@sagmans/dsh-tui 0.2.0 → 0.4.0

package/README.md

@@ -2,7 +2,7 @@
 
 Interactive terminal (TUI) surface for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): use `dsh` in a terminal instead of a browser.
 
-Status: **v1 feature-complete; published on npm as `@sagmans/dsh-tui`.** The surface owns the alternate screen, streams assistant text as markdown, renders every tool's own card, answers approvals and questions, restores and names stored conversations, switches model mid-session, runs any of the four shipped agent modes and switches between them before a session's first turn, reads a child agent's conversation in place, keeps the goal, plan mode, todo list, delegations, and background jobs above the editor with a status line below it, and hands the terminal back on every graceful exit. Publication is tag-driven with GitHub OIDC provenance and no stored npm token; see [RELEASE.md](RELEASE.md).
+Status: **v1 feature-complete; published on npm as `@sagmans/dsh-tui`.** The surface owns the alternate screen, streams assistant text as markdown, renders every tool's own card, answers approvals and questions, restores and names stored conversations, switches model mid-session, runs any of the four shipped agent modes and switches between them before a session's first turn, reads a child agent's conversation in place, keeps the goal, plan mode, todo list, delegations, and background jobs above the editor with a status line below it, nudges an agent whose plan has aged without an update, parks and restores prompt drafts per working directory, and hands the terminal back on every graceful exit. Publication is tag-driven with GitHub OIDC provenance and no stored npm token; see [RELEASE.md](RELEASE.md).
 
