent:
 
 - Terminal ANSI controls are stripped on entry.
-- A multi-line paste no longer leaves a stray `_`: when a Windows terminal delivers the paste as win32-input-mode records, the residue (`ESC[Vk;Sc;Uc;Kd;Cs;Rc_`, or the ESC-less tail left by a split record) is stripped whole on entry. Only the five-separator record grammar matches, so genuine underscores and bracket text that merely resembles a record are untouched.
+- A multi-line paste no longer leaves a stray `_`, and no longer drops characters: when a Windows terminal delivers the paste as win32-input-mode records, the key records that leak into the payload (`ESC[Vk;Sc;Uc;Kd;Cs;Rc_`, or the ESC-less tail left by a split record) are decoded back into the characters their `Uc` field encodes — newlines included, through the same CR+LF fold — which is why the chip's line count equals the paste's real line count. **The decode needs evidence**: only a *transition pair* (the same `Uc` pressed and released) is decoded back into characters; a **lone** record — with no pair to prove it is a record stream rather than literal text in the payload — is still stripped whole as a protocol token and its `Uc` is **not** restored, as are records with no character meaning (a `Uc=0` synthesized record, a key record with no text). The promise is therefore "no character is dropped silently **once the bytes are proven to be a record stream**", not "every record shape is decoded back".
+- Both stripping and decoding need evidence: complete records are consumed before ESC-less tails (so a record is never sliced open and its orphan ESC never eats the payload character behind it), and a tail must stand alone as its own token — a record-shaped run welded into the payload's own word is kept byte-for-byte (visible residue beats silent loss). Only the five-separator record grammar matches, so genuine underscores and bracket text that merely resembles a record are untouched.
 - Pasted CRLF collapses: a CR+LF pair produces one newline instead of two; LF-only and lone CR keep their previous behavior.
 - Tabs are expanded to spaces on entry.
 
@@ -278,13 +294,33 @@ While the model is working, three paths have different placement:
 
 | Action | Placement |
 | --- | --- |
-| `Enter` | Steer: deliver to the running turn at its next step boundary |
+| `Enter` | known `/` command (with or without arguments) → run it, its own gate decides; anything else → steer: deliver to the running turn at its next step boundary |
 | `Tab` | Follow-up: wait until the current turn finishes |
 | `Ctrl+Enter` | Interrupt: stop the turn and deliver immediately |
 
+**While a turn is running, a command is always a command; only two kinds of input steer: plain text that is not a command, and a direct skill gesture (`/skill-name …`).** The completion overlay groups commands by their impact on the current conversation: the harmless ones stay on top in their normal style, while gated, interrupting, replacing or steering commands sink to the bottom in the theme's grey (`subtle`, no header row) — where they stay selectable.
+
 - Undelivered messages appear above the editor.
 - `Alt/Option+Up` retrieves the latest one.
-- Pressing `Esc` while pending messages exist interrupts and redelivers them immediately.
+- Pressing `Esc` while the model works interrupts the turn and holds the queued
+  messages above the input instead of re-sending them; the hint row reads
+  `Press ↑ to edit queued messages, ⏎ to send now`. DSH and Claude behave the same.
+  - With messages held and idle, `↑` on an empty input opens the queued-message
+    selector: `↑`/`↓` move, `⏎` takes the selected message back into the input
+    for editing, `Esc` leaves the selector. You can also click a held message
+    (takes it back for editing; with a draft in the input the two swap, and
+    `Ctrl+Z` swaps them back) or click the hint row (sends everything).
+  - `⏎` on an empty input sends all held messages in order, exactly once; with a
+    draft in the input `⏎` sends only the draft and the held messages stay, so
+    they are never bundled with it.
+  - `Ctrl+Enter` (with a draft) interrupts the turn and sends the held messages together
+    with the draft right away.
+  - When a turn ends normally, queued messages still flow into the next turn;
+    `Ctrl+C` keeps the queue.
+  - Only messages the backend confirmed as withdrawn are held. With an older
+    Claude CLI that cannot withdraw them, or when the withdrawal request fails,
+    the backend still runs them next turn; dsh-TUI stops holding them, says so,
+    and never sends them twice.
 
 ## Session workflows
 
@@ -384,9 +420,10 @@ On Windows, `dsh-tui.cmd --resume` uses the session ID last written to `~/.dsh-t
 
 ### Background sessions
 
-`/bg` (alias `/background`) moves the current session to the background and keeps it
+On DSH, `/bg` (alias `/background`) moves the current session to the background and keeps it
 running, switches the terminal to a fresh session, and opens the session-management screen;
-`←` on an empty prompt does the same.
+`←` on an empty prompt does the same. On Claude/Codex, both entries open the session manager
+without backgrounding the attached session.
 
 - While a background session waits on you, the prompt footer shows `← N agents`.
 - A background session awaiting approval shows as **needs input**, and the approval panel labels which session it comes from.
@@ -462,6 +499,79 @@ A full-screen scene (no scrollback pollution) over the whole session timeline:
 
 See [Configuration](configuration.en.md#agent-presets).
 
