@dsh-plus/secret-env 0.1.1 → 0.1.2

package/lib/client.js

@@ -6,6 +6,230 @@ window.__ModuleLoader__.load({
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		let react = require("react");
 		let react_jsx_runtime = require("react/jsx-runtime");
+		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
+		//#region src/client/panel-bus.ts
+		const listeners = /* @__PURE__ */ new Set();
+		/** 请求打开指定会话的密钥面板（由 /secret 命令的 onSelect 调用）。 */
+		function requestOpenSessionPanel(sessionId) {
+			for (const listener of listeners) listener(sessionId);
+		}
+		/** 订阅打开信号；返回退订器（随组件卸载清理）。 */
+		function onOpenSessionPanel(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+		//#endregion
+		//#region src/client/command.ts
+		/**
+		* `/var` 斜杠命令（dsh-client-ui-commands 的 commandUi 服务）：
+		* contribution 仅支持官方 popupSelect 壳（kind 唯一），故命令提供单个
+		* 「打开面板」动作，选中后经打开总线唤起本会话的变量面板——
+		* 完全自定义的 React 面板只能在自己占有的 overlay 槽渲染。
+		* 子代理会话不提供本命令（对齐官方 /model 的可用性过滤）。
+		* @module secret-env/client/command
+		*/
+		/** 注册 /var 命令（commandUi 服务缺席时 inject 回调不触发，自然跳过）。 */
+		function registerVarCommand(ctx, sessions, t) {
+			ctx.inject(["commandUi"], (scope) => {
+				scope.effect(() => scope.commandUi.register({
+					name: "var",
+					description: t("command.description"),
+					available: (session) => sessions.subagentAddress?.(session.sessionId) === void 0,
+					ui: {
+						kind: "popupSelect",
+						options: () => Promise.resolve([{
+							id: "open",
+							label: t("command.openPanel")
+						}]),
+						onSelect: (_option, session) => {
+							requestOpenSessionPanel(session.sessionId);
+						}
+					}
+				}), "secret-env: /var contribution");
+			});
+		}
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const mergeClasses = (...classes) => classes.filter((className, index, array) => {
+			return Boolean(className) && className.trim() !== "" && array.indexOf(className) === index;
+		}).join(" ").trim();
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/shared/src/utils/toKebabCase.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const toKebabCase = (string) => string.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/shared/src/utils/toCamelCase.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const toCamelCase = (string) => string.replace(/^([A-Z])|[\s-_]+(\w)/g, (match, p1, p2) => p2 ? p2.toUpperCase() : p1.toLowerCase());
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/shared/src/utils/toPascalCase.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const toPascalCase = (string) => {
+			const camelCase = toCamelCase(string);
+			return camelCase.charAt(0).toUpperCase() + camelCase.slice(1);
+		};
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/defaultAttributes.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		var defaultAttributes = {
+			xmlns: "http://www.w3.org/2000/svg",
+			width: 24,
+			height: 24,
+			viewBox: "0 0 24 24",
+			fill: "none",
+			stroke: "currentColor",
+			strokeWidth: 2,
+			strokeLinecap: "round",
+			strokeLinejoin: "round"
+		};
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/shared/src/utils/hasA11yProp.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const hasA11yProp = (props) => {
+			for (const prop in props) if (prop.startsWith("aria-") || prop === "role" || prop === "title") return true;
+			return false;
+		};
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/context.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const LucideContext = (0, react.createContext)({});
+		const useLucideContext = () => (0, react.useContext)(LucideContext);
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/Icon.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const Icon = (0, react.forwardRef)(({ color, size, strokeWidth, absoluteStrokeWidth, className = "", children, iconNode, ...rest }, ref) => {
+			const { size: contextSize = 24, strokeWidth: contextStrokeWidth = 2, absoluteStrokeWidth: contextAbsoluteStrokeWidth = false, color: contextColor = "currentColor", className: contextClass = "" } = useLucideContext() ?? {};
+			const calculatedStrokeWidth = absoluteStrokeWidth ?? contextAbsoluteStrokeWidth ? Number(strokeWidth ?? contextStrokeWidth) * 24 / Number(size ?? contextSize) : strokeWidth ?? contextStrokeWidth;
+			return (0, react.createElement)("svg", {
+				ref,
+				...defaultAttributes,
+				width: size ?? contextSize ?? defaultAttributes.width,
+				height: size ?? contextSize ?? defaultAttributes.height,
+				stroke: color ?? contextColor,
+				strokeWidth: calculatedStrokeWidth,
+				className: mergeClasses("lucide", contextClass, className),
+				...!children && !hasA11yProp(rest) && { "aria-hidden": "true" },
+				...rest
+			}, [...iconNode.map(([tag, attrs]) => (0, react.createElement)(tag, attrs)), ...Array.isArray(children) ? children : [children]]);
+		});
+		//#endregion
+		//#region ../../node_modules/.pnpm/lucide-react@1.38.0_react@18.2.0/node_modules/lucide-react/dist/esm/createLucideIcon.mjs
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const createLucideIcon = (iconName, iconNode) => {
+			const Component = (0, react.forwardRef)(({ className, ...props }, ref) => (0, react.createElement)(Icon, {
+				ref,
+				iconNode,
+				className: mergeClasses(`lucide-${toKebabCase(toPascalCase(iconName))}`, `lucide-${iconName}`, className),
+				...props
+			}));
+			Component.displayName = toPascalCase(iconName);
+			return Component;
+		};
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const Eye = createLucideIcon("eye", [["path", {
+			d: "M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",
+			key: "1nclc0"
+		}], ["circle", {
+			cx: "12",
+			cy: "12",
+			r: "3",
+			key: "1v7zrd"
+		}]]);
+		/**
+		* @license lucide-react v1.38.0 - ISC
+		*
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
+		*/
+		const EyeOff = createLucideIcon("eye-off", [
+			["path", {
+				d: "M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",
+				key: "ct8e1f"
+			}],
+			["path", {
+				d: "M14.084 14.158a3 3 0 0 1-4.242-4.242",
+				key: "151rxh"
+			}],
+			["path", {
+				d: "M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143",
+				key: "13bj9a"
+			}],
+			["path", {
+				d: "m2 2 20 20",
+				key: "1ooewy"
+			}]
+		]);
+		//#endregion
+		//#region ../shared/src/client/icons.tsx
+		function lucideProps(props) {
+			return {
+				size: props.size ?? 14,
+				className: props.className,
+				"aria-hidden": true
+			};
+		}
+		/** 可见（注入生效）语义——官方基元无 Eye 系，lucide 补齐。 */
+		function IconEye(props) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Eye, { ...lucideProps(props) });
+		}
+		/** 已屏蔽（本会话/全局不注入）语义。 */
+		function IconEyeOff(props) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(EyeOff, { ...lucideProps(props) });
+		}
+		//#endregion
 		//#region ../shared/src/client/fetch.ts
 		/**
 		* 同源自定义端点的最小 fetch 封装（各插件 client/api.ts 的公共收编版）。
@@ -175,6 +399,137 @@ ${extra}
 			return tag;
 		}
 		//#endregion
+		//#region src/client/i18n.ts
+		/**
+		* 浏览器半文案（zh/en）。公共键来自 shared common，本文件只维护业务键。
+		* @module secret-env/client/i18n
+		*/
+		const NS = "dsh-plus-secret-env";
+		const ownZh = {
+			nav: "环境变量",
+			title: "环境变量",
+			description: "以 $DSH_VAR_* 变量名向 agent 暴露值（密钥、链接等）：值在每次 shell 调用时由宿主注入，不进入对话记录与提示词，不影响上下文缓存。",
+			globalList: "全局变量",
+			configured: "已配置",
+			unconfigured: "未配置",
+			readonly: "只读来源",
+			addGlobal: "添加全局变量",
+			nameLabel: "变量名",
+			nameHint: "大写字母/数字/下划线，如 GITHUB_TOKEN；模型实际使用 $DSH_VAR_ 前缀拼接后的完整名。",
+			valueLabel: "值",
+			valueHint: "写入后不可回读；保存于宿主凭据库，不进入对话。",
+			descLabel: "描述（可选）",
+			descHint: "仅人读备注，不进提示词。",
+			save: "保存",
+			saving: "保存中…",
+			delete: "删除",
+			copy: "复制变量名",
+			copied: "已复制",
+			emptyGlobal: "暂无全局变量。添加后 agent 即可通过变量名引用。",
+			loadFailed: "加载失败，请稍后重试。",
+			retry: "重试",
+			inheritedList: "继承变量（宿主环境）",
+			inheritedNote: "来自宿主进程环境，默认纳入注入",
+			inheritedEmpty: "宿主环境中没有可继承的 DSH_VAR_* 变量。",
+			maskGlobal: "全局屏蔽",
+			unmaskGlobal: "恢复注入",
+			maskedBadge: "已屏蔽",
+			maskedGlobalBadge: "已全局屏蔽",
+			sessionManage: "会话变量",
+			sessionPick: "选择会话",
+			sessionPickEmpty: "暂无会话",
+			sessionSecrets: "会话变量",
+			sessionList: "会话变量",
+			sessionEmpty: "本会话暂无变量。",
+			sessionHint: "仅当前会话的 shell 命令可用；会话结束或一次性使用即失效。",
+			addSession: "添加会话变量",
+			onceLabel: "一次性（首次使用后销毁）",
+			globalInSession: "全局变量（可在本会话屏蔽）",
+			inheritedInSession: "继承变量（可在本会话屏蔽）",
+			maskSession: "在本会话屏蔽",
+			unmaskSession: "在本会话恢复",
+			close: "关闭",
+			refresh: "刷新",
+			scopeGlobal: "全局",
+			scopeSession: "会话",
+			scopeOnce: "一次性",
+			scopeInherited: "继承",