 ## Install
 
@@ -117,26 +117,37 @@ dsh --profile tui --no-color
 dsh --profile tui --no-bell            # do not ring when a long turn finishes
 ```
 
+Every key below is a shipped default. `/keys` lists every action the surface
+and its library can perform with the keys in force, and the `keys:` section
+moves any of them — see [Keys](#keys).
+
 | Key | Action |
 |---|---|
-| Enter | submit the prompt |
+| Enter / Shift+Enter | break the line: a prompt is written before it is sent |
+| Ctrl+Enter / Alt+Enter / Ctrl+S | submit the prompt |
 | Ctrl+C | interrupt the running turn, or leave when idle |
 | Ctrl+O | open every tool card: its header plus every retained row. Folded, a card is one line, and a shell card keeps its command plus the last 20 rows of output with a hint naming what it dropped |
 | Ctrl+Y | show or hide the calls a PTC program dispatched: one two-space-indented entry per call under its `run_code` card, named and argued from the tool's own header and wrapped at the screen edge; shown by default |
 | Shift+Tab | expand or fold the reasoning behind an answer: folded, the row names itself, its token count, and the key; opened, it adds the thought |
 | Ctrl+T | pick the reasoning effort for the next step |
+| Ctrl+R | reverse-search recorded prompts: the list opens filtered by whatever is in the bar, `enter` puts one back, `esc` keeps the draft |
+| Ctrl+X then S | stash the current draft |
+| Ctrl+X then L | open this directory's stashed drafts |
+| Ctrl+X then M | open the model picker |
+| Ctrl+X then Y | copy the last answer to the clipboard |
 | `y` / `n` / Esc | allow once, reject, or cancel a pending approval |
-| digits / space / ↑↓ / Enter / Esc | answer a question: pick or toggle, confirm, or skip one |
+| digits / space / ↑↓ / Enter / Esc | answer a question: pick or toggle, confirm, or skip one; `0` answers with your own text in the input bar |
+| typing in any picker or question | narrow the rows by fragment (`glm53` finds `GLM-5.3`); backspace widens, `esc` or Ctrl+C leaves |
 | `/` then Tab | complete commands, including every command this session registered |
 | `@` or a path then Tab | complete workspace file references |
 | `ctrl+shift+f` | search the transcript (`enter` next, `shift+enter` previous, `esc` close) |
 | `home` / `end` | jump to the start or the end of the transcript |
 | `ctrl+down` | jump to the next prompt |
-| `ctrl+b` | leave a child's conversation and return to this session |
+| `ctrl+b` | leave a child's conversation and return to this session (the status line names the key you have now) |
 | mouse wheel, drag | scroll, and copy a selection through OSC 52 |
 | `/help` | list registered and local commands |
 | `/status` | show the session id, model, permissions, context, and directory |
-| `/model` | show the route the next step will use, and the providers available |
+| `/model` | open the picker for the configured providers and their models; it heads itself with the route the next step will use, and typing filters it by fragment (`glm53` finds `GLM-5.3`) |
 | `/model <provider>` | list that provider's advertised models |
 | `/model <provider>/<model>` | use that route from the next step on (session only, nothing is written to settings) |
 | `/model <provider>/<model>/<effort>` | use that route and reasoning effort (the effort must be one the route advertises) |
@@ -152,21 +163,138 @@ dsh --profile tui --no-bell            # do not ring when a long turn finishes
 | `/export [path]` | write the visible transcript as markdown (default `dsh-session-<id>.md`) |
 | `/resume` | open another stored session without leaving the terminal |
 | `/clear` | clear the visible transcript |
+| `/history` | show how many prompts are recorded and where the file is |
+| `/history clear` | forget every recorded prompt, reporting how many went |
 | `/theme` | list every styled element and the value in force |
+| `/keys` | list every action and the keys in force; `/keys <layer>` narrows it (see [Keys](#keys)) |
+| `/stash <draft>` | park the text given after the command (`ctrl+x` then `s` parks the editor) |
+| `/stash-pop [index\|id]` | put a stashed draft into the editor and remove it (newest by default) |
+| `/stash-apply [index\|id]` | put a stashed draft into the editor and keep it |
+| `/stash-list` | pick from this directory's stashed drafts; `enter` pops the marked one |
+| `/stash-drop [index\|id]` | delete a stashed draft without using it |
+| `/stash-clear` | delete every stashed draft for this directory, after a confirmation |
 | `/quit` | leave and print the resume command |
 
-Any other `/command` goes to the command registry, so `/plan`, `/compact`, `/goal`, and `/feedback` behave as they do on the other surfaces.
+`Ctrl+X` starts a chord. For the next two seconds the footer leads with the
+prefix alone — enough to say that a key is waiting, without reciting the map —
+and a key that finishes nothing is typed as usual rather than swallowed, so a
+prefix pressed by accident costs nothing; `/help` lists the chords, `m` for the
+model picker, `p` for plan mode, `y` for the last answer, `s` to stash the
+draft, and `l` for the stashes.
+`keys.chord.prefix: alt+x` starts the chord with another key — or with a list of
+them, as so many ways in — and `prefixWindow: 0` waits for the next key instead
+of lapsing; every second key is a row of its own (`chord.model`, `chord.plan`,
+`chord.copy`, `chord.stash`, `chord.stashes`), so a chord can be respelled whole. A prefix that is not a modifier chord, that
+the surface or the prompt bar already answers (`ctrl+c`, `ctrl+s`), or that the
+terminal keeps (`ctrl+q`) is refused with the reason, and the shipped keymap
+stays in force. The chords themselves are the commands they stand for: `m`, `p`,
+`y`, `s`, and `l` ask the same dispatcher `/model`, `/plan`, `/copy`, `/stash`,
+and `/stash-list` do. Plan mode is
+the one pair that cannot share a name: `/plan` only enters, so the chord names
+`/plan off` instead when the agent is in plan mode — or is waiting for the turn
+boundary to become so — and reads that state from the plan package rather than
+from the dock.
+
+An approval or a question draws inline above the editor and takes the keyboard. A question that lists options always adds row `0. other — type your own answer`: type or paste an answer the model did not offer, and the seam receives it as that question's free text — replacing a single-select choice, or supplementing a multi-select one. `0`, or `↓` past the last option, reaches the row; `↑` walks back to the list with the text kept, and `esc` does the same from that row, because a question skipped by accident is a question answered twice — an escape from the list skips it. Free text is written in the prompt bar's own editor, drawn under that row: movement, word and line deletion, undo, completion, and multi-line paste are all the editor the reader already uses, and the prompt bar steps aside while a question is open, so a prompt written but not sent comes back untouched once the question is answered. No question hides its answer — the reader is the one who has to check what they are about to send. Every gate row wraps at the screen edge under its own label, so a long option or question is readable rather than cut.
