@deepseek-harness-tui/dsh-tui 0.14.0 → 0.15.0

package/guide/dsh-tui-guide/interaction.en.md

@@ -64,10 +64,13 @@ side panel (`Ctrl+B`/`Alt+Z`), subagent dashboard, show-all, and todo fold are r
 - Plugins may also contribute one text line above the prompt, or a compact rich status view of up to three rows when the host exposes `tuiStatus.registerView`.
 - Rich views receive only host `Box`, `Text`, `Image`, and terminal size. Click/hover/drag work in fullscreen, and the view never owns the keyboard.
 - `Image` takes decoded RGBA pixels plus a same-size cell fallback.
-- After a successful Kitty probe, the host centers the image at its natural aspect ratio
-  using terminal-reported cell geometry (or a conservative default), adding transparent
-  letterboxing and downsampling when needed. Otherwise it renders the fallback (including
+- After a successful Kitty probe, the host enlarges or downsamples the image to the
+  reserved cell box's physical pixels, preserving its aspect ratio with centered transparent
+  letterboxing. It uses terminal-reported cell geometry (or a conservative default) and
+  downsamples boxes that exceed the pixel budget. Otherwise it renders the fallback (including
   inline, accessibility, and multiplexer sessions).
+- The 16 MiB frame budget bounds both decoded sources and fitted rasters;
+  images over the budget keep their text fallback.
 - Plugins provide the keyboard path for the same action through a slash command or `tuiShortcuts`.
 - A refused rich registration returns `undefined`; an admitted one returns a disposer that removes both the view and its Cordis effect.
 
@@ -77,16 +80,16 @@ The startup **launchpad** and the **first-run wizard** each own the keyboard; bo
 results back to the chat screen and add no new behavior.
 
 - **Launchpad**: printable input goes into the input box (the prefix turns from `❯` to `⌘` when the line
-  starts with `/`), `Backspace`/`Delete`/`←`/`→`/`Home`/`End` edit it; the caret is an **inverse block
-  sitting on the current character** (inverse on that one character; an inverse blank cell at end of
-  line — a theme that declares the `cursor` key paints a solid fill with a contrasting glyph instead,
-  see [Themes](themes.en.md)), blinking is a pure style toggle (inverse ↔ regular, ~550ms per phase)
-  and never occupies an extra cell or eats a character; `Alt+R` continues the most recent session
+  starts with `/`), `Backspace`/`Delete`/`←`/`→`/`Home`/`End` edit it; the **native terminal cursor**
+  inherits your terminal's shape, color, blinking, and enabled animation or trail effects.
+  Cursor movement never adds a cell or eats a character. Static rendering retains the
+  [theme-painted fallback](themes.en.md); `Alt+R` continues the most recent session
   (= the first entry row slot, bound only on this screen, no-op when there is nothing to continue,
   remappable in `/settings`);
   a leading `/` opens the
   **command palette** (the same data source and component as the chat composer: `↑`/`↓` move the selection,
-  `Enter`/`Tab`/click **run** the selected command, `Esc` dismisses only the palette and keeps the draft);
+  `Tab` **completes** the selected command in the input box with the caret at the end,
+  `Enter`/click **run** it and clear the input, `Esc` dismisses only the palette and keeps the draft);
   with the palette dismissed, `Enter` **sends** the line straight away (a leading `/` line — including
   plugin/registry commands — goes through the chat page's merged command table and never reaches the model);
   `↑`/`↓`/`Tab` walk the focus ring (input box → the four param segments under the box → the quick
@@ -126,13 +129,16 @@ results back to the chat screen and add no new behavior.
 - **Corner plates**: the bottom-left working directory is **clickable** — it opens the existing
   `/workspace` menu (rendered above the launchpad; `Esc` returns to the launchpad), keyboard path =
   the focus ring's last slot + `Enter`, hover/focus = text highlight; the bottom-right plate starts
-  with `dsh-tui v<TUI>`, followed by one row for each of the two kernels:
-  `▸ DSH · dsh-core v<kernel>` / `Claude · claude-code v<CLI>`. `▸` marks the current kernel and the
-  other row stays dim; an unavailable kernel adds the reason after its version (such as *Not installed*
-  or *Not signed in*), a row whose version cannot be read shows just the name, and *Checking…* shows
-  while the probe runs. The whole block is clickable and opens the same kernel picker (keyboard path =
-  focus ring + `Enter`). Rows are right-aligned, the cwd plate is top-aligned to the first row, and
-  narrow terminals truncate per the existing truncate-middle contract.
+  with `dsh-tui v<TUI>`, followed by one row for **each registered backend**:
+  `▸ DSH · dsh-core v<kernel>` / `Claude · claude-code v<CLI>` (then `Codex · codex-cli v<CLI>`, and any
+  installed plugin backend after it). The name is the backend manifest's short label; `▸` marks the
+  current kernel and the other rows stay dim; an unavailable kernel adds the reason after its version (such as *Not installed*
+  or *Too old · upgrade needed*), a row whose version cannot be read shows just the name, and *Checking…* shows
+  while the probe runs. Sign-in state never enters the plate — check it in the picker when switching (a signed-out
+  row is selectable, its subtitle says *Not signed in*). The whole block is clickable
+  and opens the same kernel picker (keyboard path =
+  focus ring + `Enter`). Every row ends flush at the same right edge, the cwd plate is top-aligned to the
+  first row, and narrow terminals truncate per the existing truncate-middle contract.
 - **Wizard**: `←`/`→` change step (except the effort slider in step 3 and a drilled-in model list, where the
   horizontal keys belong to the child control), `Tab` switches between the language/theme and
   model/effort/workspace panes, `↑`/`↓` move the selection; `Enter` runs the step (step 1 = re-check
@@ -330,6 +336,7 @@ The four commands and the `⌸` entry at the head of the prompt row all open the
 
 - The workspace rail (the durable registry) on the left.
 - The sessions of the selected workspace on the right, every row carrying that session's live state.
+- Focus starts on the most recently used session in the current workspace, ready for `Enter`; with no history, it starts on the new-session card.
 
