@deepseek-harness-tui/dsh-tui 0.14.0 → 0.15.0

package/cordis.patch.yml

@@ -7,7 +7,7 @@
 # restates every key it owns (see the dsh-base patch for the shared
 # defaults). The dsh-base core rows that need no dsh-tui value — tools,
 # sandbox/approval policy, skills, goal, plan mode, workspace context,
-# telemetry — are inherited unless this surface explicitly restates them.
+# telemetry — are inherited unchanged.
 
 # ── surface-specific values over the dsh-base layer ─────────────────────────
 
@@ -54,53 +54,6 @@
   config:
     agents: []
 
-# Preserve the TUI's opt-in privacy stance across the 0.1.2 base default
-# change to FEEDBACK_ONLY. An explicit DSH_TELEMETRY_MODE still wins. This
-# restates the whole 0.1.2 config because include patches replace config
-# objects rather than merging them. The 0.2.0 base moved the collector to
-# dsh-otel-collector and added maxRequestBytes; older cohorts keep the
-# endpoint (and the key set) their base shipped, so both follow the
-# installed package version.
-- id: session-telemetry-otel
-  config: !!js >-
-    (() => {
-      let url = 'https://dsh-otel-collector.deepseeksvc.com/v1/logs'
-      let modern = false
-      try {
-        const require = process.getBuiltinModule('node:module').createRequire(ctx.baseUrl)
-        const fs = process.getBuiltinModule('node:fs')
-        const manifest = require.resolve('@deepseek-ai/dsh-session-telemetry-otel/package.json')
-        const version = String(JSON.parse(fs.readFileSync(manifest, 'utf8')).version ?? '')
-        const match = /^(\d+)\.(\d+)\./u.exec(version)
-        modern = match === null || Number(match[1]) > 0 || Number(match[2]) >= 2
-        if (!modern) url = 'https://harness-telemetry.deepseeksvc.com/v1/logs'
-      } catch {}
-      return {
-        mode: process.env.DSH_TELEMETRY_MODE || 'DISABLED',
-        shutdownTimeoutMillis: 3000,
-        // 0.2.0's base config caps one request at 4 MB; the older plugin's
-        // schema has no such key, so only a probed 0.2+ host gets it.
-        ...(modern ? { maxRequestBytes: 4000000 } : {}),
-        exporter: {
-          url: process.env.DSH_TELEMETRY_OTLP_URL ?? url,
-          compression: 'gzip',
-          timeoutMillis: 1000,
-        },
-        processor: {
-          scheduledDelayMillis: 10000,
-          maxQueueSize: 2048,
-          maxExportBatchSize: 2048,
-          exportTimeoutMillis: 1500,
-        },
-      }
-    })()
-
-# The 0.1.2 base sends the active Loader package inventory on official
-# DeepSeek requests by default. TUI keeps that diagnostic metadata opt-in.
-- id: plugin-package-inventory-deepseek
-  config:
-    enabled: false
-
 # ── agent presets (issue #8) ────────────────────────────────────────────────
 #
 # The model-facing plugin set moves INTO the preset registry: every
@@ -218,7 +171,9 @@
 