+
+While a turn runs, a prompt submitted into the editor waits in the agent's own inbox instead of disappearing: it is drawn above the editor in the input bar's own frame, faint and italic, and moves into the transcript when the agent takes it — where it keeps that frame in the prompt's own mint shade, so what the reader typed is never mistaken for what the agent said. `editor.queued` and `editor.queued.more` restyle or hide the waiting rows; `transcript.user` restyles the submitted prompt.
+
+Every submitted line is also kept in a global prompt history at
+`$DSH_HOME/prompt-history.json`. Typing the start of a prompt that was sent
+before draws the rest of the newest match after the cursor in a faint shade.
+`Ctrl+E` takes the whole suggestion and the word-movement key takes the next
+word, and both keys fall back to their old meaning the moment nothing is
+offered. The history is deliberately global — the same prompt is useful in
+every checkout — so nothing records a directory. An exact repeat moves to the
+front instead of being stored twice. `history.ghost: false` keeps reverse
+search but stops drawing the suggestion, `history.enabled: false` stops
+recording and offering, and `history.maxEntries` bounds the file. A file this
+build cannot parse is left untouched and writes are refused, so a newer format
+is never overwritten; `/history` names it and the count, and `/history clear`
+forgets everything.
 
-## Theme
+Any other `/command` goes to the command registry, so `/plan`, `/compact`, `/goal`, and `/feedback` behave as they do on the other surfaces.
 
-Every styled element is a named token with a shipped default, so the surface can
-be restyled without touching code. Overrides live in the same user-settings
-document as every other preference (`$DSH_HOME/settings.yaml`), under a
-`dsh-tui:` section:
+## Prompt stash
+
+`ctrl+x` then `s` parks the draft the editor is holding and clears it;
+`/stash <draft>` parks a draft typed on the command line. A bare `/stash` only
+says so, because submitting a command consumes the line it was typed on and there
+is nothing left of the draft to park. `/stash-pop` puts a parked draft back and
+removes it, so a prompt written for the wrong moment survives a restart instead
+of being retyped or sent; `l` opens the list of them. A stash belongs to the exact
+working directory, so the drafts parked in one checkout never appear in another;
+the footer shows `stash N` while any are waiting, ranked above the context and
+cache numbers it shares a row with.
+
+A selector is the number the list shows in brackets — `0` is the newest — or the
+entry's own id; leaving it out takes the newest. `apply` and `pop` refuse to
+overwrite a draft already in the editor, because losing an unsent prompt to a
+restore is the one outcome the feature exists to prevent. They refuse while a
+question is borrowing the bar for the same reason: a draft written into an answer
+would be sent as one. `pop` writes the editor first and removes the entry second,
+so a crash between the two leaves the draft in the bank rather than only in a
+terminal that is gone.
+
+Nothing is cleared until the write has landed. A refusal — no room left, a bank
+past its cap, another writer holding the lock — leaves the draft in the bar,
+including a draft typed after `/stash`, which is written back into the bar before
+the write is attempted. The bar is only cleared while it still holds that same
+draft and no question has borrowed it, so an answer typed during the write is
+never wiped by a stash finishing.
+
+The bank is one JSON file per directory under `$DSH_HOME/tui-stash`, written with
+owner-only permissions (`0700` directory, `0600` file) through a no-follow open,
+and every directory the path passes through must be owned by the reader (or by
+root) and not writable by anyone else — the sticky bit is the only exception,
+since it keeps renaming to an entry's owner. Links are walked one hop at a time,
+with `..` left for the filesystem to resolve against what the link points at, and
+a link this user does not own ends the walk: a chain that jumps through a shared
+directory is refused at the directory it jumped through. A directory
+that another user or a group member could redirect the storage through is refused
+rather than trusted, which is also why a group-writable home directory fails the
+stash with the offending path named. Every update is a locked read-modify-write
+and an atomic temp-and-rename, so two surfaces in the same directory cannot lose
+each other's entries; reclaiming a lock whose owner is gone is serialized on a
+per-bank claim file, and the removal only applies to the lock it judged, so a
+holder that released in between cannot have its successor's live lock deleted. A
+contender never deletes a lock it did not publish, so losing the name to a
+successor costs a retry rather than the successor's turn.
+
+A bank whose working directory is not this one, or whose bytes do not parse, is
+moved aside as `<name>.corrupt-<time>` and reported with its path — including when
+the directory holding the copy could not be synced. A bank written by a newer
+format, or one past the size cap, is refused in place rather than moved, because
+neither is corruption. A storage directory a save had to create is flushed
+through the directory that names it before the save reports anything. If that
+flush fails, the empty directories are taken back so the retry starts clean; a
+directory another surface has already saved into is left exactly as it is, because
+an entry left unflushed costs durability while a removed bank costs the draft. Drafts are never written to a session log, and control and
+Unicode bidi controls are stripped when a draft is stored and again when it is
+read, so a hand-edited bank cannot park a terminal escape or a reordering trick in
+the bar.
+
+## Settings
+
+Every styled element is a named token with a shipped default, and every key is
+an action with one, so the surface can be restyled and rebound without touching
+code. Preferences live in the same user-settings document as every other
+(`$DSH_HOME/settings.yaml`), under a `dsh-tui:` section:
 