 They used to be three implementations that grew apart — a session browser, an agent view,
 a workspace home — each listing the same session with its own selection model and its own
@@ -350,7 +357,7 @@ brings it back.
 
 | Key | Action |
 | --- | --- |
-| `←` `→` | Choose the column that owns the keyboard (rail / sessions); exactly one `❯` is on screen |
+| `←` `→` | Choose the column that owns the keyboard (rail / sessions), preserving the selected session in the same workspace; exactly one `❯` is on screen |
 | `↑` `↓` / `PgUp` `PgDn` / wheel | Move in the rail; move in the session list (row 0 is the new-session card) |
 | Type | Filter the selected workspace's sessions live (title, directory, branch, model) |
 | `Enter` | Sessions: enter the row under the cursor (row 0 = start a session in this workspace). Rail: open that workspace's action menu |
@@ -361,6 +368,10 @@ brings it back.
 | `Tab` / `Shift+Tab` | Next / previous source tab (when other agents have sessions) |
 | `Esc` | Dismiss a notice → clear the filter → leave the screen |
 
+Each workspace starts on its most recent visible session, or the new-session card if it has no matches. Changing columns or moving the mouse into the list preserves the current selection. Changing workspace chooses that workspace's newest session; returning chooses the newest again, without remembering past selections per workspace. Until you choose a list row, partial results, complete reads, and later refreshes keep following the newest visible session. After you select a session or the new-session card, refreshes preserve that choice.
+
+The native cursor follows the last-used region, as in the model picker: workspace navigation parks it on the workspace row, session navigation on the session row or new-session card, and typing or clicking the filter on its text caret. Row carets hide after 0.5 seconds at rest; the search caret stays visible. Animation and trail effects come from your terminal settings. Narrow layouts keep the caret on a visible target when the workspace rail is hidden. Arrow and Enter actions keep the same meaning while filtering.
+
 The right side of the title row is the **source strip**: `DSH │ Claude Code  Codex …`.
 
 - A tab appears only for another coding agent on this machine (Claude Code, Codex, Grok Build, zcode) that has conversations, in a fixed order; with none, there is no strip. Opening the screen only checks whether each source has any conversation; a source's list is read when its tab is opened.
@@ -491,9 +502,15 @@ A full-screen scene (no scrollback pollution) over the whole session timeline:
 
 ### Model and preset
 
-`/model` switches through a session fork at the end of current history, because DSH has no in-place model-switch API. The old session remains in `/resume`.
+`/model` shows the model list and the highlighted model's reasoning effort on one page. DSH also has provider tabs, with **Recently used** first; opening records the current model as the latest use and moves it to the front without duplicates, initially focusing it when it is still in the catalog.
+Codex and Claude show their complete model catalogs directly, without provider or recents tabs; the current model is initially focused when the catalog loads.
+In DSH, `Tab` selects the next provider and `Shift+Tab` the previous one, wrapping at either end; all backends use `↑/↓` to select a model and `←/→` to adjust its effort.
+The native terminal cursor follows the **region you used last**: `Tab`/`Shift+Tab` moves to the provider tab, `↑/↓` to the focused model's `❯`, and `←/→` to the effort level. Movement shows the terminal's original cursor shape, blinking, and enabled animation or trail effects; the cursor hides after **0.5 seconds at rest**, then reappears and restarts the timer on the next movement. Ordinary repaints do not extend this window; text input carets stay visible, and accessibility mode retains visible focus anchors. Clipped tabs or unavailable effort levels fall back to the model row. Inverse tabs and the `❯` pointer always remain visible, including in static rendering.
+Confirmation submits only explicit effort drafts. Changing only the model leaves saved-effort validation to the backend; candidate defaults do not become new preferences. While the picker is open, `Ctrl+B` and `Alt+Z` still control the sidebar, and picker navigation stays with the model picker.
+`Enter` applies the model and effort; `Esc` cancels the draft. Shortcuts sit below the title, and a separate effort heading and level strip sit below the models, with the `←/→` hint beside the effort heading. Selectable levels use the body text color and the current level is highlighted. DSH, Claude, and Codex use the terminal background while covering the text underneath.
+Click tabs, models, and effort levels, then click **select** or **cancel** below the title; the wheel moves through the model list. When space above the input is tight, navigation hints, model descriptions and neighboring models are omitted, effort collapses to one row, and Select / Cancel stay at the bottom. With only two rows, effort is hidden too, keeping the focused model and actions visible.
 
-- A session nobody has typed into records no branch: switching models there yields an independent session with no `parentSession` (inheriting the same session-scaffolding prefix), so the first real prompt you send still triggers automatic session-title generation. A session that already holds a conversation keeps its lineage as before.
+`/model` selects the next request’s route within the same DSH session, preserving its ID, history, and title. Switching is refused during a running turn. The next request records the actual route and a model-change notice. Parked agents retain their selection when reattached. After the process exits, a choice with no subsequent request is saved only as a global default; disk resume resolves the last recorded request route. DSH versions before `0.1.2-alpha.3` refuse switching and prompt an upgrade so legacy subagents cannot silently use the original model.
 
 - `/preset` switches in place only for a blank session. In a started session, the choice becomes the default for the next `/new` or launch.
 
@@ -604,8 +621,9 @@ In inline mode, the terminal emulator owns native scrollback and selection.
   transcript behind an open overlay. Moves the cursor in the trajectory scene (±3 rows per
   notch on the timeline, ±1 in hotspot; scrolls the detail while expanded). Walks the
   focused row in /settings.
-- **Drag** — Select text, copy on release, then clear the selection; a "Copied N characters"
-  notice pops up. With `dsh-tui.scrollGutter: scrollbar`, the right-edge scrollbar is a drag
+- **Drag** — Select text and copy on release, keeping the selection; a "Copied N characters"
+  notice pops up. A new selection replaces the retained one. With
+  `dsh-tui.scrollGutter: scrollbar`, the right-edge scrollbar is a drag
   target: an unmodified left drag scrubs the transcript to the track position (same mapping
   as a track click — drag to point), while `Shift`/`Alt`/`Ctrl`+drag still selects text (the
   drag protocol opens only for unmodified left presses).
@@ -784,7 +802,7 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 
 **Account and policy**
 
-- `/provider`, `/login`, `/logout`, `/permission`, `/add-dir`, `/hooks`, `/mcp`, `/plugins` — `check <path>` validates a plugin manifest.
+- `/provider`, `/login`, `/logout`, `/permission`, `/add-dir`, `/hooks`, `/mcp`, `/plugin` — `list` shows the plugins you added (the installation-supplied bundles stay out); `check <path>` validates a plugin manifest, `info <id>` describes an installed entry or an install spec, `registries` lists where installations ask; bare `/plugin` gives the full diagnostics (reserved for the plugin management panel).
 - After `/auth login deepseek-account` or `/provider` signs in, a Platform-confirmed, unshown login bonus appears with its amount and expiry as a “Whale coupon” in the whale-maid dialog; Enter/Esc closes it.
 