+### Channel profiles (/channel, Claude only)
+
+Relay channels often route a request to a different model while keeping a Claude
+tier name (such as Opus 5.5 (1M)). A channel profile records each channel's model
+mappings and connection, in `~/.dsh-tui/backends/claude/channels.json`:
+
+```json
+{
+  "active": "zhipu",
+  "channels": [
+    {
+      "id": "zhipu",
+      "name": "Zhipu",
+      "baseUrl": "https://open.bigmodel.cn/api/anthropic",
+      "tokenRef": "CHANNEL_ZHIPU_TOKEN",
+      "models": { "claude-opus-5-5[1m]": "glm-5.3[1M]" },
+      "tiers": { "opus": "glm-5.3[1M]", "haiku": "glm-5.3-flash" }
+    }
+  ]
+}
+```
+
+- `models` is an exact map: exact match first, then a match that strips the `[1m]`
+  suffix and ignores case. `tiers` matches tier keywords (`haiku`/`opus`/`sonnet`/
+  `fable`); the reserved `default` matches every other model (like
+  `ANTHROPIC_MODEL`). Both fields are optional.
+- The `id` is derived from `name` (lowercase, non-alphanumerics folded into `-`);
+  importing again updates the channel with the same id.
+- The model name shown is taken in this order: the active channel's `models` > its
+  `tiers` > the legacy `model-names.json` > the tier variables in the Claude
+  settings `env` > the raw id. Without an active channel it is as if the file did
+  not exist.
+- `baseUrl`, `tokenRef` and a channel-private `env` are the connection; all are
+  optional. The active channel decides where the session connects and outranks the
+  dsh-auth subscription sign-in. The token is stored in `~/.dsh/.credentials.yaml`
+  (0600, the same credential store `/provider` uses, referenced as
+  `CHANNEL_<ID>_TOKEN` by default); `channels.json` keeps only the reference, never
+  the token.
+- The connection reaches the CLI twice: in the child environment and through the
+  SDK `settings` option (the CLI's `--settings` layer, which outranks the `env` of
+  `~/.claude/settings.json`, so values a tool such as cc-switch wrote there cannot
+  override the channel). `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN` issued for a
+  different endpoint are never carried to the new host.
+
+`/channel` opens the picker, in this order:
+
+- The channels (the active one ticked, the sub-row shows the mapping counts).
+  `Enter` switches the active channel. Between channels with the same connection
+  the switch is in place and the footer and `/model` names refresh at once; a
+  different connection restarts into a new session (a running CLI cannot change
+  its connection).
+- *Import from settings.json*: names the channel after the `ANTHROPIC_BASE_URL`
+  host, takes `ANTHROPIC_DEFAULT_{HAIKU,OPUS,SONNET,FABLE}_MODEL` and
+  `ANTHROPIC_MODEL` as `tiers` (exact `models` are never guessed), and takes the
+  `baseUrl` and `ANTHROPIC_AUTH_TOKEN` too (the token goes to the credential store
+  as above). Importing again updates the same-id channel and keeps hand-written
+  `models`.
+- *Add a channel* and *Manage channels*: open the same question panel `/provider`
+  uses. Adding asks for the name, base URL, token (input hidden), mapping source
+  (take the tiers from the settings or skip) and whether to switch now; managing
+  edits the base URL or token, refreshes the mappings from the settings, or deletes
+  the channel along with its stored token.
+- *View mappings*: prints the active channel's `models` and `tiers` as a local
+  transcript block. To edit single entries, edit `channels.json`; the display
+  follows the order above live.
+
+A corrupt file reads as empty, a failed write only reaches the debug log, and
+writes go through a same-directory temporary file and an atomic rename. dsh-tui
+never edits `~/.claude/settings.json`; when its `ANTHROPIC_BASE_URL` or credentials
+conflict with the active channel, the session start shows one notice that this
+session connects per the channel profile. The command appears only in Claude
+sessions.
+
 ### Workspaces
 
 - `/workspace resume` opens the workspace picker.
@@ -627,10 +737,15 @@ owns the keyboard (when a questionnaire is also pending, approval takes priority
 
 The protocol offers only "allow once / deny" — there is **no "always allow"**.
 
+On the Claude backend the approval comes from the CLI: it adds *allow always*
+when the CLI suggests a rule, and with the focus on the reject row you can type a
+reason; see [Claude backend](claude-backend.en.md#approvals-and-questions).
+
 ## Slash commands
 
 The command menu merges local commands with the DSH command registry. Type `/` to inspect the complete surface available in the current composition.
 