 # Windows has no sandbox confinement backend yet (sandbox-local's win32
 # chain is empty); use danger-full-access on Windows so bash commands can
-# run. Other platforms keep the base workspace-write default.
+# run. Other platforms keep the base workspace-write default. DSH_PERMISSION_MODE
+# is the INITIAL state of a launch — the remembered /permission pick
+# (~/.dsh-tui/permission.json) outranks it whenever it is not set.
 - id: sandbox-policy
   config:
     mode: !!js "process.platform === 'win32' ? 'danger-full-access' : (process.env.DSH_PERMISSION_MODE ?? 'workspace-write')"
@@ -467,6 +422,9 @@
       # open. (The comment sits below the inject line:
       # verify-workspace-attachment.mjs asserts the name→inject distance.)
       config:
+        # `provider` + `model` are the deployment DEFAULT route (used until a
+        # `/model` pick is persisted in ~/.dsh-tui/model.json, which then wins
+        # whole); a half-pinned pair is ignored outright (issue #67).
         provider: deepseek-official
         # Alt-screen fullscreen 布局：应用内鼠标选区（选择即复制, OSC 52 +
         # wl-copy/xclip/xsel 兜底）、滚轮滚动、双击选词/三击选行。出厂默认开启，
@@ -479,10 +437,15 @@
         terminalImages: true
         # diffLayout: auto
         # mermaidDiagrams: true
+        # 任务完成通知：off / unfocused（默认）/ always；方式：auto（默认）/ osc9 / bel。
+        # taskNotifications: unfocused
+        # notificationMethod: auto
         # 回复中 LaTeX 公式的显示方式：auto（默认，目前为 Unicode）/ image（支持图形的终端里块级公式显示为图片）/ unicode / source（保留源码）。/settings 可实时改。
         # mathRendering: auto
         # 每个请求实际生效的推理强度，按当前路由的 adapter 档位校验
         #（deepseek: off/low/high/max）；非法值回落 adapter 默认。
+        # 这是部署默认值：上一次 /effort 的持久化选择（~/.dsh-tui/effort.json）
+        # 优先于它，它只决定"还没有选择过"的会话。
         effort: max
         # Shift+Tab session-mode cycle (array order IS the cycle order;
         # absent → the built-in default/plan/full trio below). Each entry
@@ -503,9 +466,10 @@
         #     plan: false
         #     sandbox: danger-full-access
         #     approval: never
-        # Static preset choice (DSH_TUI_PRESET overrides): wins over the
-        # persisted `/preset` preference (~/.dsh-tui/agent-preset.json), which
-        # wins over the roster default (standard).
+        # Deployment default for the Agent preset: the persisted `/preset`
+        # preference (~/.dsh-tui/agent-preset.json) outranks it, and
+        # DSH_TUI_PRESET (this run's explicit instruction) outranks both; the
+        # roster default (standard) closes the chain.
         preset: !!js process.env.DSH_TUI_PRESET ?? undefined
         workspace: !!js process.env.DSH_TUI_WORKSPACE_TARGET ?? undefined
         sessionId: !!js process.env.DSH_TUI_RESUME_SESSION ?? undefined

package/cordis.yml

@@ -64,12 +64,16 @@
     # 以下为 /settings 可改的显示设置；每项说明与默认值见应用内 /settings 屏。
     terminalImages: true
     # mermaidDiagrams: true
+    # 任务完成通知：off / unfocused（默认）/ always；方式：auto（默认）/ osc9 / bel。
+    # taskNotifications: unfocused
+    # notificationMethod: auto
     # 回复中 LaTeX 公式的显示方式：auto（默认，目前为 Unicode）/ image（支持图形的终端里块级公式显示为图片）/ unicode / source（保留源码）。/settings 可实时改。
     # mathRendering: auto
     # Reasoning effort applied to every request, validated against the live
     # route's adapter levels. An unlisted level falls back to the adapter
-    # default; this wins over the persisted /effort choice and seeds the
-    # startup header/statusline.
+    # default. This is the deployment DEFAULT for sessions that carry no
+    # choice of their own: the persisted /effort pick (last session's level)
+    # outranks it, and it seeds the startup header/statusline.
     effort: max
     # Shift+Tab 会话模式循环（数组顺序即循环顺序；缺省为下面三档）。
     # 每档可声明 plan（计划模式开/关）、sandbox（read-only/

package/guide/dsh-tui-guide/claude-backend.en.md

@@ -18,7 +18,13 @@ You need:
   entry or `/kernel`) and press Enter on the dim Claude row — the wizard
   locates the profile directory and installs the pinned SDK via pnpm; the row
   lights up when it finishes (standalone builds and profile-less launches get
-  manual instructions). The manual equivalent, run once in the dsh-tui profile
+  manual instructions). Before installing, the wizard pins the profile's pnpm
+  store to a stable path (storeDir: ../../.pnpm-store, written into
+  pnpm-workspace.yaml), so store drift caused by environment overrides (a
+  sandbox or relay that redirected XDG_DATA_HOME, and the like) cannot recur;
+  if the drift predates the install, the installer rebuilds the dependencies
+  automatically and retries — no manual cleanup needed. The manual equivalent,
+  run once in the dsh-tui profile
   directory (`~/.dsh/profiles/dsh-tui`, or `$DSH_HOME/profiles/dsh-tui` when
   `DSH_HOME` is set):
 