 **Skills**
@@ -796,7 +814,7 @@ The command menu merges local commands with the DSH command registry. Type `/` t
 - `/update`, `/vim` — vim editing mode toggle, see "Editing keys".
 - `/terminal-setup`, `/connect`, `/help`, `/exit` — aliases `/quit`, `/q`.
 - `/kernel` — opens the kernel picker (the current kernel is ticked; every row
-  carries a version and a one-line explanation), on DSH and Claude sessions alike.
+  carries a version and a one-line explanation), on DSH, Codex and Claude sessions alike.
   Picking the other kernel remembers it and restarts into it with a new session;
   the old session stays in `/resume`, and if the new session fails to start you
   are back on the old one. A running turn blocks the switch. The launchpad's
@@ -805,6 +823,11 @@ The command menu merges local commands with the DSH command registry. Type `/` t
   a later direct launch follows the flag. A fresh launch lands on the launchpad
   whichever kernel is remembered; a launch with a resume target goes straight
   into the session.
+- `/dsh`, `/codex`, `/claude` — directly choose the named kernel through the same
+  checks and restart flow as `/kernel`. Choosing the current kernel only reports
+  that it is already current; a running turn blocks switching. Missing Claude
+  opens the install wizard; missing or outdated Codex shows install/upgrade guidance.
+  These shortcuts also work before startup is ready.
 
 **Registry**
 
@@ -829,7 +852,7 @@ Additional forms:
 - `/model` opens a two-level picker:
   - A pinned **Recently used** group first — the last 10 switched models, persisted at `~/.dsh-tui/model-recents.json` — then provider groups.
   - `Enter` drills into a group's models, and a single provider with no recents skips straight to the list.
-  - Switching = fork continuation, history preserved.
+  - Switching keeps the current session and history; the new model is used for the next request.
 - `/theme <name>` and `/theme status` are described in the theme guide.
 - `/permission` reads the DSH `permissionPresets` registry, preserving registry order for
   the picker, completion and the `Shift+Tab` cycle. Third-party presets need no TUI
@@ -842,6 +865,16 @@ Additional forms:
   path (the same handler, real events) and confirms via event/readback. When neither is
   available, it fails loudly instead of sending the input to the model.
 - Exiting plan mode restores the pre-plan atoms first, then the durable preset you were on before plan mode (while the registry still offers it).
+- The DSH `/permission` pick is persisted the same way at `~/.dsh-tui/permission.json`: every durable
+  preset switch teaches it (picker, typed command, Shift+Tab static mode, or a switch the official
+  command performed on its own), and a session that never customized its permission planes starts on
+  the remembered preset — applied through the same official switch path. "Never customized" means the
+  USER never touched it: the composition itself writes its default preset into every fresh session at
+  creation (`dsh-permission-presets`' `session/created` → `pinInitialPermission`), and those events are
+  not a user choice — only a session that ran a turn, or whose identity is not the composition default,
+  keeps its own planes. Plan-mode transients are excluded (entering plan keeps the pre-plan memory; the
+  exit restore teaches it again), `DSH_PERMISSION_MODE` is this launch's initial permission plane and
+  outranks the file when set, and an identity the mounted roster no longer offers is skipped.
 - When the registry service is absent, TUI uses its legacy three-row compatibility roster; a mounted but broken service is unavailable and fails closed.
 - Non-DSH backends (Claude) that declare native permission modes answer
   `/permission` with that backend's own modes: `default` (ask before each risky

package/guide/dsh-tui-guide/interaction.md

@@ -60,8 +60,9 @@
 - 富状态最多三行，只能用宿主的 `Box`、`Text`、`Image` 与终端尺寸。
 - 点击/悬停/拖动只在 fullscreen 下生效，不会取得键盘。
 - `Image` 接收已解码 RGBA，另有同尺寸字符回退。
-- 探测到 Kitty graphics 时，按终端报告的单元格像素比例等比居中。
-- 像素比例不可用时用保守默认值；必要时透明留边并降采样。
+- 探测到 Kitty graphics 时，按终端报告的单元格像素将图像等比放大或缩小到预留格子盒，并居中留透明边。
+- 像素比例不可用时用保守默认值；超出像素预算时降采样。
+- 整帧 16 MiB 预算同时约束原图与放大后的栅格；超限图片显示文字回退。
 - 否则自动显示回退内容（inline、辅助功能、多路复用器同样如此）。
 
 同一动作的键盘路径由插件另提供 slash 命令，或注册 `tuiShortcuts`。
@@ -74,12 +75,11 @@
 启动**落地页**与**首次引导向导**各自独占键盘；两者都只把结果交回对话页，不新增行为。
 