+- **While a turn is running**, the overlay groups commands by their impact on the current conversation: the harmless ones stay on top in their normal style, while gated, interrupting, replacing or steering commands sink to the bottom in the theme's grey (`subtle`, no header row) — and stay selectable there.
 - Command descriptions follow the UI language (`/lang`).
 - Built-in commands and mapped registry commands (`/plan`, `/goal`, `/feedback`) show Chinese translations in zh.
 - Unmapped registry commands fall back to the registry's own text.
@@ -638,7 +753,7 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 **Sessions**
 
 - `/new`, `/resume`, `/home`, `/agentview` — all three open the same session-management screen.
-- `/bg` — alias `/background`, backgrounds the session and opens that screen.
+- `/bg` — alias `/background`, opens the session manager; DSH backgrounds the session first, while Claude/Codex keep it attached.
 - `/rename`.
 - `/recap` — session recap: apply the suggested title in one key; `/settings` can enable an
   auto-summary on session open, on by default — a divider + `Recap:` line appears at the
@@ -659,8 +774,9 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 
 **Model and display**
 
-- `/model`, `/effort`, `/thinking`, `/tokens`, `/activity`, `/preset`, `/theme`, `/color` —
-  session accent color: bare opens the palette picker, `<name>` sets directly, `status`/`reset`;
+- `/model`, `/effort`, `/thinking`, `/tokens`, `/activity`, `/preset`, `/theme`.
+- `/channel` — the channel-profile picker (Claude backend only; see the Channel profiles section).
+- `/color` — session accent color: bare opens the palette picker, `<name>` sets directly, `status`/`reset`;
   input border + session-name chip at the top-right, per-session; chip off by default, enable
   in `/settings`.
 - `/panel` — side panel: toggle / focus / zoom / switch panels (subcommands in the user guide §2.8).
@@ -679,6 +795,16 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 
 - `/update`, `/vim` — vim editing mode toggle, see "Editing keys".
 - `/terminal-setup`, `/connect`, `/help`, `/exit` — aliases `/quit`, `/q`.
+- `/kernel` — opens the kernel picker (the current kernel is ticked; every row
+  carries a version and a one-line explanation), on DSH and Claude sessions alike.
+  Picking the other kernel remembers it and restarts into it with a new session;
+  the old session stays in `/resume`, and if the new session fails to start you
+  are back on the old one. A running turn blocks the switch. The launchpad's
+  Kernel entry and its bottom-right kernel block open the same picker. When
+  `--backend` or the config row names a kernel, this restart follows your pick but
+  a later direct launch follows the flag. A fresh launch lands on the launchpad
+  whichever kernel is remembered; a launch with a resume target goes straight
+  into the session.
 
 **Registry**
 
@@ -717,6 +843,22 @@ Additional forms:
   available, it fails loudly instead of sending the input to the model.
 - Exiting plan mode restores the pre-plan atoms first, then the durable preset you were on before plan mode (while the registry still offers it).
 - When the registry service is absent, TUI uses its legacy three-row compatibility roster; a mounted but broken service is unavailable and fails closed.
+- Non-DSH backends (Claude) that declare native permission modes answer
+  `/permission` with that backend's own modes: `default` (ask before each risky
+  action), `acceptEdits` (auto-accept file edits), `plan` (read-only planning),
+  `bypassPermissions` (skip every permission check), plus `auto` where the model
+  supports it, each with a one-line explanation. `bypassPermissions` can only be
+  picked explicitly here; the `Shift+Tab` cycle default → acceptEdits → plan
+  (→ auto) never reaches it. The footer always shows the current mode
+  (`bypassPermissions`/`dontAsk` in the warning colour), except under Minimal UI.
+  A Claude settings file with `defaultMode: bypassPermissions` is downgraded to
+  `default` with a transcript notice, so a cloned repository cannot silently turn
+  every prompt off.
+- The `/permission` pick is saved to `~/.dsh-tui/backends/claude/prefs.json` (the
+  same file as the model and effort picks) and later sessions start on it.
+  Precedence: the `DSH_TUI_CLAUDE_PERMISSION_MODE` environment variable > the
+  remembered pick > Claude settings > `default`. Starting in `bypassPermissions`
+  from the remembered pick is announced in the transcript.
 - `/lang` toggles the interface language (see "Interface language").
 - `/compact` compresses the session history; unavailable under the kernel Minimal agent preset (`minimal`, a single persistent-shell tool), which mounts no compaction and does not prune tool results — a long session can hit the context limit and oversized tool output stays in full (Help and `/` completion mark the entry, and entering the preset says so once) — unrelated to the display-side Minimal UI switch.
 - `/thinking` toggles extended reasoning display; UI state only — **not persisted**.