+			"menu.title": "变量",
+			"menu.aria": "变量候选",
+			"command.description": "管理本会话的环境变量（密钥、链接等）",
+			"command.openPanel": "打开会话变量面板",
+			"error.invalid-name": "变量名不合法：大写字母开头，仅字母/数字/下划线，≤64 字符。",
+			"error.empty-value": "值不能为空。",
+			"error.shadowed": "进程环境中已存在同名变量且优先级更高，写入无效；请先取消该环境变量。",
+			"error.conflict": "变量名与其他插件注册的受管变量冲突。",
+			"error.no-session": "缺少会话标识，请刷新后重试。",
+			"error.method": "请求方法不允许。",
+			"error.internal": "服务内部错误，请查看宿主日志。"
+		};
+		const ownEn = {
+			nav: "Env Variables",
+			title: "Env Variables",
+			description: "Expose values (keys, links, etc.) to the agent as $DSH_VAR_* variables: values are injected by the host into each shell call, never enter the transcript or prompt, and do not affect context caching.",
+			globalList: "Global variables",
+			configured: "Configured",
+			unconfigured: "Not configured",
+			readonly: "Read-only source",
+			addGlobal: "Add global variable",
+			nameLabel: "Variable name",
+			nameHint: "Uppercase letters/digits/underscore, e.g. GITHUB_TOKEN; the model uses the full name with the $DSH_VAR_ prefix.",
+			valueLabel: "Value",
+			valueHint: "Write-only after saving; stored in the host credential store, never in chat.",
+			descLabel: "Description (optional)",
+			descHint: "Human-readable note only; never enters prompts.",
+			save: "Save",
+			saving: "Saving…",
+			delete: "Delete",
+			copy: "Copy variable name",
+			copied: "Copied",
+			emptyGlobal: "No global variables yet. Once added, the agent can reference them by name.",
+			loadFailed: "Failed to load. Try again later.",
+			retry: "Retry",
+			inheritedList: "Inherited variables (host env)",
+			inheritedNote: "From the host process environment; injected by default",
+			inheritedEmpty: "No inheritable DSH_VAR_* variables in the host environment.",
+			maskGlobal: "Mask globally",
+			unmaskGlobal: "Resume injection",
+			maskedBadge: "Masked",
+			maskedGlobalBadge: "Masked globally",
+			sessionManage: "Session variables",
+			sessionPick: "Select session",
+			sessionPickEmpty: "No sessions",
+			sessionSecrets: "Session variables",
+			sessionList: "Session variables",
+			sessionEmpty: "No session variables yet.",
+			sessionHint: "Available to shell commands of this session only; expires when the session ends or after one use.",
+			addSession: "Add session variable",
+			onceLabel: "One-time (destroyed after first use)",
+			globalInSession: "Global variables (can be masked in this session)",
+			inheritedInSession: "Inherited variables (can be masked in this session)",
+			maskSession: "Mask in this session",
+			unmaskSession: "Resume in this session",
+			close: "Close",
+			refresh: "Refresh",
+			scopeGlobal: "global",
+			scopeSession: "session",
+			scopeOnce: "once",
+			scopeInherited: "inherited",
+			"menu.title": "Variables",
+			"menu.aria": "Variable suggestions",
+			"command.description": "Manage this session's env variables (keys, links, etc.)",
+			"command.openPanel": "Open the session variable panel",
+			"error.invalid-name": "Invalid name: start with an uppercase letter; letters/digits/underscore only, ≤64 chars.",
+			"error.empty-value": "Value must not be empty.",
+			"error.shadowed": "A same-named process environment variable shadows this write; unset it first.",
+			"error.conflict": "The variable conflicts with a managed variable registered by another plugin.",
+			"error.no-session": "Missing session id; refresh and retry.",
+			"error.method": "Method not allowed.",
+			"error.internal": "Internal error; check the host log."
+		};
+		const zh = mergeDict(commonZh, ownZh);
+		const en = mergeDict(commonEn, ownEn);
+		//#endregion
 		//#region src/client/api.ts
 		/**
 		* 数据端点通道：GET list / POST set/unset（同源 fetch，值不上行到任何对话通道）。
@@ -223,477 +578,93 @@ ${extra}
 				name
 			});
 		}
+		/** 屏蔽/恢复：sessionId 缺席为全局屏蔽（设置页），否则为会话级屏蔽。 */
+		function setMask(name, masked, sessionId) {
+			return write("mask/set", {
+				name,
+				masked,
+				sessionId
+			});
+		}
 		//#endregion
-		//#region src/client/common.ts
+		//#region src/client/menu-core.ts
+		const WORD_CHAR = /[\p{L}\p{N}_]/u;
+		const TOKEN_CHAR = /^[A-Za-z0-9_]$/;
 		/**
-		* 浏览器半共享小件：错误码文案映射与复制助手（设置页与会话控件共用）。
-		* @module secret-env/client/common
+		* 检测光标处的 `$` 触发令牌。词法：
+		* - 从光标向左扫描，token 字符（字母/数字/下划线）继续，空白直接判负；
+		* - 遇到 `$` 时校验词边界：起草开头 / 前字符为空白 / 前字符为非词字符（标点）
+		*   才开闸——`foo$BAR` 这类词中 $ 不触发（与官方 URL 内 / 不触发同理）；
+		* - 其余字符（如 `{`、`(`）终止扫描。
 		*/
-		/** 端点错误 → 本地化文案（未知码回落 internal）。 */
-		function errorText(t, error) {
-			const code = error instanceof ApiError ? error.code : "internal";
-			const text = t(`error.${code}`);
-			return text === `error.${code}` ? t("error.internal") : text;
+		function detectSecretTrigger(draft, caret) {
+			if (caret <= 0 || caret > draft.length) return null;
+			for (let i = caret - 1; i >= 0; i--) {
+				const ch = draft.charAt(i);
+				if (/\s/u.test(ch)) return null;
+				if (ch !== "$") {
+					if (!TOKEN_CHAR.test(ch)) return null;
+					continue;
+				}
+				if (i > 0) {
+					const prev = draft.charAt(i - 1);
+					if (!/\s/u.test(prev) && WORD_CHAR.test(prev)) return null;
+				}
+				return {
+					query: draft.slice(i + 1, caret),
+					start: i,
+					end: caret
+				};
+			}
+			return null;
 		}
-		/** 复制文本到剪贴板（clipboard API 缺席时退 execCommand）。 */
-		async function copyText(text) {
-			try {
-				await navigator.clipboard.writeText(text);
-				return true;
-			} catch {
-				const area = document.createElement("textarea");
-				area.value = text;
-				area.style.position = "fixed";
-				area.style.opacity = "0";
-				document.body.appendChild(area);
-				area.select();
-				const ok = document.execCommand("copy");
-				area.remove();
-				return ok;
+		/** 两个命中的等价判定（抑制重复 setState）。 */
+		function sameHit(a, b) {
+			if (a === null || b === null) return a === b;
+			return a.query === b.query && a.start === b.start && a.end === b.end;
+		}
+		/** 按 query 过滤候选（大小写不敏感；变量名前缀命中排前，其余子串命中随后）。 */
+		function filterCandidates(entries, query) {
+			const q = query.toUpperCase();
+			const prefixed = [];
+			const partial = [];
+			for (const entry of entries) {
+				if (q === "") {
+					prefixed.push(entry);
+					continue;
+				}
+				if (entry.envName.toUpperCase().includes(q) || entry.name.toUpperCase().includes(q)) {
+					if (entry.name.toUpperCase().startsWith(q) || entry.envName.toUpperCase().includes(`_${q}`)) prefixed.push(entry);
+					else partial.push(entry);
+				}
 			}
+			return [...prefixed, ...partial];
+		}
+		/**
+		* 渲染文本偏移 → 草稿投影偏移。contenteditable 中芯片（引用装饰器）的
+		* 渲染文本与其草稿投影长度不等，光标渲染偏移需逐芯片修正。
+		*/
+		function applyChipCorrection(renderedOffset, chipsBeforeCaret) {
+			let offset = renderedOffset;
+			for (const chip of chipsBeforeCaret) offset -= chip.rendered - chip.draft;
+			return Math.max(0, offset);
 		}
 		//#endregion
-		//#region src/client/composer.tsx
+		//#region src/client/menu.tsx
 		/**
-		* 会话注入控件（conversation.input.right 官方插槽，session 作用域）：
-		* composer 工具行的钥匙胶囊，弹出本会话的会话级密钥面板（列表 + 增删）。
-		* 会话 id 由插槽 inject 工厂直接供给（框架解析的严格 session 作用域）。
-		* 窄屏（≤767px）popover 转底部抽屉；桌面点外部或 Esc 关闭。
-		* @module secret-env/client/composer
+		* `$` 触发补全菜单（conversation.input.overlay 官方插槽，session 作用域）：
+		* 在 composer 中输入 `$` 弹出密钥名候选（对齐官方 / 命令与 @ 引用的交互）。
+		*
+		* 官方 input-trigger 管线的检测核硬编码 '/' 与 '@'（TriggerChar 联合类型），
+		* '$' 进不了官方检测，故检测与菜单由本组件自理，插入复用官方会话作用域
+		* bail 通道 'slash/input-insert-text'（span + draftRev CAS，编辑器内应用）。
+		* @module secret-env/client/menu
 		*/
-		const EMPTY_FORM$1 = {
-			name: "",
-			value: "",
-			description: "",
-			once: false
-		};
-		function SessionRow(props) {
-			const { t, entry } = props;
-			const [copied, setCopied] = (0, react.useState)(false);
-			const timer = (0, react.useRef)(null);
-			(0, react.useEffect)(() => () => {
-				if (timer.current !== null) clearTimeout(timer.current);
-			}, []);
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "dse-row",
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "dse-rowMain",
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "dse-env",
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-							className: "dse-envName",
-							children: ["$", entry.envName]
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: "dse-iconBtn",
-							title: t("copy"),
-							"aria-label": t("copy"),
-							onClick: () => {
-								copyText(`$${entry.envName}`).then((ok) => {
-									if (!ok) return;
-									setCopied(true);
-									if (timer.current !== null) clearTimeout(timer.current);