 - **落地页**：可打印字符接进输入框（行首 `/` 时前缀由 `❯` 变 `⌘`），`Backspace`/`Delete`/`←`/`→`/`Home`/`End` 编辑；
-- **落地页**：可打印字符接进输入框（行首 `/` 时前缀由 `❯` 变 `⌘`），`Backspace`/`Delete`/`←`/`→`/`Home`/`End` 编辑；
-  输入光标是**压在当前字符身上的反显块**（对那一个字符 inverse，行尾是反显空格；主题声明了 `cursor`
-  键时改用该填充色的实色块配对比字形，见[主题系统](themes.md)），闪烁是纯样式切换
-  （inverse ↔ 常规，约 550ms 一相位），绝不另起一格、绝不吃掉字符；`Alt+R` 继续最近一条会话
+  输入使用**终端原生光标**，形状、颜色、闪烁及已启用的动画或拖尾继承终端设置；
+  光标移动不增删字符。静态呈现保留[主题绘制的光标回退](themes.md)；`Alt+R` 继续最近一条会话
   （= 入口行第一格「继续「…」」，仅此屏生效，无可继续会话时无动作，键位可在 `/settings` 改）；
-  **执行**选中命令，`Esc` 只收面板、草稿不动）；面板没收时 `Enter` 直接**发送**这一行（行首 `/` 的命令——含
+  行首 `/` 弹出**命令补全面板**（数据与组件与聊天页同源：`↑`/`↓` 移选中，`Tab` **补全**选中命令到输入框、光标移到末尾，
+  `Enter`/点击**执行**并清空输入，`Esc` 只收面板、草稿不动）；面板收起后 `Enter` 直接**发送**这一行（行首 `/` 的命令——含
   插件/registry 命令——按对话页同一条合并命令表判定，是命令就不发模型）；
   `↑`/`↓`/`Tab` 沿焦点环走（输入框 → 框下参数行四段 → 快捷入口行 → Tips 行），`Enter` 激活焦点上的那一条
   （焦点在 Tips 行上 `Enter` = 切下一条 Tip），在入口/参数段上敲字会把焦点收回输入框；有字时 `Esc` 只清空，
@@ -105,11 +105,13 @@
   还会**自动轮换**（约 10s 一换，手动切换后计时重置），切换只改文本、行高与居中位置不变。
 - **双角铭牌**：左下角工作目录**可点**——点开既有的 `/workspace` 菜单
   （盖在落地页之上、`Esc` 回落地页），键盘路径 = 焦点环末格 + `Enter`，悬停/焦点 =
-  文字高亮；右下角第一行是 `dsh-tui v<TUI>`，其下两个内核各占一行：
-  `▸ DSH · dsh-core v<内核>` / `Claude · claude-code v<CLI>`。`▸` 标出当前内核，其余行暗色；
-  不可用的内核在版本后写原因（如「未安装」「未登录」），读不到版本时只写名字，检测期间显示
-  「检测中…」。整块可点，打开同一个内核选择器（键盘路径 = 焦点环 + `Enter`）。
-  各行右对齐，左下目录铭牌与第一行顶对齐，窄屏按既有 truncate-middle 截断。
+  文字高亮；右下角第一行是 `dsh-tui v<TUI>`，其下**每个已注册后端各占一行**：
+  `▸ DSH · dsh-core v<内核>` / `Claude · claude-code v<CLI>`（还有 `Codex · codex-cli v<CLI>`，
+  装了插件后端就再往后排）。名字取该后端 manifest 的短品牌名，`▸` 标出当前内核，其余行暗色；
+  不可用的内核在版本后写原因（如「未安装」「版本过旧 · 需升级」），读不到版本时只写名字，检测期间显示
+  「检测中…」；**登录状态不进铭牌**——要切内核时在选择器里看（未登录行可选，副标题标注「未登录」）。
+  整块可点，打开同一个内核选择器（键盘路径 = 焦点环 + `Enter`）。
+  各行右端贴齐同一条右边界，左下目录铭牌与第一行顶对齐，窄屏按既有 truncate-middle 截断。
 - **引导向导**：`←`/`→` 换步骤（例外：第三步的强度区、以及已钻进去的模型列表，横向键归子控件，不换步骤）、
   `Tab` 在「语言 / 主题」与「模型 / 强度 / 工作区」两组面板间切、`↑`/`↓` 移动选择；
   `Enter` 执行这一步（第一步 = 重新检查连通性，第三步 = 钻进 provider / 换模型 / 打开工作区选择器——**强度不走 Enter**，只用 `←`/`→` 调且移动即生效）；
@@ -322,6 +324,7 @@ Bracketed paste（右键或终端原生粘贴）保留普通文本与换行。
 四条命令和输入框行首的 `⌸` 按钮打开的是**同一个界面**。
 
 - 左边是工作区（durable registry）栏，右边是所选工作区里的会话列表。
+- 默认聚焦当前工作区最近使用的会话，`Enter` 直接进入；没有历史时聚焦“新建会话”卡片。
 - 每行带该会话的实时状态。
 - 原来是三个各自演化的实现（会话浏览器 / 会话总览 / 工作区首页）。
 - 同一个会话会被三个界面各自列出、各自定义"打开"的含义。
@@ -343,7 +346,7 @@ Bracketed paste（右键或终端原生粘贴）保留普通文本与换行。
 
 | 按键 | 作用 |
 | --- | --- |
-| `←` `→` | 切换键盘所在栏（工作区栏 / 会话栏），屏幕上永远只有一个 `❯` |
+| `←` `→` | 切换键盘所在栏（工作区栏 / 会话栏），同一工作区保留会话选择，屏幕上永远只有一个 `❯` |
 | `↑` `↓` / `PgUp` `PgDn` / 滚轮 | 在工作区栏移动工作区；在会话栏移动会话（第 0 行是"新建会话"卡片） |
 | 直接输入 | 实时筛选当前工作区下的会话（标题、目录、分支、模型） |
 | `Enter` | 会话栏：进入光标所在行（第 0 行 = 在该工作区新建会话）；工作区栏：打开该工作区的操作菜单 |
@@ -365,6 +368,10 @@ Bracketed paste（右键或终端原生粘贴）保留普通文本与换行。
 - 外部标签下 `Ctrl+N`、`Ctrl+X`、固定不生效；`Ctrl+L` 改为重新扫描该来源。
 - 导入与 `/migrate` 用同一套解析和确定性 id，两个入口导入同一条会话得到的是同一个 DSH 会话。
 