package/guide/dsh-tui-guide/interaction.md

@@ -6,7 +6,7 @@
 
 | 按键 | 行为 |
 | --- | --- |
-| `Enter` | 空闲时发送；模型工作时把文本 steer 到当前回合的下一步边界；菜单打开时确认选项 |
+| `Enter` | 空闲时发送；输入构成已知 `/` 命令时执行该命令（可带参数，回合运行中由该命令自己的门禁裁决）；模型工作时把其余文本 steer 到当前回合的下一步边界；菜单打开时确认选项 |
 | `Tab` | 补全 `/` 命令或 `@` 文件；模型工作且输入非空时排入当前回合之后的 follow-up |
 | `Ctrl+Enter` | 打断当前回合并立即处理输入消息 |
 | `Shift+Enter` / `Ctrl+J` | 在光标处插入换行；终端无法上报 Shift 修饰键时可用 `Ctrl+J`（LF）兜底，macOS Terminal.app 用 `Option+Enter` |
@@ -17,9 +17,10 @@
 | `Ctrl+G` | 用外部编辑器（`$VISUAL` → `$EDITOR`）编辑当前输入，保存退出后回填；`:cq` 或非零退出保留原稿；未设置变量时提示配置，无 `vi` 兜底 |
 | `Ctrl+Shift+E` | 展开全屏草稿编辑器（也可点输入行尾 `⛶`）：行号 + 当前行高亮 + 行/字统计，`Enter` 换行、`Ctrl+Enter` 或「发送」按钮发送、`Esc` 或「收起」按钮收起（草稿保留）；滚轮自由滚动、点击定位/拖选/双击选词与输入框一致；可经 `/settings` 重映射 |
 | `Ctrl+Z` | 撤销输入框草稿的上一步「词级」编辑（文本、光标、图片一起回退）。只作用于草稿：提交、历史召回（`Ctrl+R`/`↑`）或换会话后即结束；`Esc Esc` 的会话/消息回溯与它不是一回事。可经 `/settings` 重映射 |
-| `Esc` | 层级：关帮助 → 关图片预览 → 关命令菜单 → 关文件菜单（仅当前 `@` token）→ **输入框内有选区时仅清选区（文本不动）** → 中断回合并重投 pending 消息 → 有输入时清空 → 空输入连续两次 = 时间回溯 rewind；fullscreen 下有鼠标选区时优先取消选区（不复制） |
+| `Esc` | 层级：关帮助 → 关图片预览 → 关命令菜单 → 关文件菜单（仅当前 `@` token）→ **输入框内有选区时仅清选区（文本不动）** → 排队选择器开着时仅退出选择器 → 中断回合并暂存排队消息（不自动重发，见「消息投递语义」）→ 有输入时清空 → 空输入连续两次 = 时间回溯 rewind；fullscreen 下有鼠标选区时优先取消选区（不复制） |
 | 图片预览打开时 `Esc` / `Ctrl+C` / `Enter` | 关闭预览，恢复下层界面；其余按键不透传 |
 | 图片弹窗中的 `←` / `→` | 上一张 / 下一张；首尾不循环，临时光标预览不抢输入框方向键 |
+| `←`（输入框为空） | 打开会话管理界面；DSH 内核会先把当前会话转入后台，Claude/Codex 内核保持当前会话运行 |
 | `Ctrl+C` | 工作时中断；中断迟迟不收敛时再按一次强制退出；空闲且有输入时清空；**空闲且输入框内有选区时复制选区到剪贴板（保留选区继续编辑）**；空输入时连续两次退出 |
 | `Ctrl+D` | 与 `Ctrl+C` 同阶梯：工作中=中断（未收敛时再按=强制退出）；空闲时连续两次退出 |
 | `Ctrl+O` | 切换 transcript/verbose 详情，展开思考与完整工具参数/输出；也是**超长单行折叠**（单行 > 1000 字符裁到 1000 + `… 已折叠 N 字符` 标记，见 user guide §5）的展开逃生门——鼠标点被折叠的那一行（或工具卡卡面）同样能展开/收起 |
@@ -74,7 +75,8 @@
 