-									timer.current = setTimeout(() => setCopied(false), 1500);
-								});
-							},
-							children: copied ? "✓" : "⧉"
-						})]
-					}), entry.description !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "dse-note",
-						children: entry.description
-					}) : null]
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "dse-badges",
-					children: [entry.once ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "dse-badge",
-						children: t("scopeOnce")
-					}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						type: "button",
-						className: "dse-iconBtn dse-delBtn",
-						title: t("delete"),
-						"aria-label": t("delete"),
-						onClick: () => {
-							unsetSession(props.sessionId, entry.name).then(() => props.onDeleted()).catch((error) => props.onError(errorText(t, error)));
-						},
-						children: "✕"
-					})]
-				})]
-			});
-		}
-		function ComposerSecret(props) {
-			const { sessionId, t } = props;
-			const [open, setOpen] = (0, react.useState)(false);
-			const [items, setItems] = (0, react.useState)(null);
-			const [form, setForm] = (0, react.useState)(EMPTY_FORM$1);
-			const [saving, setSaving] = (0, react.useState)(false);
-			const [status, setStatus] = (0, react.useState)(null);
-			const wrapRef = (0, react.useRef)(null);
-			const load = () => {
-				fetchSecrets(sessionId).then((list) => setItems(list.session)).catch(() => setStatus(errorText(t, /* @__PURE__ */ new Error("internal"))));
-			};
-			(0, react.useEffect)(() => {
-				if (!open) return;
-				load();
-			}, [open, sessionId]);
-			(0, react.useEffect)(() => {
-				if (!open) return;
-				const onDown = (event) => {
-					if (wrapRef.current !== null && !wrapRef.current.contains(event.target)) setOpen(false);
-				};
-				const onKey = (event) => {
-					if (event.key === "Escape") setOpen(false);
-				};
-				document.addEventListener("mousedown", onDown);
-				document.addEventListener("keydown", onKey);
-				return () => {
-					document.removeEventListener("mousedown", onDown);
-					document.removeEventListener("keydown", onKey);
-				};
-			}, [open]);
-			const onSave = () => {
-				setSaving(true);
-				setStatus(null);
-				setSession(sessionId, form.name, form.value, form.description, form.once).then(() => {
-					setForm(EMPTY_FORM$1);
-					load();
-				}).catch((error) => setStatus(errorText(t, error))).finally(() => setSaving(false));
-			};
-			const count = items?.length ?? 0;
-			const canSave = form.name.trim() !== "" && form.value !== "" && !saving;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-				className: "dse-wrap",
-				ref: wrapRef,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-					type: "button",
-					className: "dse-chip",
-					"aria-expanded": open,
-					"aria-label": t("sessionSecrets"),
-					title: t("sessionSecrets"),
-					onClick: () => setOpen(!open),
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("svg", {
-						width: "14",
-						height: "14",
-						viewBox: "0 0 24 24",
-						fill: "none",
-						"aria-hidden": "true",
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
-							d: "M14.5 2a7.5 7.5 0 0 0-7.36 9.04L2 20.19V22h1.81l1.5-1.5v-1.81h1.81v-1.81h1.81l1.22-1.22A7.5 7.5 0 1 0 14.5 2Zm2 5.5a1.5 1.5 0 1 1 0-3 1.5 1.5 0 0 1 0 3Z",
-							fill: "currentColor"
-						})
-					}), count > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "dse-count",
-						children: count
-					}) : null]
-				}), open ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "dse-pop",
-					role: "dialog",
-					"aria-label": t("sessionSecrets"),
-					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							className: "dse-popHead",
-							children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									className: "dse-popTitle",
-									children: t("sessionSecrets")
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "dse-iconBtn",
-									title: t("refresh"),
-									"aria-label": t("refresh"),
-									onClick: load,
-									children: "⟳"
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "dse-iconBtn",
-									title: t("close"),
-									"aria-label": t("close"),
-									onClick: () => setOpen(false),
-									children: "✕"
-								})
-							]
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: "dse-popHint",
-							children: t("sessionHint")
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "dse-popList",
-							children: items === null || items.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-								className: "dse-empty",
-								children: t("sessionEmpty")
-							}) : items.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
-								t,
-								sessionId,
-								entry,
-								onDeleted: load,
-								onError: (text) => setStatus(text === "" ? null : text)
-							}, entry.name))
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							className: "dse-popForm",
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "dse-field",
-								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "dse-head",
-										children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
-											className: "dse-label",
-											htmlFor: "dse-s-name",
-											children: t("addSession")
-										})
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										id: "dse-s-name",
-										className: "dse-input",
-										placeholder: "API_TOKEN",
-										value: form.name,
-										onChange: (event) => setForm({
-											...form,
-											name: event.target.value
-										})
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: "dse-input",
-										type: "password",
-										autoComplete: "off",
-										placeholder: t("valueLabel"),
-										value: form.value,
-										onChange: (event) => setForm({
-											...form,
-											value: event.target.value
-										})
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: "dse-input",
-										placeholder: t("descLabel"),
-										value: form.description,
-										onChange: (event) => setForm({
-											...form,
-											description: event.target.value
-										})
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "dse-checkRow",
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-											id: "dse-s-once",
-											type: "checkbox",
-											role: "switch",
-											"aria-checked": form.once,
-											checked: form.once,
-											onChange: (event) => setForm({
-												...form,
-												once: event.target.checked
-											})
-										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
-											htmlFor: "dse-s-once",
-											children: t("onceLabel")
-										})]
-									})
-								]
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "dse-foot",
-								children: [status !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									className: "dse-status dse-statusError",
-									children: status
-								}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "dse-btn dse-btnPrimary",
-									disabled: !canSave,
-									onClick: onSave,
-									children: saving ? t("saving") : t("save")
-								})]
-							})]
-						})
-					]
-				}) : null]
-			});
-		}
-		//#endregion
-		//#region src/client/i18n.ts
-		/**
-		* 浏览器半文案（zh/en）。公共键来自 shared common，本文件只维护业务键。
-		* @module secret-env/client/i18n
-		*/
-		const NS = "dsh-plus-secret-env";
-		const ownZh = {
-			nav: "密钥变量",
-			title: "密钥变量",
-			description: "以 $DSH_SECRET_* 变量名向 agent 暴露密钥：值在每次 shell 调用时由宿主注入，不进入对话记录与提示词，不影响上下文缓存。",
-			globalList: "全局密钥",
-			colName: "变量名（模型可见）",
-			colDescription: "描述",
-			colState: "状态",
-			colActions: "操作",
-			configured: "已配置",
-			unconfigured: "未配置",
-			readonly: "只读来源",
-			addGlobal: "添加全局密钥",
-			nameLabel: "变量名后缀",
-			nameHint: "大写字母/数字/下划线，如 GITHUB_TOKEN；模型实际使用 $DSH_SECRET_ 前缀拼接后的完整名。",
-			valueLabel: "值",
-			valueHint: "写入后不可回读；保存于宿主凭据库，不进入对话。",
-			descLabel: "描述（可选）",
-			descHint: "仅人读备注，不进提示词。",
-			save: "保存",
-			saving: "保存中…",
-			delete: "删除",
-			deleteConfirm: "确认删除 {name}？该变量将立即对后续命令失效。",
-			copy: "复制变量名",
-			copied: "已复制",
-			emptyGlobal: "暂无全局密钥。添加后 agent 即可通过变量名引用。",
-			loadFailed: "加载失败，请稍后重试。",
-			retry: "重试",
-			sessionSecrets: "会话密钥",
-			sessionEmpty: "本会话暂无有默认值的密钥。",
-			sessionHint: "仅当前会话的 shell 命令可用；会话结束或一次性使用即失效。",
-			addSession: "添加会话密钥",
-			onceLabel: "一次性（首次使用后销毁）",
-			close: "关闭",
-			refresh: "刷新",
-			scopeGlobal: "全局",
-			scopeSession: "会话",
-			scopeOnce: "一次性",
-			"menu.title": "密钥变量",
-			"menu.aria": "密钥变量候选",
-			"error.invalid-name": "变量名不合法：大写字母开头，仅字母/数字/下划线，≤64 字符。",
-			"error.empty-value": "值不能为空。",