+每个工作区默认选中当前可见的最新会话，没有匹配会话时落在“新建会话”卡片。左右切栏或鼠标移入列表不会重置选择；换工作区时选中该工作区最新会话，返回之前的工作区时也重新选最新会话，不记忆各工作区的旧选择。尚未主动选择列表行时，首批结果、完整读取和后续刷新都会跟随最新可见会话；主动选择会话行或“新建会话”后，刷新保持该选择。
+
+原生光标与模型选择器一样跟随最后操作的区域：导航工作区时停在工作区行，导航会话时停在会话行或“新建会话”卡片，输入或点击筛选框时移到文本光标。行光标停稳 0.5 秒后隐藏，搜索光标保持可见；动画与拖尾沿用终端设置。窄屏隐藏工作区栏后，光标会回落到可见位置。筛选期间方向键与 Enter 的作用保持一致。
+
 工作区栏的菜单有四项：
 
 - **编辑**：选中该工作区，右侧列出它的会话。
@@ -504,10 +511,15 @@ Windows `dsh-tui.cmd --resume` 使用 `~/.dsh-tui/resume.txt` 中最后选择的
 
 ### Model 与 preset
 
-`/model` 通过在当前历史末尾 fork 会话来切换模型，因为 DSH 没有原位换模型 API。
+`/model` 在同一页展示模型列表与当前高亮模型的推理等级。DSH 额外显示提供商标签，首个为「最近使用」；打开时将当前模型记为最近一次使用并去重置顶，目录中仍可选的当前模型排在第一项并默认高亮。
+Codex 与 Claude 直接展示完整模型目录，不显示提供商或最近使用标签；目录加载后默认高亮当前模型。
+DSH 中 `Tab` 切到下一个提供商，`Shift+Tab` 切到上一个，首尾循环；所有后端均用 `↑/↓` 选择模型、`←/→` 调整推理等级。
+终端原生光标跟随**最后操作的区域**：`Tab`/`Shift+Tab` 移到提供商标签，`↑/↓` 移到聚焦模型的 `❯`，`←/→` 移到推理档位。移动时显示终端原本的光标形状、闪烁及已启用的动画或拖尾；停稳 **0.5 秒后隐藏**，再次移动时重新显示并计时。普通重绘不延长显示时间，输入框光标继续常显；无障碍模式保留可见焦点锚点。标签被裁剪或档位区不可见时回落到模型行。反色标签与 `❯` 始终保留，静态呈现也沿用这些焦点标记。
+确认时仅提交用户显式调整的推理草稿；只换模型时由后端沿用或校验保存的推理偏好，候选模型的默认档位不会写成新的偏好。模型选择器打开时，`Ctrl+B` 与 `Alt+Z` 仍控制侧栏，其余选择器按键由模型选择器消费。
+`Enter` 确认模型与等级，`Esc` 取消草稿。操作提示放在标题下，推理区在模型列表下独立显示标题与档位，`←/→` 提示紧贴推理标题；可选档位使用正文色，当前档位高亮。DSH、Claude、Codex 均沿用终端背景，并遮住底层文字。
+鼠标点击标签、模型和档位后，可点击标题下的「选择」应用或「取消」退出；滚轮在模型列表中移动。输入框上方空间不足时，省略导航提示、隐藏模型描述及邻项、合并推理区为一行，并把「选择 / 取消」保留在底部；仅剩两行时再隐藏推理行，保留聚焦模型与操作入口。
 
-- 旧会话仍保留在 `/resume` 中。
-- 还没有人说过话的会话不记分支：此时换模型得到的是一个不写 `parentSession` 的独立会话（继承同一份会话脚手架前缀），这样你随后打的第一个真实 prompt 仍能触发自动生成会话标题；已经对话过的会话照旧记血缘。
+`/model` 通过 DSH 的请求路由选择机制在同一会话内切换模型，保留 session ID、历史和标题。运行中的回合不能切换。下一次请求会记录实际使用的模型与模型变化提示；停放中的 agent 保留所选路由，返回该会话时也会保留；退出进程后，尚未发出请求的选择仅作为全局默认保存，从磁盘恢复仍按最后一次实际请求的路由解析。DSH 低于 `0.1.2-alpha.3` 时拒绝切换并提示升级，避免旧版子代理继续使用原模型。
 
 `/preset` 只允许空白会话原地切换。
 
@@ -619,7 +631,7 @@ dsh-tui 不修改 `~/.claude/settings.json`；会话启动时若其中的 `ANTHR
   - 浮层打开时不穿透滚动背后转录。
   - 轨迹场景移动光标（时间线一格 ±3 行、热点 ±1 行、详情展开时滚详情）。
   - 设置屏移动焦点行。
-- **拖拽**：选择文本，松开后立即复制并清除选区，弹出「已复制 N 字符」提示。
+- **拖拽**：选择文本，松开后立即复制并保留选区，弹出「已复制 N 字符」提示；重新拖选会替换现有选区。
   - `dsh-tui.scrollGutter: scrollbar` 时，右缘滚动条是拖拽目标。
   - 未修饰左键按住拖动，按轨道位置连续滚动（与点击轨道同一映射：拖到哪滚到哪）。
   - `Shift`/`Alt`/`Ctrl`+拖动仍是选字（拖拽协议只对无修饰左键开启）。
@@ -792,7 +804,7 @@ Claude 后端的审批来自 CLI：CLI 给出建议时多一个「始终允许
 
 - `/provider`、`/login`、`/logout`、`/permission`、`/add-dir`、`/hooks`、`/mcp`。
 - `/auth login deepseek-account` 或 `/provider` 完成 DeepSeek 登录后，若 Platform 返回尚未展示的登录赠金，鲸鱼女仆娘弹窗会显示“鲸鱼券”的金额与到期时间；按 Enter/Esc 关闭。
-- `/plugins`：`check <路径>` 校验插件清单。
+- `/plugin`：`list` 简洁列出你装的额外插件（不含安装自带）；`check <路径>` 校验插件清单、`info <id>` 查已装条目或待装 spec、`registries` 列安装源；无参 `/plugin` 给完整诊断（预留为插件管理面板）。
 