@@ -27,9 +33,16 @@ You need:
   ```
 
 - A Claude credential; see "Signing in" below.
-- The `claude` command is optional: a working `claude` on `PATH` is used (same
-  version and session store as the CLI you already use), otherwise the SDK's
-  bundled binary.
+- The `claude` command is optional: dsh-TUI probes an **explicitly specified
+  executable path** (an environment variable, used as set, with no version check;
+  the variable name is in [Agent backends](agent-backend-design.md) (Chinese)) → a
+  `claude` on `PATH` → the native installer's directory under your home
+  (`%USERPROFILE%\.local\bin\claude.exe` on Windows, `~/.local/bin/claude` on
+  POSIX), and a `PATH` hit still wins; every candidate has to launch and report a
+  version before it is adopted (same version and session store as the CLI you
+  already use), and only when none does is the SDK's bundled binary used. When the
+  SDK is missing but a local Claude Code exists, the install wizard's confirmation
+  pane reports the CLI it found.
 
 To pick the backend, use any of:
 
@@ -37,8 +50,13 @@ To pick the backend, use any of:
   `/kernel` inside a session, which open the kernel picker. Picking the other
   kernel remembers the choice (`~/.dsh-tui/kernel.json`) and restarts dsh-TUI
   into a new session on it; the old session stays in `/resume`. A running turn
-  blocks the switch. Without the SDK or a credential the picker marks Claude as
-  *Not installed* or *Not signed in*.
+  blocks the switch. Without the SDK the picker marks Claude as *Not installed*;
+  an undetected credential does **not** block the pick — a key may perfectly well
+  live where detection cannot see it (the Claude settings' `env`, an
+  `apiKeyHelper`, a relay channel). The row stays selectable (the bottom-right
+  plate never shows sign-in state; the picker's subtitle says *Not signed in*).
+  The CLI applies its own configuration after start; `/login` covers a
+  subscription sign-in in-session, `/channel` the relay route.
 - `dsh-tui --backend claude` (this launch only).
 - `backend: claude` in the dsh-tui config row.
 
@@ -98,7 +116,7 @@ Works, served by Claude:
 Not available (hidden from completion; typing one shows a notice and nothing is
 sent to the model): `/tree`, `/agentview`, `/bg`, `/home`, `/workspace`,
 `/preset`, `/provider`, `/balance`, `/config`, `/reload`,
-`/setup`, `/migrate`, `/skills`, `/plugins`, `/hooks`, `/add-dir`,
+`/setup`, `/migrate`, `/skills`, `/plugin`, `/hooks`, `/add-dir`,
 `/goal` (Claude has no goal capability). Other commands the DSH composition
 registers (such as `/plan`) do not appear either.
 
@@ -151,6 +169,12 @@ a notice, so a cloned repository cannot silently switch off every check.
   conversation continues), `Ctrl+R` renames, `Ctrl+D` deletes; the open session and
   one another dsh-TUI terminal is using cannot be deleted. Pins are kept per
   backend.
+  Reopening or restarting first paints the last complete list while the SDK refreshes it.
+  First-paint snapshots are isolated by Claude configuration directory. Without a snapshot,
+  up to 32 recent sessions from the SDK's default project scope appear first, including
+  the current directory and Git worktrees in the same repository, then the complete
+  project and other projects. A failed all-projects read retains the project's worktree
+  sessions. Failed reads preserve the last complete snapshot.
 - From a shell: `dsh-tui --backend claude --resume <id>`; without an id it resumes
   the last Claude session this install used. dsh-TUI prints that command on exit.
   A session another dsh-TUI terminal has open is refused, and a `--resume` that
@@ -193,6 +217,19 @@ their prompts carried.
 ## Known limitations
 
 - One dsh-TUI process runs one backend; switching restarts through `/kernel`.
+- On Claude, `dsh-tui` starts the TUI from the package's own entry and
+  composes only a light profile (this package plus the third-party plugins the
+  profile declares, without DSH's agent core): the screen appears first and sending waits until
+  the session has opened. Until then Enter keeps the draft and says the kernel
+  is still starting, and a command-line prompt is sent once the session opens;
+  a failed open says why (the landing page closes to show it) and `/new`
+  retries. Third-party
+  DSH/Cordis plugins (themes, panels, decision hooks) load and join once the
+  screen is up; a plugin that needs DSH's own services (agents, tools, the LLM
+  layer) does not activate on this kernel. `DSH_TUI_HOST_ENTRY=0` goes back to
+  starting through `dsh --profile dsh-tui`. (The DSH kernel starts from the
+  package's entry by default too, but composes the whole DSH profile into that
+  process.)
 - In a Claude session the side panel's workspace panel reports it is unsupported
   and the trajectory panel stays empty.
 - No `/add-dir`; the refusal dialog offers only *Retry* and *Cancel*; an MCP

package/guide/dsh-tui-guide/claude-backend.md

@@ -14,7 +14,10 @@ dsh-TUI 可以把会话跑在 Claude Agent 后端上，而不是 DeepSeek Harnes
 - Claude Agent SDK。它是可选依赖，默认不装。最省事的装法：打开内核选择器（启动页
   「内核」或 `/kernel`），对未安装的 Claude 行按 Enter，按引导一键安装——dsh-TUI
   自己定位 profile 目录，用 pnpm 装锁定版本的 SDK，装完该行即变亮可选（独立构建
-  与无 profile 的启动给手动指引）。手动等价形式，在 dsh-tui 的 profile 目录（默认
+  与无 profile 的启动给手动指引）。安装前会把 profile 的 pnpm store 钉到稳定路径
+  （storeDir: ../../.pnpm-store，写入 pnpm-workspace.yaml），环境变量漂移
+  （沙箱、中转改过的 XDG_DATA_HOME 等）导致的 store 错位不再复发；万一装的时候
+  已经错位，安装器会自动重建依赖再重试，无需手动清理。手动等价形式，在 dsh-tui 的 profile 目录（默认
   `~/.dsh/profiles/dsh-tui`，设置了 `DSH_HOME` 时是 `$DSH_HOME/profiles/dsh-tui`）
   执行一次：
 
@@ -23,15 +26,22 @@ dsh-TUI 可以把会话跑在 Claude Agent 后端上，而不是 DeepSeek Harnes
   ```
 