-			"error.shadowed": "进程环境中已存在同名变量且优先级更高，写入无效；请先取消该环境变量。",
-			"error.conflict": "变量名与其他插件注册的受管变量冲突。",
-			"error.no-session": "缺少会话标识，请刷新后重试。",
-			"error.method": "请求方法不允许。",
-			"error.internal": "服务内部错误，请查看宿主日志。"
-		};
-		const ownEn = {
-			nav: "Secret Variables",
-			title: "Secret Variables",
-			description: "Expose secrets to the agent as $DSH_SECRET_* variables: values are injected by the host into each shell call, never enter the transcript or prompt, and do not affect context caching.",
-			globalList: "Global secrets",
-			colName: "Variable (model-visible)",
-			colDescription: "Description",
-			colState: "State",
-			colActions: "Actions",
-			configured: "Configured",
-			unconfigured: "Not configured",
-			readonly: "Read-only source",
-			addGlobal: "Add global secret",
-			nameLabel: "Name suffix",
-			nameHint: "Uppercase letters/digits/underscore, e.g. GITHUB_TOKEN; the model uses the full name with the $DSH_SECRET_ prefix.",
-			valueLabel: "Value",
-			valueHint: "Write-only after saving; stored in the host credential store, never in chat.",
-			descLabel: "Description (optional)",
-			descHint: "Human-readable note only; never enters prompts.",
-			save: "Save",
-			saving: "Saving…",
-			delete: "Delete",
-			deleteConfirm: "Delete {name}? The variable stops working for subsequent commands immediately.",
-			copy: "Copy variable name",
-			copied: "Copied",
-			emptyGlobal: "No global secrets yet. Once added, the agent can reference them by name.",
-			loadFailed: "Failed to load. Try again later.",
-			retry: "Retry",
-			sessionSecrets: "Session secrets",
-			sessionEmpty: "No session secrets yet.",
-			sessionHint: "Available to shell commands of this session only; expires when the session ends or after one use.",
-			addSession: "Add session secret",
-			onceLabel: "One-time (destroyed after first use)",
-			close: "Close",
-			refresh: "Refresh",
-			scopeGlobal: "global",
-			scopeSession: "session",
-			scopeOnce: "once",
-			"menu.title": "Secret variables",
-			"menu.aria": "Secret variable suggestions",
-			"error.invalid-name": "Invalid name: start with an uppercase letter; letters/digits/underscore only, ≤64 chars.",
-			"error.empty-value": "Value must not be empty.",
-			"error.shadowed": "A same-named process environment variable shadows this write; unset it first.",
-			"error.conflict": "The variable conflicts with a managed variable registered by another plugin.",
-			"error.no-session": "Missing session id; refresh and retry.",
-			"error.method": "Method not allowed.",
-			"error.internal": "Internal error; check the host log."
-		};
-		const zh = mergeDict(commonZh, ownZh);
-		const en = mergeDict(commonEn, ownEn);
-		//#endregion
-		//#region src/client/menu-core.ts
-		const WORD_CHAR = /[\p{L}\p{N}_]/u;
-		const TOKEN_CHAR = /^[A-Za-z0-9_]$/;
-		/**
-		* 检测光标处的 `$` 触发令牌。词法：
-		* - 从光标向左扫描，token 字符（字母/数字/下划线）继续，空白直接判负；
-		* - 遇到 `$` 时校验词边界：起草开头 / 前字符为空白 / 前字符为非词字符（标点）
-		*   才开闸——`foo$BAR` 这类词中 $ 不触发（与官方 URL 内 / 不触发同理）；
-		* - 其余字符（如 `{`、`(`）终止扫描。
-		*/
-		function detectSecretTrigger(draft, caret) {
-			if (caret <= 0 || caret > draft.length) return null;
-			for (let i = caret - 1; i >= 0; i--) {
-				const ch = draft.charAt(i);
-				if (/\s/u.test(ch)) return null;
-				if (ch !== "$") {
-					if (!TOKEN_CHAR.test(ch)) return null;
-					continue;
-				}
-				if (i > 0) {
-					const prev = draft.charAt(i - 1);
-					if (!/\s/u.test(prev) && WORD_CHAR.test(prev)) return null;
-				}
-				return {
-					query: draft.slice(i + 1, caret),
-					start: i,
-					end: caret
-				};
-			}
-			return null;
-		}
-		/** 两个命中的等价判定（抑制重复 setState）。 */
-		function sameHit(a, b) {
-			if (a === null || b === null) return a === b;
-			return a.query === b.query && a.start === b.start && a.end === b.end;
-		}
-		/** 按 query 过滤候选（大小写不敏感；变量名前缀命中排前，其余子串命中随后）。 */
-		function filterCandidates(entries, query) {
-			const q = query.toUpperCase();
-			const prefixed = [];
-			const partial = [];
-			for (const entry of entries) {
-				if (q === "") {
-					prefixed.push(entry);
-					continue;
-				}
-				if (entry.envName.toUpperCase().includes(q) || entry.name.toUpperCase().includes(q)) {
-					if (entry.name.toUpperCase().startsWith(q) || entry.envName.toUpperCase().includes(`_${q}`)) prefixed.push(entry);
-					else partial.push(entry);
-				}
-			}
-			return [...prefixed, ...partial];
-		}
-		/**
-		* 渲染文本偏移 → 草稿投影偏移。contenteditable 中芯片（引用装饰器）的
-		* 渲染文本与其草稿投影长度不等，光标渲染偏移需逐芯片修正。
-		*/
-		function applyChipCorrection(renderedOffset, chipsBeforeCaret) {
-			let offset = renderedOffset;
-			for (const chip of chipsBeforeCaret) offset -= chip.rendered - chip.draft;
-			return Math.max(0, offset);
-		}
-		//#endregion
-		//#region src/client/menu.tsx
-		/**
-		* `$` 触发补全菜单（conversation.input.overlay 官方插槽，session 作用域）：
-		* 在 composer 中输入 `$` 弹出密钥名候选（对齐官方 / 命令与 @ 引用的交互）。
-		*
-		* 官方 input-trigger 管线的检测核硬编码 '/' 与 '@'（TriggerChar 联合类型），
-		* '$' 进不了官方检测，故检测与菜单由本组件自理，插入复用官方会话作用域
-		* bail 通道 'slash/input-insert-text'（span + draftRev CAS，编辑器内应用）。
-		* @module secret-env/client/menu
-		*/
-		const FALLBACK_INPUT = {
-			draft: "",
-			draftRev: 0,
-			phase: "plain",
-			occurrences: []
+		const FALLBACK_INPUT = {
+			draft: "",
+			draftRev: 0,
+			phase: "plain",
+			occurrences: []
 		};
 		/** 本组件容器向上找到 composer 卡片与 Lexical contenteditable 根。 */
 		function editorRootOf(el) {
@@ -728,18 +699,27 @@ ${extra}
 			return applyChipCorrection(rendered, corrections);
 		}
 		function toCandidates(list) {
-			return [...list.session.map((entry) => ({
-				envName: entry.envName,
-				name: entry.name,
-				description: entry.description,
-				scope: "session",
-				once: entry.once
-			})), ...list.global.map((entry) => ({
-				envName: entry.envName,
-				name: entry.name,
-				description: entry.description,
-				scope: "global"
-			}))];
+			return [
+				...list.session.map((entry) => ({
+					envName: entry.envName,
+					name: entry.name,
+					description: entry.description,
+					scope: "session",
+					once: entry.once
+				})),
+				...list.global.filter((entry) => !entry.masked).map((entry) => ({
+					envName: entry.envName,
+					name: entry.name,
+					description: entry.description,
+					scope: "global"
+				})),
+				...list.inherited.filter((entry) => !entry.masked).map((entry) => ({
+					envName: entry.envName,
+					name: entry.name,
+					description: "",
+					scope: "inherited"
+				}))
+			];
 		}
 		function SecretMenu(props) {
 			const { sessionId, t, insertToken } = props;
@@ -784,137 +764,589 @@ ${extra}
 			const candidates = hit === null || items === null ? [] : filterCandidates(items, hit.query);
 			const open = hit !== null && candidates.length > 0;
 			(0, react.useEffect)(() => {
-				const root = editorRootOf(wrapRef.current);
-				if (root === null) return;
-				const onStart = () => {
-					composingRef.current = true;
-				};
-				const onEnd = () => {
-					composingRef.current = false;
-				};
-				root.addEventListener("compositionstart", onStart);
-				root.addEventListener("compositionend", onEnd);
-				return () => {
-					root.removeEventListener("compositionstart", onStart);
-					root.removeEventListener("compositionend", onEnd);
-				};
-			}, []);
-			const pick = (entry) => {
-				if (hit === null) return;
-				const span = {
-					start: hit.start,
-					end: hit.end,
-					draftRev: input.draftRev
-				};
-				insertToken(`$${entry.envName} `, span);
-				suppressedRef.current = null;
-				setHit(null);
+				const root = editorRootOf(wrapRef.current);
+				if (root === null) return;
+				const onStart = () => {
+					composingRef.current = true;
+				};
+				const onEnd = () => {
+					composingRef.current = false;
+				};
+				root.addEventListener("compositionstart", onStart);
+				root.addEventListener("compositionend", onEnd);
+				return () => {
+					root.removeEventListener("compositionstart", onStart);
+					root.removeEventListener("compositionend", onEnd);
+				};
+			}, []);
+			const pick = (entry) => {
+				if (hit === null) return;
+				const span = {
+					start: hit.start,
+					end: hit.end,
+					draftRev: input.draftRev
+				};
+				insertToken(`$${entry.envName} `, span);
+				suppressedRef.current = null;
+				setHit(null);
+			};
+			const pickRef = (0, react.useRef)(pick);
+			pickRef.current = pick;
+			const candidatesRef = (0, react.useRef)(candidates);
+			candidatesRef.current = candidates;
+			const highlightRef = (0, react.useRef)(highlight);
+			highlightRef.current = highlight;