 - **落地页**：可打印字符接进输入框（行首 `/` 时前缀由 `❯` 变 `⌘`），`Backspace`/`Delete`/`←`/`→`/`Home`/`End` 编辑；
 - **落地页**：可打印字符接进输入框（行首 `/` 时前缀由 `❯` 变 `⌘`），`Backspace`/`Delete`/`←`/`→`/`Home`/`End` 编辑；
-  输入光标是**压在当前字符身上的反显块**（对那一个字符 inverse，行尾是反显空格），闪烁是纯样式切换
+  输入光标是**压在当前字符身上的反显块**（对那一个字符 inverse，行尾是反显空格；主题声明了 `cursor`
+  键时改用该填充色的实色块配对比字形，见[主题系统](themes.md)），闪烁是纯样式切换
   （inverse ↔ 常规，约 550ms 一相位），绝不另起一格、绝不吃掉字符；`Alt+R` 继续最近一条会话
   （= 入口行第一格「继续「…」」，仅此屏生效，无可继续会话时无动作，键位可在 `/settings` 改）；
   **执行**选中命令，`Esc` 只收面板、草稿不动）；面板没收时 `Enter` 直接**发送**这一行（行首 `/` 的命令——含
@@ -86,9 +88,13 @@
   的显示名——Standard/PTC/极简…）：四段**各自可点**，点开的就是对话页同一套选择器
   （`/model` · `/effort` · `/preset` · `/permission`），选择器**盖在落地页之上**、吃走键盘
   （`Esc` 关掉它回到落地页），选中的值就地更新参数行、已输入的草稿不动；选择器开着时点它内部是选择，
-  **点别处会关掉它、点另一段会直接切换**成那个选择器。
-- **入口行（第七版四格）**：`继续「…」`（Alt+R；无可继续会话时整格不画）· `会话与工作区`（`/home`，
-  历史会话与工作区合并成一个入口）· `设置`（`/settings`）· **条件位**（优先级：有后台任务在跑 →
+  **点别处会关掉它、点另一段会直接切换**成那个选择器。四段**常在**：这一行装得下就原样画；
+  装不下时只把**超长的段**按显示宽度截尾成 `前缀…`（权限段**不被截断**），悬停被截断的段约 600ms
+  弹出卡片显示**完整名**（落地页这一屏恒启用鼠标跟踪，inline 模式下也是）；其余各段压到下限后
+  **完整权限名放不进预算**时（终端 ≥76 列后，再宽也不改变结果；更窄的终端或更长的权限名都会更早触发）
+  才回落到按显示顺序**从尾部整段省掉**（权限 → 模式 → 思考深度 → 模型），省掉的段同时退出焦点环。
+- **入口行**：`继续「…」`（Alt+R；无可继续会话时整格不画）· `会话与工作区`（`/home`，
+  历史会话与工作区合并成一个入口）· `设置`（`/settings`）· `内核 · <当前内核>`（`/kernel`，打开内核选择器，见「命令」一节）· **条件位**（优先级：有后台任务在跑 →
   `后台任务`；检测到新版本 → `有新版本`；用量到档且从未 star → `投喂一颗 Star`；兜底 `帮助`）。
   从落地页打开的整屏界面（会话与工作区 / 设置 / 后台任务 / 家谱 / 引导向导）都**盖在落地页之上**，
   `Esc` 退出回到落地页（草稿/参数/焦点原样保留）；**离开落地页进对话页的唯一方式是回车提交一条
@@ -96,19 +102,22 @@
   遮掉宿主屏的字形（绝不重影）、不发背景色（无白底；Kitty 立绘图像仍从终端默认背景透出；
   聊天页同款选择器不受影响）。
 - **Tips 行**：可点击轮换（三条 Tips 循环；首启那一句优先级最高、不参与轮换），键盘路径 = 焦点环 + `Enter`；
-  第七版起还**自动轮换**（约 10s 一换，手动切换后计时重置），切换只改文本、行高与居中位置不变。
-- **双角铭牌（第七版）**：左下角工作目录**可点**——点开既有的 `/workspace` 菜单
+  还会**自动轮换**（约 10s 一换，手动切换后计时重置），切换只改文本、行高与居中位置不变。
+- **双角铭牌**：左下角工作目录**可点**——点开既有的 `/workspace` 菜单
   （盖在落地页之上、`Esc` 回落地页），键盘路径 = 焦点环末格 + `Enter`，悬停/焦点 =
-  文字高亮；右下角是**双版本竖排两行**：第一行 `dsh-tui v<TUI>`、第二行
-  `dsh-core v<内核>`（内核版本读宿主/内核线包的 manifest，读不到只画 TUI 一行），
-  两行都右对齐、左下目录铭牌与第一行顶对齐，窄屏按既有 truncate-middle 截断。
+  文字高亮；右下角第一行是 `dsh-tui v<TUI>`，其下两个内核各占一行：
+  `▸ DSH · dsh-core v<内核>` / `Claude · claude-code v<CLI>`。`▸` 标出当前内核，其余行暗色；
+  不可用的内核在版本后写原因（如「未安装」「未登录」），读不到版本时只写名字，检测期间显示
+  「检测中…」。整块可点，打开同一个内核选择器（键盘路径 = 焦点环 + `Enter`）。
+  各行右对齐，左下目录铭牌与第一行顶对齐，窄屏按既有 truncate-middle 截断。
 - **引导向导**：`←`/`→` 换步骤（例外：第三步的强度区、以及已钻进去的模型列表，横向键归子控件，不换步骤）、
   `Tab` 在「语言 / 主题」与「模型 / 强度 / 工作区」两组面板间切、`↑`/`↓` 移动选择；
   `Enter` 执行这一步（第一步 = 重新检查连通性，第三步 = 钻进 provider / 换模型 / 打开工作区选择器——**强度不走 Enter**，只用 `←`/`→` 调且移动即生效）；
   主题面板移动光标即预览，**语言面板要 `Enter` 才生效**；最后一步的 `Enter` 在**键位卡**上「完成」并记账，
   在命令卡上则是「试一下」；`Esc` 跳过（**不记账**，下次启动再问）。
-- **鼠标**（fullscreen）：落地页的快捷入口（悬停 = 文字变主题蓝加粗，移开复原）、参数行四段、命令补全面板、
-  Tips 行、引导招式卡的「试一下」与工作区选择器都可点，点击与键盘落到同一条命令路径。
+- **鼠标**（落地页这一屏恒启用鼠标跟踪）：落地页的快捷入口（悬停 = 文字变主题蓝加粗，移开复原）、
+  参数行四段、命令补全面板、Tips 行、引导招式卡的「试一下」与工作区选择器都可点，
+  点击与键盘落到同一条命令路径。
 