 - 一份 Claude 凭据，见下面的「登录」。
-- `claude` 命令不是必需的：`PATH` 上有能运行的 `claude` 就用它（与你平时用的 CLI 同版本、
-  同一个会话库），否则用 SDK 自带的二进制。
+- `claude` 命令不是必需的：按**显式指定的可执行路径**（环境变量，设置后原样采用，不做版本校验；
+  变量名见[多后端架构](agent-backend-design.md)）→ `PATH` 上的 `claude` → 用户主目录下的
+  `.local/bin`（Windows `%USERPROFILE%\.local\bin\claude.exe`、POSIX `~/.local/bin/claude`）
+  的顺序探测，`PATH` 命中的那份仍然优先；每个候选都要能启动并报出版本才会被采用（与你平时用的
+  CLI 同版本、同一个会话库），全部落空才交给 SDK 自带的二进制。SDK 没装但本机已有 Claude Code
+  时，安装向导的确认面板也会把发现的那个 CLI（版本与路径）报出来。
 
 选择后端，任选一种：
 
 - 启动页的「内核」入口、右下角的内核区，或在会话里输入 `/kernel`，打开内核选择器。
   选中另一个内核后 dsh-TUI 记住选择（`~/.dsh-tui/kernel.json`）并重启，在新内核里开
-  一个新会话；原来的会话仍可在 `/resume` 找到。回合进行中不能切换。SDK 没装或没有
-  凭据时，选择器会把 Claude 标为「未安装」或「未登录」。
+  一个新会话；原来的会话仍可在 `/resume` 找到。回合进行中不能切换。SDK 没装时，选择器
+  会把 Claude 标为「未安装」；凭据检测不出**不会**拦住选择——key 完全可以放在检测看不到
+  的地方（Claude 设置的 `env`、`apiKeyHelper`、中转渠道），行仍可选（右下角铭牌不显示登录
+  状态，未登录在选择器里以副标题标注）。进去后 CLI 会应用自己的配置；订阅登录在会话里
+  `/login`，中转渠道用 `/channel` 配。
 - `dsh-tui --backend claude`（只对这一次启动生效）。
 - 在 dsh-tui 的配置行写 `backend: claude`。
 