+			(0, react.useEffect)(() => {
+				if (!open) return;
+				const root = editorRootOf(wrapRef.current);
+				if (root === null) return;
+				const onKey = (event) => {
+					const list = candidatesRef.current;
+					if (event.key === "ArrowDown" || event.key === "ArrowUp") {
+						event.preventDefault();
+						event.stopPropagation();
+						const delta = event.key === "ArrowDown" ? 1 : -1;
+						setHighlight((prev) => (prev + delta + list.length) % list.length);
+						return;
+					}
+					if (event.key === "Enter" || event.key === "Tab") {
+						const entry = list[highlightRef.current] ?? list[0];
+						if (entry !== void 0) {
+							event.preventDefault();
+							event.stopPropagation();
+							pickRef.current(entry);
+						}
+						return;
+					}
+					if (event.key === "Escape") {
+						event.preventDefault();
+						event.stopPropagation();
+						suppressedRef.current = hit;
+						setHit(null);
+					}
+				};
+				root.addEventListener("keydown", onKey, true);
+				return () => root.removeEventListener("keydown", onKey, true);
+			}, [open, hit]);
+			(0, react.useEffect)(() => {
+				if (!open) return;
+				const onDown = (event) => {
+					if (!(event.target instanceof Node)) return;
+					if ((wrapRef.current?.closest("[data-composer-card]"))?.contains(event.target) === true) return;
+					setHit(null);
+				};
+				document.addEventListener("pointerdown", onDown, true);
+				return () => document.removeEventListener("pointerdown", onDown, true);
+			}, [open]);
+			(0, react.useEffect)(() => {
+				setHighlight((prev) => candidates.length === 0 ? 0 : Math.min(prev, candidates.length - 1));
+			}, [candidates.length]);
+			if (!open) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dse-menuWrap",
+				ref: wrapRef
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dse-menuWrap",
+				ref: wrapRef,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-menu",
+					role: "listbox",
+					"aria-label": t("menu.aria"),
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-menuTitle",
+						children: t("menu.title")
+					}), candidates.map((entry, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+						type: "button",
+						role: "option",
+						"aria-selected": index === highlight,
+						title: `$${entry.envName}`,
+						className: `dse-menuItem${index === highlight ? " dse-menuItemActive" : ""}`,
+						onMouseEnter: () => setHighlight(index),
+						onMouseDown: (event) => {
+							event.preventDefault();
+							pick(entry);
+						},
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dse-menuName",
+								children: entry.name
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dse-menuDesc",
+								children: entry.description
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "dse-menuBadges",
+								children: [entry.once === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dse-badge",
+									children: t("scopeOnce")
+								}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dse-badge dse-badgeDim",
+									children: entry.scope === "session" ? t("scopeSession") : entry.scope === "inherited" ? t("scopeInherited") : t("scopeGlobal")
+								})]
+							})
+						]
+					}, `${entry.scope}:${entry.name}`))]
+				})
+			});
+		}
+		//#endregion
+		//#region src/names.ts
+		/** 后缀语法：POSIX 环境变量名，大写字母开头，总长（含前缀）不超过 79。 */
+		const SUFFIX_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+		const MAX_SUFFIX_LENGTH = 64;
+		/** 规范化用户输入：去空白并转大写。 */
+		function normalizeSuffix(raw) {
+			return raw.trim().toUpperCase();
+		}
+		/** 校验规范化后的后缀；合法返回 null，非法返回失败码。 */
+		function validateSuffix(suffix) {
+			if (suffix.length === 0) return "empty";
+			if (suffix.length > MAX_SUFFIX_LENGTH) return "too-long";
+			if (!SUFFIX_PATTERN.test(suffix)) return "bad-charset";
+			return null;
+		}
+		//#endregion
+		//#region src/client/common.ts
+		/**
+		* 浏览器半共享小件：错误码文案映射、复制助手与变量名输入规则
+		* （设置页与会话控件共用；名称规则与 node 半 names.ts 同源）。
+		* @module secret-env/client/common
+		*/
+		/** 端点错误 → 本地化文案（未知码回落 internal）。 */
+		function errorText(t, error) {
+			const code = error instanceof ApiError ? error.code : "internal";
+			const text = t(`error.${code}`);
+			return text === `error.${code}` ? t("error.internal") : text;
+		}
+		/** 名称输入的实时规范化：键入即转大写（去空白交给保存时的 normalizeSuffix）。 */
+		function liveName(raw) {
+			return raw.toUpperCase();
+		}
+		/** 名称输入的实时校验：空串不标错（必填兜底），其余按 names.ts 规则判定。 */
+		function nameErrorOf(raw) {
+			if (raw.trim() === "") return null;
+			return validateSuffix(normalizeSuffix(raw));
+		}
+		/** 复制文本到剪贴板（clipboard API 缺席时退 execCommand）。 */
+		async function copyText(text) {
+			try {
+				await navigator.clipboard.writeText(text);
+				return true;
+			} catch {
+				const area = document.createElement("textarea");
+				area.value = text;
+				area.style.position = "fixed";
+				area.style.opacity = "0";
+				document.body.appendChild(area);
+				area.select();
+				const ok = document.execCommand("copy");
+				area.remove();
+				return ok;
+			}
+		}
+		//#endregion
+		//#region src/client/panel.tsx
+		/**
+		* 会话密钥面板（复用件）：会话级密钥的列表/增删 + 全局与继承变量的
+		* 会话内屏蔽开关。两个宿主共用——overlay 槽的面板宿主（/secret 命令唤起，
+		* 传 onClose）与设置页的会话管理区（选择会话后内嵌，无头栏）。
+		* 值只经同源端点下行，绝不回显。
+		* @module secret-env/client/panel
+		*/
+		const EMPTY_FORM$1 = {
+			name: "",
+			value: "",
+			description: "",
+			once: false
+		};
+		/** 复制按钮（复制成功短暂亮勾）。 */
+		function CopyButton$1(props) {
+			const { t } = props;
+			const [copied, setCopied] = (0, react.useState)(false);
+			const timer = (0, react.useRef)(null);
+			(0, react.useEffect)(() => () => {
+				if (timer.current !== null) clearTimeout(timer.current);
+			}, []);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: "dse-iconBtn",
+				title: t("copy"),
+				"aria-label": t("copy"),
+				onClick: () => {
+					copyText(props.text).then((ok) => {
+						if (!ok) return;
+						setCopied(true);
+						if (timer.current !== null) clearTimeout(timer.current);
+						timer.current = setTimeout(() => setCopied(false), 1500);
+					});
+				},
+				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 })
+			});
+		}
+		/** 会话内屏蔽开关（眼睛语义：可见=注入，划掉=本会话屏蔽）。 */
+		function MaskToggle(props) {
+			const { t, masked } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: `dse-iconBtn dse-maskBtn${masked ? " dse-maskBtnOn" : ""}`,
+				title: masked ? t("unmaskSession") : t("maskSession"),
+				"aria-label": masked ? t("unmaskSession") : t("maskSession"),
+				"aria-pressed": masked,
+				onClick: props.onToggle,
+				children: masked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconEyeOff, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconEye, { size: 14 })
+			});
+		}
+		function SessionRow(props) {
+			const { t, entry } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dse-row",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-rowMain",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-env",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: "dse-envName",
+							children: ["$", entry.envName]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton$1, {
+							t,
+							text: `$${entry.envName}`
+						})]
+					}), entry.description !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-note",
+						children: entry.description
+					}) : null]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-badges",
+					children: [entry.once ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-badge",
+						children: t("scopeOnce")
+					}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "dse-iconBtn dse-delBtn",
+						title: t("delete"),
+						"aria-label": t("delete"),
+						onClick: () => {
+							unsetSession(props.sessionId, entry.name).then(() => props.onChanged()).catch((error) => props.onError(errorText(t, error)));
+						},
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutline16, { size: 14 })
+					})]
+				})]
+			});
+		}
+		function GlobalRow$1(props) {
+			const { t, entry } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dse-row",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-rowMain",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-env",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: `dse-envName${entry.masked ? " dse-envNameDim" : ""}`,
+							children: ["$", entry.envName]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton$1, {
+							t,
+							text: `$${entry.envName}`
+						})]
+					}), entry.description !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-note",
+						children: entry.description