 ## 输入编辑
 
@@ -157,7 +166,8 @@ Bracketed paste（右键或终端原生粘贴）保留普通文本与换行。
 
 - 不会把粘贴内容误当成 `Enter` 提交。
 - 为保显示、点击与选区几何一致，剥离终端 ANSI 控制序列。
-- 多行粘贴不再留下 `_`：Windows 终端以 win32-input-mode 逐条记录投递时，残留的键记录（`ESC[Vk;Sc;Uc;Kd;Cs;Rc_` 完整形态，或记录拆散后无 ESC 的尾部）在入口整体剥离；只匹配 5 段分号的记录语法，普通文本里的真实 `_` 与形似记录的方括号文本不受影响。
+- 多行粘贴不再留下 `_`，也不再丢字符：Windows 终端以 win32-input-mode 逐条记录投递时，泄漏进载荷的键记录（`ESC[Vk;Sc;Uc;Kd;Cs;Rc_` 完整形态，或记录拆散后无 ESC 的尾部）按 `Uc` 字段**还原成它编码的字符**（含换行，走同一条 CR+LF 折叠规则），所以 chip 报出的行数等于粘贴内容的真实行数。**还原要有证据**：只有构成**成对转移**（同一 `Uc` 的按下+抬起）的记录才还原成字符；**单条**记录（拿不到成对证据、无法与载荷里的字面文本区分）仍按协议记号整体剥离，它的 `Uc` **不还原**；没有字符语义的记录（`Uc=0` 的合成记录、无文本的按键记录）同样整体剥离。本屏的承诺因此是「**在能证明这些字节是记录流时**不静默删除字符」，而不是"任何记录形状都还原成字符"。
+- 剥离与还原都要证据：完整记录先于尾部剥离（不会把一条记录从中间切开、留下孤立 ESC 再连带吃掉紧随的一个载荷字符）；无 ESC 的尾部必须自成记号，焊在载荷自身词内的记录形态逐字节保留（宁可见残留）。只匹配 5 段分号的记录语法，普通文本里的真实 `_` 与形似记录的方括号文本不受影响。
 - CRLF 折叠：粘贴内容里的 CR+LF 只产生一个换行，不再多出空行；LF-only 与单独 CR 行为不变。
 - `Tab` 进入编辑缓冲区时展开为空格。
 
@@ -284,14 +294,26 @@ Bracketed paste（右键或终端原生粘贴）保留普通文本与换行。
 
 | 操作 | 放置位置 |
 | --- | --- |
-| `Enter` | steer：送入正在运行的回合，在下一步边界被 Agent 领取 |
+| `Enter` | 输入构成已知 `/` 命令（可带参数）→ 按命令执行，由该命令自己的门禁裁决；其余文本 → steer：送入正在运行的回合，在下一步边界被 Agent 领取 |
 | `Tab` | follow-up：等待当前回合结束后再处理 |
 | `Ctrl+Enter` | interrupt：中断当前回合并立即投递 |
 
+**回合运行中，命令永远是命令；只有两类输入才 steer：不构成命令的普通文本，以及直接调用技能的手势（`/技能名 …`）。** 补全浮窗据此把命令按对当前对话的影响分区：不影响的在上（原样式），会被门禁拦下 / 会打断或替换对话 / 会 steer 的沉到下方、整行变灰（`subtle`，不插标题行），灰区命令仍可选中执行。
+
 输入框上方会显示尚未领取的消息。
 
 - `Alt/Option+Up` 取回最后一条。
-- 模型工作时按 `Esc` 会中断，并立即重投当前 pending 消息。
+- 模型工作时按 `Esc` 会中断回合，排队消息暂存在输入框上方，不自动重发；提示行显示
+  `按 ↑ 编辑排队消息，⏎ 立即发送`。DSH 与 Claude 后端行为相同。
+  - 有暂存消息且空闲时，在空输入框按 `↑` 打开排队消息选择器：`↑`/`↓` 移动，`⏎` 把选中的消息
+    取回输入框编辑，`Esc` 退出选择器。也可以直接点暂存的消息（取回编辑；输入框里已有草稿
+    时两者互换，`Ctrl+Z` 换回）或点提示行（全部发送）。
+  - 空输入框按 `⏎` 按顺序发送全部暂存消息，只发一次；输入框有草稿时 `⏎` 只发送草稿，暂存的
+    消息继续暂存，不会和草稿合并发出。
+  - `Ctrl+Enter`（有草稿时）中断当前回合，连同暂存消息一起立即发送。
+  - 回合正常结束时，排队消息照常进入下一回合；`Ctrl+C` 中断时保留队列。
+  - 只有后端确认已撤回的消息才会暂存。旧版 Claude CLI 不支持撤回，或撤回请求失败时，这些
+    消息仍由后端在下一回合执行，dsh-TUI 不再暂存它们并给出提示，不会重复发送。
 