 **Skills**
 
@@ -802,11 +814,14 @@ Claude 后端的审批来自 CLI：CLI 给出建议时多一个「始终允许
 **其他**
 
 - `/update`、`/vim`（vim 编辑模式开关，见「输入编辑」）、`/terminal-setup`、`/connect`、`/help`。
-- `/kernel`：打开内核选择器（当前内核打勾，每行带版本与一句说明），在 DSH 与 Claude 会话里都可用。
+- `/kernel`：打开内核选择器（当前内核打勾，每行带版本与一句说明），在 DSH、Codex 与 Claude 会话里都可用。
   选中另一个内核会记住选择并重启进入它，在新内核里开新会话；原会话仍可在 `/resume` 找到，新会话
   启动失败时回到原会话。回合进行中不能切换。启动页的「内核」入口与右下角内核区打开的是同一个
   选择器。用 `--backend` 或配置行指定了内核时，本次按选择重启，之后直接启动仍按参数。全新启动
   不论记住的是哪个内核都先到启动页，带恢复目标的启动直接进入会话。
+- `/dsh`、`/codex`、`/claude`：直接选择对应内核，沿用 `/kernel` 的检查与重启流程。
+  选择当前内核只提示「已经是当前内核」；回合运行中不能切换。未安装 Claude 时打开安装向导；
+  Codex 未安装或版本过旧时显示安装/升级提示。启动尚未就绪时也可使用这三个命令。
 - `/exit`（别名 `/quit`、`/q`）。
 
 **注册表**
@@ -839,6 +854,14 @@ dsh-TUI 不预装通用技能；技能内容与发现规则由 DSH 及当前组
   - registry 服务缺失时 TUI 使用三项 legacy 兼容名册。
   - 服务已挂载但损坏、为空或不一致时标记 unavailable 并 fail closed。
   - 退出计划模式先恢复进入前的 sandbox/approval，再还原进入前所在的权限预设（registry 仍提供时）。
+  - DSH 的 `/permission` 选择以同样方式存进 `~/.dsh-tui/permission.json`：任何一次持久的预设切换
+    （选择器、手敲命令、Shift+Tab 静态模式、官方命令自行完成的切换）都会更新它；从未自定义过
+    权限面的会话按记住的预设启动，走同一条官方切换路径。这里的"从未自定义"以**用户是否动过**为准：
+    合成层自己会在每个新会话创建时写入默认预设（`dsh-permission-presets` 的 `session/created` →
+    `pinInitialPermission`），那三个事件不算用户选择——只有跑过回合、或身份不是合成默认预设的
+    会话才保有自己的权限面。计划模式的临时切换不记入（进入计划保持计划前的记忆、退出还原后再次
+    记入）；`DSH_PERMISSION_MODE` 是本次启动的初始权限面，显式设置时优先于该文件；名册已不提供
+    的身份会被跳过。
   - 非 DSH 后端（如 Claude）声明原生权限模式时，`/permission` 列的是该后端的模式：
     `default`（逐个询问）、`acceptEdits`（自动接受编辑）、`plan`（只读规划）、
     `bypassPermissions`（跳过全部权限确认），模型支持时还有 `auto`，每行带一句解释。

package/guide/dsh-tui-guide/plugins.en.md

@@ -26,9 +26,13 @@ live in the admission & development guide.
 
 ## Seam stability reference
 
-An **informal** maturity grading to help plugin authors gauge investment;
-the authoritative status and compatibility agreement live in the
-[admission & development guide](../tui-profile/docs/plugin-admission-and-development.md):
+A maturity grading to help plugin authors gauge investment; the authoritative
+status and compatibility agreement live in the
+[admission & development guide](../tui-profile/docs/plugin-admission-and-development.md).
+**The "stable candidate" tier is part of the frozen public surface as of the first
+published apiVersion (`tui.dsh/v1alpha1`)** — the four commitments are in
+`tui-profile/CHANGELOG.md`'s freeze entry; the other two tiers stay a **maturity
+reference**, not a promise:
 
 | Tier | Seams |
 | --- | --- |
@@ -52,6 +56,14 @@ Also an experimental public surface:
 - The `@deepseek-harness-tui/dsh-tui/test-utils` subpath and
   `ctx.tuiPluginHost.grants.corrupt` were removed in the adapter layering
   refactor (#705).
+- **The backend contribution family (`tui.dsh/v1alpha1` `Backend`, seam XIV) has its
+  public surface frozen with the first published apiVersion**: the type surface
+  (`BackendSpec`, `validateBackendSpec`, `backendAdmission`) and conformance
+  (`TUI-BACKEND-001`) are usable, and the **admission chain (manifest →
+  registry → descriptor) is wired**; what is still missing is the step that
+  reads a mounted bundle's declaration into the registry and the kernel picker
+  (the install chain), so "install a third-party backend, restart, see it in the
+  picker" does not hold end to end yet.
 - `grants` is now the narrower `HostGrantFacade`; see that PR for migration
   details.
 - On `TuiSceneProps.channel` (`ChannelUi`), `minimal` / `setMinimal()` were
@@ -68,6 +80,27 @@ Also an experimental public surface:
   callers means both aliases and the `'setMinimal': 'mutate'` row in
   `ui-policy.ts` are deleted in v0.13; any remaining caller is migrated within
   that same release rather than postponing the removal again.
+- **The DSH kernel in the package's own entry** (the default since the
+  standalone host, [configuration](configuration.en.md)): the screen mounts
+  before the profile composes, so plugin rows activate *after* the first
+  frame and every `ctx.tui*` registration reaches an already-mounted screen
+  (themes, panels, status views and the rest join live). A runtime theme the
+  user had chosen is applied once its plugin registers it; until then the
+  first frames use the auto-detected palette. The root-capability guard is
+  the same as under `dsh --profile`: a row activating after the first TUI row
+  cannot use `ctx.root` capabilities (`root.plugin`, `root.effect`,
+  `root.on`, …) in its apply. A plugin that waits for something in its apply
+  holds the composition: start long work detached, not awaited. On a scene's
+  `TuiSceneProps.channel`, `ready` is `false` (and `status` `'starting'`)
+  while no session stands behind the channel, e.g. after the startup session
+  failed to open (`startupFailure`).
+- **Claude and Codex kernels** (light profile; accepted on Claude, not yet on
+  Codex, which takes the same composition path): the entry composes this
+  package's rows and the third-party bundles the profile declares, without
+  `@deepseek-ai/dsh-base`, after the first frame, on the same terms as above.
+  A row whose `inject` names a service only DSH's core provides (`agents`,
+  `llm`, `tools`, `sessionPersistence`, …) stays pending on these kernels;
+  the `tui*` services are all there.
 