@@ -81,7 +91,7 @@ IDE 选区、状态栏的 git 分支、`/clear`（只清屏，Claude 保留上
 
 不可用（不出现在补全里，直接输入会提示不可用，不会发给模型）：`/tree`、`/agentview`、
 `/bg`、`/home`、`/workspace`、`/preset`、`/provider`、`/balance`、`/config`、
-`/reload`、`/setup`、`/migrate`、`/skills`、`/plugins`、`/hooks`、
+`/reload`、`/setup`、`/migrate`、`/skills`、`/plugin`、`/hooks`、
 `/add-dir`、`/goal`（Claude 没有目标能力）。DSH 组合注册的其他命令（如 `/plan`）也不会出现。
 
 启动时仍先到启动页；首启引导和工作区首页只在 DSH 下出现。带恢复目标的启动直接进入
@@ -120,6 +130,10 @@ Claude 设置 > `default`。Claude 设置里的 `defaultMode: bypassPermissions`
   dsh-TUI 创建的会话也在其中（Claude Code 自己的 `/resume` 选择器不显示它们，要用
   `claude --resume <id>` 打开）。`Enter` 恢复（先回放历史再继续），`Ctrl+R` 重命名，
   `Ctrl+D` 删除；当前会话和另一个 dsh-TUI 终端正在用的会话不能删。置顶按后端分开保存。
+  再次打开或重启后先显示上次完整列表，同时仍从 SDK 刷新。首屏快照按 Claude 配置
+  目录隔离；没有快照时按 SDK 默认项目范围（当前工作目录及同仓库的 Git worktree）
+  先显示最近的最多 32 条，再补齐该项目及其他项目的完整列表；全部项目读取失败时
+  也保留该项目的 worktree 会话。读取失败时保留上次完整快照。
 - 从 shell 恢复：`dsh-tui --backend claude --resume <id>`；不带 id 时恢复本机最近一次
   用过的 Claude 会话。退出时 dsh-TUI 会打印这条命令。另一个 dsh-TUI 终端已打开的会话会
   被拒绝；`--resume` 打不开时直接报错，不会改开新会话。状态栏的短会话 id 就是
@@ -153,6 +167,14 @@ Claude 设置 > `default`。Claude 设置里的 `defaultMode: bypassPermissions`
 ## 已知限制
 
 - 一个 dsh-TUI 进程只用一个后端，切换要经 `/kernel` 重启。
+- Claude 内核下 `dsh-tui` 从本包自己的入口启动，只组合轻量 profile（本包与 profile
+  声明的第三方插件，不含 DSH 的 agent 核心）：界面先出现，
+  会话打开后才能发送：在此之前按 Enter 草稿留在原处并提示还在启动，命令行带的首句在
+  会话打开后发出；打开失败会说明原因（落地页自动收起），`/new` 重试。第三方
+  DSH/Cordis 插件（主题、面板、决策拦截）照常加载，在界面出现后加入；依赖 DSH 自身
+  服务（agent、工具、LLM 层）的插件在这个内核下不会激活。`DSH_TUI_HOST_ENTRY=0` 回到经
+  `dsh --profile dsh-tui` 启动。（DSH 内核默认也从本包入口启动，但会在同一进程里组合
+  完整的 DSH profile。）
 - 侧栏的工作区面板在 Claude 会话下提示不支持，轨迹面板为空。
 - 不支持 `/add-dir`；拒答对话框只有「重试」和「取消」；需要浏览器操作的 MCP 请求不会
   自动打开浏览器。

package/guide/dsh-tui-guide/codex-backend.en.md

@@ -92,6 +92,21 @@ is handed to Codex unchanged. Non-first-party routes should use their own provid
 credentials or a channel key. Account status shows only credential source, subscription
 type and host, not an email address or key.
 