 ## 会话工作流
 
@@ -492,6 +514,60 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 - 已经开始的会话会把选择保存为下一次 `/new` 或启动时的默认值。
 - 详细规则见[配置参考](configuration.md#agent-preset)。
 
+### 渠道档案（/channel，仅 Claude）
+
+中转渠道常把请求路由到别的模型，却沿用 Claude 的档位名（例如 Opus 5.5 (1M)）。渠道档案
+记录每个渠道的模型映射和连接方式，存在 `~/.dsh-tui/backends/claude/channels.json`：
+
+```json
+{
+  "active": "zhipu",
+  "channels": [
+    {
+      "id": "zhipu",
+      "name": "智谱",
+      "baseUrl": "https://open.bigmodel.cn/api/anthropic",
+      "tokenRef": "CHANNEL_ZHIPU_TOKEN",
+      "models": { "claude-opus-5-5[1m]": "glm-5.3[1M]" },
+      "tiers": { "opus": "glm-5.3[1M]", "haiku": "glm-5.3-flash" }
+    }
+  ]
+}
+```
+
+- `models` 是精确映射：先精确匹配，再去掉 `[1m]` 后缀、忽略大小写匹配。`tiers` 按档位关键字
+  （`haiku`/`opus`/`sonnet`/`fable`）匹配，保留字 `default` 匹配其余所有模型（对应
+  `ANTHROPIC_MODEL`）。两个字段都可省略。
+- `id` 由 `name` 生成（小写，非字母数字折叠成 `-`）；重复导入会更新同 id 的渠道。
+- 显示的模型名按以下顺序取：激活渠道的 `models` > 激活渠道的 `tiers` > 旧的
+  `model-names.json` > Claude 设置 `env` 里的档位变量 > 原始 id。没有激活渠道时与没有这个
+  文件一样。
+- `baseUrl`、`tokenRef` 与渠道私有的 `env` 是连接信息，都可省略。激活的渠道决定本会话连到
+  哪里，并优先于 dsh-auth 订阅登录。令牌存在 `~/.dsh/.credentials.yaml`（0600，与 `/provider`
+  的密钥同一个凭据库，引用名默认 `CHANNEL_<ID>_TOKEN`），`channels.json` 只存引用，不存明文。
+- 连接经两处下发给 CLI：子进程环境，以及 SDK 的 `settings` 选项（CLI 的 `--settings` 层，
+  优先级高于 `~/.claude/settings.json` 的 `env`，所以 cc-switch 之类工具写进设置文件的值
+  不会盖过渠道）。环境里为其他端点签发的 `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN` 不会
+  带到新主机。
+
+`/channel` 打开选择器，依次是：
+
+- 各渠道（当前渠道打勾，副行是映射条数）。`Enter` 切换激活渠道。连接信息相同的渠道之间就地
+  切换，页脚和 `/model` 的模型名立即刷新；连接不同则重启进入新会话（运行中的 CLI 换不了连接）。
+- 「从 settings.json 导入」：用 `ANTHROPIC_BASE_URL` 的主机名作渠道名，把
+  `ANTHROPIC_DEFAULT_{HAIKU,OPUS,SONNET,FABLE}_MODEL` 与 `ANTHROPIC_MODEL` 收进 `tiers`
+  （不猜 `models`），同时收下 `baseUrl` 和 `ANTHROPIC_AUTH_TOKEN`（按上面的规则入凭据库）。
+  重复导入更新同 id 的渠道，手写的 `models` 保留。
+- 「新增渠道」与「管理渠道」：打开与 `/provider` 相同的问答面板。新增依次问名字、baseUrl、
+  令牌（输入不回显）、映射来源（从设置吸收档位或跳过）、是否立即切换；管理可以改 baseUrl、
+  令牌，从设置刷新映射，或删除渠道（连同保存的令牌）。
+- 「查看映射」：把当前渠道的 `models` 和 `tiers` 打印成本地转录块。逐条编辑请直接改
+  `channels.json`，模型名按上面的顺序实时生效。
+
+文件损坏时读作空，写入失败只记调试日志，写入经同目录临时文件 + rename 原子替换。
+dsh-tui 不修改 `~/.claude/settings.json`；会话启动时若其中的 `ANTHROPIC_BASE_URL` 或凭据与
+激活渠道冲突，会提示一次本会话按渠道档案连接。该命令只在 Claude 会话中出现。
+
 ### 工作区
 
 `/workspace` 子命令：
@@ -667,11 +743,15 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 
 协议只有「允许一次 / 拒绝」两种结果，**没有「总是允许」**。
 