+					}) : null]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-badges",
+					children: [entry.masked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-badge",
+						children: t("maskedBadge")
+					}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)(MaskToggle, {
+						t,
+						masked: entry.masked,
+						onToggle: () => {
+							setMask(entry.name, !entry.masked, props.sessionId).then(() => props.onChanged()).catch((error) => props.onError(errorText(t, error)));
+						}
+					})]
+				})]
+			});
+		}
+		function InheritedRow$1(props) {
+			const { t, entry } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dse-row",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-rowMain",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-env",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: `dse-envName${entry.masked ? " dse-envNameDim" : ""}`,
+							children: ["$", entry.envName]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton$1, {
+							t,
+							text: `$${entry.envName}`
+						})]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-note",
+						children: t("inheritedNote")
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "dse-badges",
+					children: entry.globallyMasked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-badge dse-badgeDim",
+						children: t("maskedGlobalBadge")
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [entry.masked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-badge",
+						children: t("maskedBadge")
+					}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)(MaskToggle, {
+						t,
+						masked: entry.masked,
+						onToggle: () => {
+							setMask(entry.name, !entry.masked, props.sessionId).then(() => props.onChanged()).catch((error) => props.onError(errorText(t, error)));
+						}
+					})] })
+				})]
+			});
+		}
+		function SessionSecretsPanel(props) {
+			const { sessionId, t } = props;
+			const [data, setData] = (0, react.useState)(null);
+			const [form, setForm] = (0, react.useState)(EMPTY_FORM$1);
+			const [saving, setSaving] = (0, react.useState)(false);
+			const [status, setStatus] = (0, react.useState)(null);
+			const load = () => {
+				fetchSecrets(sessionId).then((list) => setData(list)).catch(() => setStatus(errorText(t, /* @__PURE__ */ new Error("internal"))));
+			};
+			(0, react.useEffect)(() => {
+				load();
+			}, [sessionId]);
+			const onSave = () => {
+				setSaving(true);
+				setStatus(null);
+				setSession(sessionId, form.name, form.value, form.description, form.once).then(() => {
+					setForm(EMPTY_FORM$1);
+					load();
+				}).catch((error) => setStatus(errorText(t, error))).finally(() => setSaving(false));
 			};
-			const pickRef = (0, react.useRef)(pick);
-			pickRef.current = pick;
-			const candidatesRef = (0, react.useRef)(candidates);
-			candidatesRef.current = candidates;
-			const highlightRef = (0, react.useRef)(highlight);
-			highlightRef.current = highlight;
+			const onError = (text) => setStatus(text === "" ? null : text);
+			const nameError = nameErrorOf(form.name);
+			const canSave = form.name.trim() !== "" && nameError === null && form.value !== "" && !saving;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dse-panel",
+				children: [
+					props.onClose !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-popHead",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dse-popTitle",
+								children: t("sessionSecrets")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "dse-iconBtn",
+								title: t("refresh"),
+								"aria-label": t("refresh"),
+								onClick: load,
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconRefreshOutline16, { size: 14 })
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "dse-iconBtn",
+								title: t("close"),
+								"aria-label": t("close"),
+								onClick: props.onClose,
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCloseOutline16, { size: 14 })
+							})
+						]
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dse-popHint",
+						children: t("sessionHint")
+					}),
+					status !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dse-status dse-statusError",
+						children: status
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", {
+						className: "dse-groupLabel",
+						children: t("sessionList")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-popList",
+						children: data === null || data.session.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dse-empty",
+							children: t("sessionEmpty")
+						}) : data.session.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
+							t,
+							sessionId,
+							entry,
+							onChanged: load,
+							onError
+						}, entry.name))
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-popForm",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "dse-field",
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "dse-head",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+										className: "dse-label",
+										htmlFor: "dse-s-name",
+										children: t("addSession")
+									})
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									id: "dse-s-name",
+									className: `dse-input${nameError !== null ? " dse-inputError" : ""}`,
+									placeholder: "API_TOKEN",
+									value: form.name,
+									"aria-invalid": nameError !== null,
+									onChange: (event) => setForm({
+										...form,
+										name: liveName(event.target.value)
+									})
+								}),
+								nameError !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dse-hint dse-hintError",
+									children: t("error.invalid-name")
+								}) : null,
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "dse-input",
+									type: "password",
+									autoComplete: "off",
+									placeholder: t("valueLabel"),
+									value: form.value,
+									onChange: (event) => setForm({
+										...form,
+										value: event.target.value
+									})
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "dse-input",
+									placeholder: t("descLabel"),
+									value: form.description,
+									onChange: (event) => setForm({
+										...form,
+										description: event.target.value
+									})
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "dse-checkRow",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										id: "dse-s-once",
+										type: "checkbox",
+										role: "switch",
+										"aria-checked": form.once,
+										checked: form.once,
+										onChange: (event) => setForm({
+											...form,
+											once: event.target.checked
+										})
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+										htmlFor: "dse-s-once",
+										children: t("onceLabel")
+									})]
+								})
+							]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "dse-foot",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "dse-btn dse-btnPrimary",
+								disabled: !canSave,
+								onClick: onSave,
+								children: saving ? t("saving") : t("save")
+							})
+						})]
+					}),
+					data !== null && data.global.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", {
+						className: "dse-groupLabel",
+						children: t("globalInSession")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-popList",
+						children: data.global.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(GlobalRow$1, {
+							t,
+							sessionId,
+							entry,
+							onChanged: load,
+							onError
+						}, entry.name))
+					})] }) : null,
+					data !== null && data.inherited.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", {
+						className: "dse-groupLabel",
+						children: t("inheritedInSession")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-popList",
+						children: data.inherited.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InheritedRow$1, {
+							t,
+							sessionId,
+							entry,
+							onChanged: load,
+							onError
+						}, entry.name))
+					})] }) : null
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/panel-host.tsx
+		/**
+		* 会话变量面板的 overlay 宿主（conversation.input.overlay 官方插槽，
+		* session 作用域）：常驻监听打开总线，/var 命令选中后弹出面板。
+		* 弹层定位于 composer 卡片上方（与 $ 菜单同一浮层语言）；
+		* 点外部或 Esc 关闭。闭合态不渲染面板（数据在打开时现取）。
+		* @module secret-env/client/panel-host
+		*/
+		function SessionPanelHost(props) {
+			const { sessionId, t } = props;
+			const [open, setOpen] = (0, react.useState)(false);
+			const wrapRef = (0, react.useRef)(null);
+			(0, react.useEffect)(() => onOpenSessionPanel((target) => {
+				if (target === sessionId) setOpen(true);
+			}), [sessionId]);