+One bridging exception: when the active provider takes its credential from an `env_key`
+(say `DEEPSEEK_API_KEY`) that the launching environment did not export but the DSH credential
+store declares, the stored value is injected into the app-server child after `config/read`
+(the hub is re-acquired; the key joins the hub fingerprint through `injectedEnvKeys`). Reads
+take the active store first (`$DSH_HOME/.credentials.yaml`, or `~/.dsh/.credentials.yaml`
+when `DSH_HOME` is unset) and then the default `~/.dsh` store, so a `DSH_HOME` override does
+not orphan a key stored where both READMEs name it; writes only ever target the active home. A key
+stored once in the credential store therefore works without exporting a shell variable. The
+value only ever travels into the spawn pipeline, never into logs, notices or events.
+
+When nothing can supply the key, startup is **not** blocked: Codex itself rejects every turn
+of that provider, so the runtime reports the reason once as a start notice (naming the
+provider and the variable, never a value) — export the key, store it, or move the provider to
+a channel.
+
 ### The three `/login` methods
 
 | Method | Purpose and storage |
@@ -156,9 +171,11 @@ changes during a turn apply to the next one, not to reasoning already in progres
 
 - **`Shift+Tab` only toggles Plan**, returning to the previous permission preset when leaving
   it. It does not cycle into Full Access.
-- `/plan` enters Plan; `/plan <task>` enters it and submits the task. Choosing an explicit
-  permission preset returns to Default collaboration. Plan does not mean all tools are
-  forbidden: the actual security boundary remains Codex’s permission policy.
+- `/plan` enters Plan; `/plan <task>` enters it and submits the task; `/plan off` returns to
+  the permission preset that was active before Plan. The `on`/`off` rows in the completion
+  menu are dsh-TUI’s own state words, not task text. Choosing an explicit permission preset
+  returns to Default collaboration. Plan does not mean all tools are forbidden: the actual
+  security boundary remains Codex’s permission policy.
 - Defaults resolve per field: an explicit dsh-TUI choice > your Codex configuration >
   `auto` when unset. An unreadable configuration is not overwritten with `auto`.
 - Completed plans offer implementation, implementation with cleared context, or staying
@@ -212,6 +229,12 @@ past tokens/cost. Fresh usage notifications update the readings.
   say the transcript is retained, not physically deleted. Current, occupied or active-worker
   threads cannot be archived. The catalog lists up to 500 recent ordinary threads, excluding
   ephemeral forks and child threads from the main list.
+  Reopening or restarting first paints the last complete list while the native catalog
+  refreshes; a cold scan shows pages as they arrive. Without a snapshot, the native state
+  database supplies up to 32 recent threads from the current workspace first, then the
+  rollout scan repairs titles and fills in that workspace followed by other workspaces;
+  an unavailable database falls back to scanning. First-paint snapshots are isolated by
+  Codex storage directory; failed or incomplete reads never replace a complete snapshot.
 - `/rename` changes the official thread title; `/color` stores a session accent, not a global theme.
 - `/fork` creates a resumable copy without switching. Double `Esc` or `/rewind` conversation
   rewind creates a copy before the selected question, returns the question to the composer
@@ -265,10 +288,14 @@ Real model vision and image generation were not tested in this round.
 
 usageLimited/budgetLimited goals show a blocked state and reason. Unsupported goal APIs
 do not expose the capability. `/btw`/`/recap` use a read-only sandbox with no approval
-escalation, request answer-only behavior and reject tool/approval requests. Cancellation
-interrupts the temporary turn and unsubscribes the fork. They consume model quota, not
-free local summaries. Ephemeral fork creation/non-persistence was checked offline; actual
-side-query model answers were not tested in this round.
+escalation, request answer-only behavior and reject tool/approval requests. The fork never
+carries `deferGoalContinuation` (app-servers from 0.162 reject it combined with `ephemeral`),
+and when the thread has no rollout on disk yet (nothing persisted, e.g. a brand-new session)
+the side call falls back to a fresh ephemeral `thread/start` — the conversation is empty in
+exactly that state, so no context is lost. Cancellation interrupts the temporary turn and
+unsubscribes the fork. They consume model quota, not free local summaries. Ephemeral fork
+creation/non-persistence was checked offline; actual side-query model answers were not
+tested in this round.
 