 - The core repository remains independent; community plugins live in their own
   repos.

package/guide/dsh-tui-guide/plugins.md

@@ -24,8 +24,10 @@
 
 ## 接缝稳定性参考
 
-按当前实现成熟度给出的**非正式**分级，帮助插件作者评估投入；正式
-状态与兼容性协定以[准入与开发指南](../tui-profile/docs/plugin-admission-and-development.md)为准：
+按当前实现成熟度给出的分级，帮助插件作者评估投入；正式
+状态与兼容性协定以[准入与开发指南](../tui-profile/docs/plugin-admission-and-development.md)为准。
+**「稳定候选」那一档已随第一版 apiVersion（`tui.dsh/v1alpha1`）纳入冻结的公开面承诺**
+（四条承诺见 `tui-profile/CHANGELOG.md` 的冻结条目）；其余两档仍是**成熟度参考**，不构成承诺：
 
 | 分级 | 接缝 |
 | --- | --- |
@@ -46,6 +48,11 @@
   `@deepseek-harness-tui/dsh-tui/panels` 与 `./api`。
 - `@deepseek-harness-tui/dsh-tui/test-utils` 子路径与
   `ctx.tuiPluginHost.grants.corrupt` 已随 adapter 分层重构（#705）移除。
+- **后端贡献族（`tui.dsh/v1alpha1` `Backend`，接缝十四）的公开面已随第一版 apiVersion 冻结**：类型面
+  （`BackendSpec`、`validateBackendSpec`、`backendAdmission`）与 conformance
+  （`TUI-BACKEND-001`）已可用，**准入链路（清单 → registry → descriptor）已接线**；
+  仍未做的是把已挂载 bundle 的声明接进注册表与 kernel picker（装链路），所以
+  「装一个第三方后端、重启后出现在 picker 里」这条端到端流程尚未成立。
 - `grants` 收窄为 `HostGrantFacade`，迁移细节见该 PR。
 - `TuiSceneProps.channel`（`ChannelUi`）上的 `minimal` / `setMinimal()` 已更名为
   `minimalUi` / `setMinimalUi()`；旧名保留为 **deprecated 别名**，读写同一个
@@ -57,6 +64,18 @@
   `TuiSceneProps.channel` 取用该端口的插件）做一次 `.minimal` / `.setMinimal(`
   扫描：零调用方即在 v0.13 删除这两个别名与 `ui-policy.ts` 里的
   `'setMinimal': 'mutate'` 行；仍有调用方则在同一版本内完成迁移，不再顺延。
+- **DSH 内核在本包入口进程内**（独立宿主起的默认，见[配置](configuration.md)）：
+  界面先挂、profile 后组合，插件行在首帧**之后**激活，所有 `ctx.tui*` 注册都落到
+  已挂载的界面上（主题、面板、状态视图等实时加入）。用户选定的运行时主题在其插件
+  注册后生效，此前的首帧用自动检测的配色。根能力守卫与 `dsh --profile` 一致：在首个
+  TUI 行之后激活的行，apply 里不能用 `ctx.root` 的能力（`root.plugin`、
+  `root.effect`、`root.on` 等）。apply 里等待会拖住组合：耗时工作脱离 apply 启动、
+  不要 await。场景的 `TuiSceneProps.channel` 在没有会话撑着时（例如启动会话打开失败，
+  见 `startupFailure`）`ready` 为 `false`、`status` 为 `'starting'`。
+- **Claude 与 Codex 内核**（轻量 profile；Claude 已验收，Codex 走同一条组合路径但尚未验收）：入口在首帧之后组合本包的行与 profile 声明的
+  第三方 bundle，不含 `@deepseek-ai/dsh-base`，规则同上条。`inject` 里有只由 DSH 核心
+  提供的服务（`agents`、`llm`、`tools`、`sessionPersistence` 等）的行在这两个内核下保持
+  pending；`tui*` 服务都在。
 
 核心仓库保持独立，社区插件各居其位。
 生态组织只维护收录与准入规则——不对社区插件的功能、质量或安全性

package/guide/dsh-tui-guide/themes.en.md

@@ -4,22 +4,30 @@
 
 ## Built-in themes
 
-dsh-TUI provides three Gentle Mist Blue palettes, plus an `auto` pseudo-theme:
+dsh-TUI ships two palette families (six themes) plus an `auto` pseudo-theme:
 
-| Name | Purpose |
-| --- | --- |
-| `auto` | Pseudo-theme: follows the system/terminal background, resolving to `light` or `dark` |
-| `light` | White panels, ink body text, and mist-blue interaction color |
-| `dark` | Dark-terminal adaptation with warm-gray text and soft blue accents |
-| `dark-ansi` | Compatibility fallback using only the 16 ANSI colors (except the ignition pair) |
+| Name | Family | Purpose |
+| --- | --- | --- |
+| `auto` | — | Pseudo-theme: follows the system/terminal background, resolving to `light` or `dark` |
+| `light` | Mist Blue | White panels, ink body text, and mist-blue interaction color |
+| `dark` | Mist Blue | Dark-terminal adaptation with warm-gray text and soft blue accents |
+| `dark-ansi` | Mist Blue | 16-color ANSI fallback (except the ignition pair) |
+| `pink-day` | Sakura Pink | Light terminals: blush panels and sakura-pink interaction color |
+| `pink-night` | Sakura Pink | Dark terminals: warm surfaces and sakura-pink interaction color |
+| `pink-ansi` | Sakura Pink | 16-color ANSI fallback (except the ignition pair) |
+
+Both families keep the same role split (light / dark / ANSI fallback). `auto`
+resolves within the Mist Blue family only; the Sakura Pink family is selected
+explicitly.
 