 			(0, react.useEffect)(() => {
 				if (!open) return;
-				const root = editorRootOf(wrapRef.current);
-				if (root === null) return;
 				const onKey = (event) => {
-					const list = candidatesRef.current;
-					if (event.key === "ArrowDown" || event.key === "ArrowUp") {
-						event.preventDefault();
-						event.stopPropagation();
-						const delta = event.key === "ArrowDown" ? 1 : -1;
-						setHighlight((prev) => (prev + delta + list.length) % list.length);
-						return;
-					}
-					if (event.key === "Enter" || event.key === "Tab") {
-						const entry = list[highlightRef.current] ?? list[0];
-						if (entry !== void 0) {
-							event.preventDefault();
-							event.stopPropagation();
-							pickRef.current(entry);
-						}
-						return;
-					}
-					if (event.key === "Escape") {
-						event.preventDefault();
-						event.stopPropagation();
-						suppressedRef.current = hit;
-						setHit(null);
-					}
+					if (event.key !== "Escape") return;
+					event.preventDefault();
+					event.stopPropagation();
+					setOpen(false);
 				};
-				root.addEventListener("keydown", onKey, true);
-				return () => root.removeEventListener("keydown", onKey, true);
-			}, [open, hit]);
-			(0, react.useEffect)(() => {
-				if (!open) return;
 				const onDown = (event) => {
 					if (!(event.target instanceof Node)) return;
-					if ((wrapRef.current?.closest("[data-composer-card]"))?.contains(event.target) === true) return;
-					setHit(null);
+					if (wrapRef.current?.contains(event.target) === true) return;
+					setOpen(false);
 				};
+				document.addEventListener("keydown", onKey, true);
 				document.addEventListener("pointerdown", onDown, true);
-				return () => document.removeEventListener("pointerdown", onDown, true);
+				return () => {
+					document.removeEventListener("keydown", onKey, true);
+					document.removeEventListener("pointerdown", onDown, true);
+				};
 			}, [open]);
-			(0, react.useEffect)(() => {
-				setHighlight((prev) => candidates.length === 0 ? 0 : Math.min(prev, candidates.length - 1));
-			}, [candidates.length]);
-			if (!open) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-				className: "dse-menuWrap",
-				ref: wrapRef
-			});
+			if (!open) return null;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-				className: "dse-menuWrap",
+				className: "dse-panelWrap",
 				ref: wrapRef,
-				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "dse-menu",
-					role: "listbox",
-					"aria-label": t("menu.aria"),
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "dse-menuTitle",
-						children: t("menu.title")
-					}), candidates.map((entry, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-						type: "button",
-						role: "option",
-						"aria-selected": index === highlight,
-						className: `dse-menuItem${index === highlight ? " dse-menuItemActive" : ""}`,
-						onMouseEnter: () => setHighlight(index),
-						onMouseDown: (event) => {
-							event.preventDefault();
-							pick(entry);
-						},
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-								className: "dse-menuName",
-								children: ["$", entry.envName]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "dse-menuDesc",
-								children: entry.description
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-								className: "dse-menuBadges",
-								children: [entry.once === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: "dse-badge",
-									children: t("scopeOnce")
-								}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: "dse-badge dse-badgeDim",
-									children: entry.scope === "session" ? t("scopeSession") : t("scopeGlobal")
-								})]
-							})
-						]
-					}, `${entry.scope}:${entry.name}`))]
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "dse-panelCard",
+					role: "dialog",
+					"aria-label": t("sessionSecrets"),
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionSecretsPanel, {
+						sessionId,
+						t,
+						onClose: () => setOpen(false)
+					})
 				})
 			});
 		}
 		//#endregion
 		//#region src/client/section.tsx
 		/**
-		* 密钥变量设置页（settings.section 官方插槽）：全局密钥的列表与增删。
-		* 只展示元数据与模型可见的完整变量名——值写入后不可回读（端点不出值）。
-		* 响应式：≤767px 行转堆叠卡、表单转单列。
+		* 环境变量设置页（settings.section 官方插槽）：
+		* - 全局变量：列表与增删（值写入后不可回读，端点不出值）；
+		* - 继承变量：识别宿主进程环境的 DSH_VAR_*（默认纳入注入），可全局屏蔽；
+		* - 会话变量：经会话选择器内嵌会话面板（会话级/一次性变量的增删与屏蔽）。
+		* 只展示元数据与模型可见的完整变量名。响应式：≤767px 行转堆叠卡、表单单列。
 		* @module secret-env/client/section
 		*/
 		const EMPTY_FORM = {
@@ -922,23 +1354,34 @@ ${extra}
 			value: "",
 			description: ""
 		};
-		/** 单行：完整变量名（复制）+ 描述 + 状态徽标 + 两步删除。 */
-		function GlobalRow(props) {
-			const { t, entry } = props;
-			const [confirming, setConfirming] = (0, react.useState)(false);
+		/** 复制按钮（复制成功短暂亮勾）。 */
+		function CopyButton(props) {
+			const { t } = props;
 			const [copied, setCopied] = (0, react.useState)(false);
 			const timer = (0, react.useRef)(null);
 			(0, react.useEffect)(() => () => {
 				if (timer.current !== null) clearTimeout(timer.current);
 			}, []);
-			const onCopy = () => {
-				copyText(`$${entry.envName}`).then((ok) => {
-					if (!ok) return;
-					setCopied(true);
-					if (timer.current !== null) clearTimeout(timer.current);
-					timer.current = setTimeout(() => setCopied(false), 1500);
-				});
-			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				className: "dse-iconBtn",
+				title: t("copy"),
+				"aria-label": t("copy"),
+				onClick: () => {
+					copyText(props.text).then((ok) => {
+						if (!ok) return;
+						setCopied(true);
+						if (timer.current !== null) clearTimeout(timer.current);
+						timer.current = setTimeout(() => setCopied(false), 1500);
+					});
+				},
+				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 })
+			});
+		}
+		/** 全局变量行：完整变量名（复制）+ 描述 + 状态徽标 + 两步删除。 */
+		function GlobalRow(props) {
+			const { t, entry } = props;
+			const [confirming, setConfirming] = (0, react.useState)(false);
 			const onDelete = () => {
 				unsetGlobal(entry.name).then(() => props.onDeleted()).catch((error) => props.onError(errorText(t, error)));
 			};
@@ -951,13 +1394,9 @@ ${extra}
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 							className: "dse-envName",
 							children: ["$", entry.envName]
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: "dse-iconBtn",
-							title: t("copy"),
-							"aria-label": t("copy"),
-							onClick: onCopy,
-							children: copied ? "✓" : "⧉"
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+							t,
+							text: `$${entry.envName}`
 						})]
 					}), entry.description !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						className: "dse-note",
@@ -991,12 +1430,94 @@ ${extra}
 							title: t("delete"),
 							"aria-label": t("delete"),
 							onClick: () => setConfirming(true),
-							children: "✕"
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutline16, { size: 14 })
 						})
 					]
 				})]
 			});
 		}
+		/** 继承变量行：来源说明 + 全局屏蔽开关（眼睛语义）。 */
+		function InheritedRow(props) {
+			const { t, entry } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dse-row",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-rowMain",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dse-env",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: `dse-envName${entry.masked ? " dse-envNameDim" : ""}`,
+							children: ["$", entry.envName]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+							t,
+							text: `$${entry.envName}`
+						})]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-note",
+						children: t("inheritedNote")
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-badges",
+					children: [entry.masked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "dse-badge",
+						children: t("maskedBadge")
+					}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: `dse-iconBtn dse-maskBtn${entry.masked ? " dse-maskBtnOn" : ""}`,
+						title: entry.masked ? t("unmaskGlobal") : t("maskGlobal"),
+						"aria-label": entry.masked ? t("unmaskGlobal") : t("maskGlobal"),
+						"aria-pressed": entry.masked,
+						onClick: () => {
+							setMask(entry.name, !entry.masked).then(() => props.onChanged()).catch((error) => props.onError(errorText(t, error)));
+						},
+						children: entry.masked ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconEyeOff, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconEye, { size: 14 })
+					})]
+				})]
+			});
+		}
+		/** 会话变量管理块：会话选择器 + 内嵌会话面板。 */
+		function SessionManageBlock(props) {
+			const { t, sessions } = props;