 ## Limitations and troubleshooting
 

package/guide/dsh-tui-guide/codex-backend.md

@@ -75,6 +75,15 @@ thread 时，恢复保留原来的错误，不会启动后台服务或另开新
 路由应使用自己的 provider 凭据或渠道 key。读取账户状态只显示凭据来源、订阅类型
 与主机，不显示邮箱或 key。
 
+一个桥接例外：当前 provider 用 `env_key`（如 `DEEPSEEK_API_KEY`）取凭据、启动环境没导出、
+而 DSH 凭据库声明了该 ref 时，`config/read` 之后把库里的值注入 app-server 子进程（重取 hub，
+key 记入 `injectedEnvKeys` 参与指纹）。读取先看活动 home 的库，再回退默认 `~/.dsh` 的库，
+所以 `DSH_HOME` 覆盖不会让写在文档位置的 key 失联；写入只进活动 home。key 只走 spawn 管道，
+不进日志、提示或事件。
+
+两边都拿不到时不拦启动：Codex 自己会拒绝该 provider 的每个回合，运行时只在启动时报一次
+原因（点名 provider 与变量名，不含值）——导出该变量、写入凭据库，或把 provider 换成渠道。
+
 ### `/login` 的三种方式
 
 | 方式 | 用途与存储 |
@@ -130,8 +139,10 @@ Chat Completions 端点当作 Responses 使用。通过 `/channel` 选择/新建
 | Plan（`plan`） | 规划协作模式；保留已有权限档，不以 Plan 替代沙箱 |
 
 - **`Shift+Tab` 只开/关 Plan**，退出回到进入前的权限档，不循环到 Full Access。
-- `/plan` 切到 Plan；`/plan <任务>` 切换后立刻提交任务。选择一个具体权限档会回到
-  Default 协作模式。Plan 不等于“所有工具都被禁止”，安全边界仍由 Codex 权限决定。
+- `/plan` 切到 Plan；`/plan <任务>` 切换后立刻提交任务；`/plan off` 退回进入 Plan 前的
+  权限档。补全菜单里的 `on`/`off` 是 dsh-TUI 自己的状态词，不是任务文本。选择一个具体
+  权限档会回到 Default 协作模式。Plan 不等于“所有工具都被禁止”，安全边界仍由 Codex
+  权限决定。
 - 默认来源按字段为：dsh-TUI 中明确选过的值 > 用户 Codex 配置 > 未设置时的
   `auto`。读取配置失败时不拿 `auto` 覆盖未知配置。
 - 计划完成后会出现实施确认：实施、清上下文后实施、留在规划/反馈继续。清上下文
@@ -181,6 +192,10 @@ used      = max(0, T - 12000)
   `Ctrl+R` 改名、`Ctrl+D` **归档**；确认和完成提示都说明记录保留，不物理删除。
   当前使用中、其他终端占用或内部 worker 活动的 thread 不能归档。目录最多列出
   最近 500 条普通 thread，临时 fork 与子 thread 不混进主列表。
+  再次打开或重启后先显示上次完整列表，后台仍从官方目录刷新；首次读取时分页到达
+  就显示。没有快照时先从官方状态数据库显示当前工作区最近的最多 32 条，再由历史
+  扫描修正标题并补齐当前工作区及其他工作区；数据库不可用时照常扫描。首屏快照
+  按 Codex 存储目录隔离，失败或未读完的分页不会覆盖完整快照。
 - `/rename` 改官方 thread 标题；`/color` 只保存会话强调色，不改全局主题。
 - `/fork` 创建可恢复副本，不自动切换；双击 `Esc` 或 `/rewind` 的对话回退在
   所选提问之前创建副本并继续，提问回到输入框、原 thread 保留。首条提问回退会