+Claude 后端的审批来自 CLI：CLI 给出建议时多一个「始终允许」，焦点在「拒绝」行时还可以输入
+拒绝理由，见[Claude 后端](claude-backend.md#审批与提问)。
+
 ## Slash Commands
 
 命令菜单由本地命令与 DSH 命令注册表合并而成。
 
 - 输入 `/` 查看当前组合真正可用的全集。
+- **回合运行中**，浮窗按「对当前对话的影响」分区：不影响的在上（原样式），会被门禁拦下 / 会打断或替换对话 / 会 steer 的沉到下方、整行变灰（`subtle`，不插标题行），灰区命令仍可选中执行。
 - 命令描述随界面语言（`/lang`）中英切换。
 - 内置命令与已收录的注册表命令（`/plan`、`/goal`、`/feedback`）显示中文翻译。
 - 其余注册表命令回退注册表原文。
@@ -680,7 +760,7 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 
 - `/new`。
 - `/resume`、`/home`、`/agentview`：三者打开同一个会话管理界面。
-- `/bg`（别名 `/background`）：会话转入后台并打开该界面。
+- `/bg`（别名 `/background`）：打开会话管理界面；DSH 内核先将当前会话转入后台，Claude/Codex 内核保持当前会话运行。
 - `/rename`。
 - `/recap`：最近活动摘要 + 建议标题一键应用。
 - 设置 `recapOnOpen` 开启时打开会话自动出分隔线 + `回顾：` 摘要行，发送新消息后消失，默认开。
@@ -700,6 +780,7 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 **模型与显示**
 
 - `/model`、`/effort`、`/thinking`、`/tokens`、`/activity`、`/preset`、`/theme`。
+- `/channel`：渠道档案选择器（仅 Claude 后端，见「渠道档案」小节）。
 - `/color`：会话强调色。
   - 无参打开调色板选择器，`<名>` 直接设置，`status`/`reset`。
   - 输入框边框 + 右上角会话名标签，按会话保存。
@@ -721,6 +802,11 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 **其他**
 
 - `/update`、`/vim`（vim 编辑模式开关，见「输入编辑」）、`/terminal-setup`、`/connect`、`/help`。
+- `/kernel`：打开内核选择器（当前内核打勾，每行带版本与一句说明），在 DSH 与 Claude 会话里都可用。
+  选中另一个内核会记住选择并重启进入它，在新内核里开新会话；原会话仍可在 `/resume` 找到，新会话
+  启动失败时回到原会话。回合进行中不能切换。启动页的「内核」入口与右下角内核区打开的是同一个
+  选择器。用 `--backend` 或配置行指定了内核时，本次按选择重启，之后直接启动仍按参数。全新启动
+  不论记住的是哪个内核都先到启动页，带恢复目标的启动直接进入会话。
 - `/exit`（别名 `/quit`、`/q`）。
 
 **注册表**
@@ -753,6 +839,18 @@ dsh-TUI 不预装通用技能；技能内容与发现规则由 DSH 及当前组
   - registry 服务缺失时 TUI 使用三项 legacy 兼容名册。
   - 服务已挂载但损坏、为空或不一致时标记 unavailable 并 fail closed。
   - 退出计划模式先恢复进入前的 sandbox/approval，再还原进入前所在的权限预设（registry 仍提供时）。
+  - 非 DSH 后端（如 Claude）声明原生权限模式时，`/permission` 列的是该后端的模式：
+    `default`（逐个询问）、`acceptEdits`（自动接受编辑）、`plan`（只读规划）、
+    `bypassPermissions`（跳过全部权限确认），模型支持时还有 `auto`，每行带一句解释。
+    `bypassPermissions` 只能在这个选择器里明确选择，`Shift+Tab` 的循环
+    default → acceptEdits → plan（→ auto）到不了它。状态栏总是显示当前模式
+    （`bypassPermissions`/`dontAsk` 用警告色），只有「极简界面」例外。Claude 设置里的
+    `defaultMode: bypassPermissions` 会降为 `default` 并在转录里提示，克隆来的仓库不能
+    悄悄关掉所有确认。
+  - `/permission` 的选择会存进 `~/.dsh-tui/backends/claude/prefs.json`（与模型、effort
+    同一个文件），之后的会话按它启动。优先级：`DSH_TUI_CLAUDE_PERMISSION_MODE` 环境变量 >
+    记住的选择 > Claude 设置 > `default`。按记住的选择以 `bypassPermissions` 启动时，转录里
+    会提示一句。
 - `/lang` 切换中英界面语言（见「界面语言」）。
 - `/compact` 压缩会话历史；内核「极简模式」预设（Agent preset `minimal`，只有一个持久 shell 工具）既不挂载压缩服务也不剪枝工具结果，长会话可能撞上下文上限、超长工具输出整段留在上下文里，`/compact` 因此不可用（Help 与 `/` 补全标注「不可用」，进入该预设时提示一次）——与界面设置的「极简界面」无关。
 - `/thinking` 扩展思考显示开关，仅本次界面状态、**不持久化**。