+			const snapshot = (0, react.useSyncExternalStore)((listener) => sessions.list.subscribe(listener), () => sessions.list.getSnapshot());
+			const [picked, setPicked] = (0, react.useState)("");
+			(0, react.useEffect)(() => {
+				sessions.refresh().catch(() => {});
+			}, []);
+			const rows = Object.values(snapshot.byId);
+			const current = rows.find((row) => row.id === picked)?.id ?? snapshot.current ?? rows[0]?.id ?? "";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+				className: "dse-groupLabel",
+				children: t("sessionManage")
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dse-form",
+				children: rows.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "dse-empty",
+					children: t("sessionPickEmpty")
+				}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dse-field",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-head",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+							className: "dse-label",
+							htmlFor: "dse-session-pick",
+							children: t("sessionPick")
+						})
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
+						id: "dse-session-pick",
+						className: "dse-input",
+						value: current,
+						onChange: (event) => setPicked(event.target.value),
+						children: rows.map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+							value: row.id,
+							children: row.displayTitle
+						}, row.id))
+					})]
+				}), current !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionSecretsPanel, {
+					sessionId: current,
+					t
+				}, current) : null] })
+			})] });
+		}
 		function SecretsSection(props) {
 			const { t } = props;
 			const [data, setData] = (0, react.useState)(null);
@@ -1042,7 +1563,8 @@ ${extra}
 					children: t("retry")
 				}) : null]
 			});
-			const canSave = form.name.trim() !== "" && form.value !== "" && !saving;
+			const nameError = nameErrorOf(form.name);
+			const canSave = form.name.trim() !== "" && nameError === null && form.value !== "" && !saving;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "dse-section",
 				children: [
@@ -1075,6 +1597,29 @@ ${extra}
 							})
 						}, entry.name))
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+						className: "dse-groupLabel",
+						children: t("inheritedList")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dse-rows",
+						children: data.inherited.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dse-empty",
+							children: t("inheritedEmpty")
+						}) : data.inherited.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InheritedRow, {
+							t,
+							entry,
+							onChanged: load,
+							onError: (text) => setStatus({
+								kind: "err",
+								text
+							})
+						}, entry.name))
+					}),
+					props.sessions !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionManageBlock, {
+						t,
+						sessions: props.sessions
+					}) : null,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
 						className: "dse-groupLabel",
 						children: t("addGlobal")
@@ -1097,17 +1642,18 @@ ${extra}
 										}),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 											id: "dse-name",
-											className: "dse-input",
+											className: `dse-input${nameError !== null ? " dse-inputError" : ""}`,
 											value: form.name,
 											placeholder: "GITHUB_TOKEN",
+											"aria-invalid": nameError !== null,
 											onChange: (event) => setForm({
 												...form,
-												name: event.target.value
+												name: liveName(event.target.value)
 											})
 										}),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-											className: "dse-hint",
-											children: t("nameHint")
+											className: `dse-hint${nameError !== null ? " dse-hintError" : ""}`,
+											children: nameError !== null ? t("error.invalid-name") : t("nameHint")
 										})
 									]
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -1215,23 +1761,22 @@ ${extra}
 .dse-delBtn:hover{color:var(--dsw-alias-label-error)}
 .dse-empty{color:var(--dsw-alias-label-tertiary);font-size:13px;padding:18px 14px;margin:0;background:var(--dsw-alias-bg-layer-3)}
 .dse-form{border:1px solid var(--dsw-alias-border-l2);border-radius:12px;background:var(--dsw-alias-bg-layer-3);padding:4px 14px 12px;margin-top:10px}
-.dse-formGrid{display:grid;grid-template-columns:1fr 1fr;gap:0 16px}
-/* 会话注入控件（composer 工具行胶囊，对齐官方 chip 语言） */
-.dse-wrap{position:relative;align-items:center;display:inline-flex}
-.dse-chip{background:var(--dsw-alias-bg-module-platform);min-width:34px;color:var(--dsw-alias-label-secondary);cursor:pointer;border:none;border-radius:999px;align-items:center;gap:4px;padding:2px 8px;font-size:13px;font-weight:500;line-height:20px;display:inline-flex}
-.dse-chip:hover:not(:disabled){color:var(--dsw-alias-label-primary)}
-.dse-chip:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:2px}
-.dse-chip:disabled{opacity:.6;cursor:default}
-.dse-count{background:var(--dsw-alias-brand-primary);color:var(--dsw-alias-bg-base);border-radius:999px;min-width:16px;text-align:center;font-size:11px;line-height:16px;padding:0 4px}
-.dse-pop{position:absolute;bottom:calc(100% + 8px);right:0;z-index:60;width:320px;max-width:calc(100vw - 24px);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 8px 28px rgba(0,0,0,.18);padding:10px 12px 12px}
+.dse-inputError{border-color:var(--dsw-alias-label-error)}
+.dse-hintError{color:var(--dsw-alias-label-error)}
+/* 会话变量面板（/var 命令唤起，overlay 槽浮层）与内嵌共用件 */
+.dse-panelWrap{position:relative}
+.dse-panelCard{position:absolute;bottom:calc(100% + 6px);left:0;right:0;z-index:60;max-height:min(60vh,560px);overflow:auto;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 8px 28px rgba(0,0,0,.18);padding:10px 12px 12px}
+.dse-maskBtnOn{color:var(--dsw-alias-label-error)}
+.dse-envNameDim{opacity:.55;text-decoration:line-through}
 .dse-popHead{align-items:center;gap:8px;display:flex;padding:2px 0 8px}
 .dse-popTitle{color:var(--dsw-alias-label-primary);font-size:13px;font-weight:600;flex:1;margin:0}
 .dse-popHint{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5;margin:0 0 8px}
-.dse-popList{flex-direction:column;display:flex;max-height:220px;overflow:auto;margin:0 -4px;padding:0 4px}
+.dse-popList{flex-direction:column;display:flex;margin:0 -4px;padding:0 4px}
 .dse-popList .dse-row{background:0 0;border-radius:8px;padding:8px 8px}
 .dse-popList .dse-row+.dse-row{border-top:1px solid var(--dsw-alias-border-l2)}
 .dse-popForm{border-top:1px solid var(--dsw-alias-border-l2);margin-top:8px;padding-top:4px}
 .dse-foot{justify-content:flex-end;gap:8px;display:flex;padding-top:8px}
+.dse-formGrid{display:grid;grid-template-columns:1fr 1fr;gap:0 16px}
 /* $ 触发补全菜单（仿官方 input-trigger MenuView 的浮层语言） */
 .dse-menuWrap{position:relative}
 .dse-menu{position:absolute;bottom:calc(100% + 6px);left:8px;z-index:60;min-width:280px;max-width:min(420px,calc(100vw - 32px));max-height:320px;overflow:auto;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 8px 28px rgba(0,0,0,.18);padding:4px}
@@ -1252,11 +1797,9 @@ ${extra}
 .dse-row{flex-wrap:wrap;padding:12px 12px}
 .dse-rowMain{flex-basis:100%}
 .dse-badges{margin-left:auto}
-.dse-pop{position:fixed;left:8px;right:8px;bottom:8px;top:auto;width:auto;max-width:none;max-height:70vh;overflow:auto}
-.dse-chip{min-height:32px}
+.dse-panelCard{position:fixed;left:8px;right:8px;bottom:8px;top:auto;max-height:70vh}
 }
 @media (pointer:coarse){
-.dse-chip{min-height:32px}
 .dse-iconBtn{min-width:44px;min-height:44px;align-items:center;justify-content:center}
 }
 `;
@@ -1289,15 +1832,12 @@ ${extra}
 				id: "dsh-plus-secret-env",
 				order: 16,
 				label: () => t("nav"),
-				inject: () => ({ t })
+				inject: () => ({
+					t,
+					sessions: c.sessions
+				})
 			}, SecretsSection));
-			c.slots.inject("conversation.input.right", () => c.slots.register({
-				name: "conversation.input.right",
-				id: "dsh-plus-secret-env",
-				order: 40,
-				locale: NS,
-				inject: (sessionId) => ({ sessionId })
-			}, ComposerSecret));
+			registerVarCommand(c, c.sessions, t);
 			c.slots.inject("conversation.input.overlay", () => c.slots.register({
 				name: "conversation.input.overlay",
 				id: "dse-secret-menu",
@@ -1319,6 +1859,13 @@ ${extra}
 					}
 				})
 			}, SecretMenu));
+			c.slots.inject("conversation.input.overlay", () => c.slots.register({
+				name: "conversation.input.overlay",
+				id: "dse-secret-panel",
+				order: 20,
+				locale: NS,
+				inject: (sessionId) => ({ sessionId })
+			}, SessionPanelHost));
 		}
 		//#endregion
 		exports.apply = apply;