 Without an explicit choice, the TUI queries the terminal background with OSC
 11 and selects `light` or `dark`. It falls back to `dark` when the terminal
 does not answer.
 
-Light-theme panels, tool cards, and image previews use white (`#FFFFFF`)
-surfaces by default; image previews use neutral borders. Dark palettes and
-accent colors are unchanged. This does not modify the terminal's own
+Light-theme panels and tool cards take their own family's surface colors (`light`
+uses white `#FFFFFF`; `pink-day` uses blush `#F9ECF1`), and their input fills are
+the warm `#F6F3ED` / `#FBF3F0`; image previews always use neutral borders. Dark
+palettes and accent colors are unchanged. This does not modify the terminal's own
 background or wallpaper.
 
 `auto` turns that one-shot startup detection into a standing choice:
@@ -131,13 +139,14 @@ A few keys carry behavior worth knowing:
   channels (`#rgb`, `#rrggbb`, `#rrggbbaa` with the alpha ignored, or `rgb(r,g,b)`); `ansi:*` /
   `ansi256(n)` — or a missing key — falls back **per key** to the built-in pair selected by the
   palette's lightness, so the other key is unaffected.
-- `cursor`: the caret fill in the main prompt, launchpad input and picker search boxes.
+- `cursor`: the painted caret fill in the main prompt, launchpad input and picker search boxes
+  during static rendering without a native cursor, plus image-token focus in the main prompt.
+  Ordinary TTY text editing uses the native cursor; shape, color, blinking and animation follow terminal settings.
   The glyph on it is whichever of `text` / `inverseText`
   contrasts better with that fill (a 16-color `ansi:*` fill, or a palette whose `text`/`inverseText`
   has no parseable channels, cannot be measured and keeps `inverseText`), so a light caret can still
-  carry dark ink. The built-ins leave it empty — empty
-  keeps the inverse-video caret for backwards compatibility; declare it only when the caret must
-  stop following the body text color.
+  carry dark ink. The built-ins leave it empty, giving the painted fallback an inverse-video block.
+  A custom fill affects these painted highlights only.
 - Transcript link text follows `accent`; an empty or unparseable accent keeps the old fixed blue.
 
 ## npm plugin themes

package/guide/dsh-tui-guide/themes.md

@@ -4,21 +4,27 @@
 
 ## 内置主题
 
-dsh-TUI 提供三套 Gentle Mist Blue 色板，外加一个 `auto` 伪主题：
+dsh-TUI 内置两个色板族共六套主题，外加一个 `auto` 伪主题：
 
-| 名称 | 用途 |
-| --- | --- |
-| `auto` | 伪主题：跟随系统/终端背景，自动解析为 `light` 或 `dark` |
-| `light` | 白色面板、墨色正文、雾蓝交互色 |
-| `dark` | 深色终端适配，暖灰正文与柔雾蓝强调色 |
-| `dark-ansi` | 只依赖 16 色 ANSI 的兼容回退（点火色对除外） |
+| 名称 | 族 | 用途 |
+| --- | --- | --- |
+| `auto` | — | 伪主题：跟随系统/终端背景，自动解析为 `light` 或 `dark` |
+| `light` | 雾蓝 | 白色面板、墨色正文、雾蓝交互色 |
+| `dark` | 雾蓝 | 深色终端适配，暖灰正文与柔雾蓝强调色 |
+| `dark-ansi` | 雾蓝 | 16 色 ANSI 兼容回退（点火色对除外） |
+| `pink-day` | 樱 | 浅色终端：淡粉面板、樱粉交互色 |
+| `pink-night` | 樱 | 深色终端：暖调面板、樱粉交互色 |
+| `pink-ansi` | 樱 | 16 色 ANSI 兼容回退（点火色对除外） |
+
+两族保持相同的角色划分（浅色 / 深色 / ANSI 回退）。`auto` 只在雾蓝族内解析，
+樱族需要显式选择。
 
 未明确指定主题时，TUI 通过 OSC 11 查询终端背景，
 在 `light` 与 `dark` 之间选择；终端不响应时回退到 `dark`。
 
-浅色主题的面板、工具卡和图片预览默认用纯白底色（`#FFFFFF`），
-图片预览用中性边框。深色主题及强调色保持原样。
-此设置不修改终端自身的背景色或壁纸。
+浅色主题的面板与工具卡各用本族的浅色表面色（雾蓝 `light` 为纯白 `#FFFFFF`，
+樱 `pink-day` 为淡粉 `#F9ECF1`；两族的输入框底色另有暖色 `#F6F3ED` / `#FBF3F0`），
+图片预览一律用中性边框。深色主题及强调色保持原样。此设置不修改终端自身的背景色或壁纸。
 
 `auto` 把这一次性启动检测变成常驻选择：
 
@@ -130,11 +136,12 @@ DSH_TUI_THEME
   出固定通道的形式（`#rgb`、`#rrggbb`、`#rrggbbaa`（alpha 会被忽略）或 `rgb(r,g,b)`）；
   写成 `ansi:*` / `ansi256(n)`（或整键缺失）时**逐键**回退到按主题明暗选定的内置点火色对，
   另一个键不受牵连。
-- `cursor`：主输入框、落地页输入框及选择器搜索框光标的填充色。
+- `cursor`：无原生光标的静态呈现中，主输入框、落地页输入框及选择器搜索框绘制光标的填充色，
+  也用于主输入框的图片标记焦点高亮。常规 TTY 文本输入使用原生光标，形状、颜色、闪烁与动画由终端配置控制。
   块上的字形取 `text` 与 `inverseText` 中对该填充对比度更高
   的一个（16 色的 `ansi:*` 填充，或 `text`/`inverseText` 解析不出通道的调色板，
   都量不出对比度，仍用 `inverseText`），所以浅色光标也能配深墨字形。
-  内置主题留空——空值表示沿用原来的反色块光标（向后兼容）；只有需要光标独立于正文色时才声明。
+  内置主题留空——绘制回退采用反色块；自定义填充只影响这些绘制高亮。
 - 正文链接的文字色跟随 `accent`；accent 为空或解析不出时回落到原来的固定蓝。
 
 ## npm 插件主题