 ```yaml
 dsh-tui:
   subcalls: collapsed         # fold the calls a PTC program dispatched (default inline)
+  mermaid: streaming          # draw a reply's mermaid fences: off, final, or streaming (default streaming)
+  prefixWindow: 2             # seconds a chord waits for its second key; 0 waits for the next key instead
+  keys:
+    chord.prefix: ctrl+x      # the key that starts a chord; "prefix:" is the older spelling of this row
+    prompt.submit: [ctrl+enter, alt+enter, ctrl+s]
+    surface.effort: ctrl+t    # one key, or a list of them
+    tui.editor.yank: ctrl+y   # any action the library draws, by the id /keys prints
+  history:
+    enabled: true             # record prompts and offer them back (default true)
+    ghost: true               # draw the dimmed completion; reverse search stays either way (default true)
+    maxEntries: 2000          # prompts kept, newest first (1-20000, default 2000)
   palette:
     muted: '#5c5c5c'          # one shade quiets every receding element
   tokens:
@@ -181,9 +309,10 @@ dsh-tui:
 ```
 
 Every field is optional, so a section that changes one shade is enough. The
-document is hot-reloaded: an edit restyles a running session, and `/theme` shows
-each element's effective value and whether it came from an override, the
-palette, or the default.
+document is hot-reloaded: an edit restyles a running session and re-arms the
+keymap on the next press, and `/theme` shows each element's effective value and
+whether it came from an override, the palette, or the default.
+
 
 The section is not only shades. By default every session draws the calls a PTC
 program dispatched under their card, and `subcalls: collapsed` starts with the
@@ -191,6 +320,26 @@ card alone instead. `Ctrl+Y` toggles the same choice for the current session,
 and an edit to the document re-seeds it. An unknown key or value is
 refused with a notice naming it, so a typo cannot quietly do nothing.
 
+The `history` block tunes the prompt history. `enabled: false` stops recording
+and offering it; `ghost: false` keeps reverse search but stops the dimmed
+completion; `maxEntries` bounds the file, and an exact repeat moves to the
+front rather than being stored twice. `editor.ghost` styles the suggestion, and
+`NO_COLOR` or `--no-color` suppresses it entirely, because a suggestion the
+reader cannot see but could still accept is worse than none.
+
+A reply whose fenced block names `mermaid` is drawn as terminal box art instead
+of source, laid out at the width the transcript has. `mermaid: streaming` (the
+default) draws a diagram while the reply is still arriving, `final` waits for
+the turn to end, and `off` leaves every fence exactly as written. A diagram
+wider than the terminal, one the renderer cannot draw at all, or one whose source
+is larger than a frame can lay out stays as the source fence rather than being
+truncated; a settled diagram whose source was only partly readable keeps the
+fence and names what was dropped. The drawing is
+restyleable like anything else through `markdown.diagram.border`,
+`.text`, `.edge`, `.edgeLabel`, `.title`, and `.warning`, so `/theme`
+lists it with the rest. Nothing is lost by drawing: `/export` and the session
+file keep the reply exactly as the model wrote it.
+
 `fg` and `bg` accept `#rrggbb`, a palette name (`default`, `muted`, `accent`,
 `arg`, `warn`, `added`, `removed`, `user`, `assistant`), or an index. A colour is
 emitted as 24-bit when the terminal advertises it (`COLORTERM`) and degraded to
@@ -200,7 +349,7 @@ name the palette rather than a terminal slot, so on anything but a 16-colour
 terminal their contrast does not depend on what the reader's colour scheme maps
 slot 8 to. `arg` is the pale blue a card gives the argument it was called with,
 so `tool.args` is restyled on its own and stays distinct from the tool's own
-label and from its output. `user` is the rose a submitted prompt takes, so a
+label and from its output. `user` is the mint a submitted prompt takes, so a
 reader's own turns stand apart from the reply without reading either.
 
 `NO_COLOR` and `--no-color` disable styling entirely, attributes included, and
@@ -208,6 +357,49 @@ outrank everything in this section. A token or palette name the surface does not
 have is refused with the offending name, and the surface prints the refusal as a
 notice when the document loads, so a typo cannot quietly paint nothing.
 
+### Keys
+
+Every press the surface answers is an action with an id and a shipped key.
+`/keys` prints all of them with the keys in force, marks the rows you wrote,
+names the keys your map took from the library, and ends with a sample `keys:`
+section rather than a whole one; the table above it is the complete account.
+`/keys prompt`, `surface`, `chord`, `gate`, `question`,
+`picker`, and `library` narrow that list to one part of the surface.
+
+An entry is one key or a list of them. A key is a modifier chord
+(`ctrl`/`alt`/`shift` joined by `+`, written in that order), a named key
+(`enter`, `escape`, `tab`, `space`, `backspace`, `delete`, `home`, `end`,
+`pageUp`, `pageDown`, the arrows, `f1`–`f12`), or a bare character where the
+layer reads one: `y` and `n` for an approval, or a chord's second key. Ids
+beginning `tui.` are pi-tui's own actions, so the editor, the search, and the
+transcript move where you tell them to.
+
+Refused, with the reason in a notice and the shipped map left in force: an
+action the surface does not have, a key no terminal reports, `ctrl+q` (the
+terminal keeps it), a bare character outside the chord and gate layers, two
+actions of one layer on one press, a key the library already answers on a row you
+never wrote, a key the viewport reads before the surface sees it, whichever of the
+two the map moved onto it (`pageUp`, or `tui.altScreen.search` moved onto a
+surface key), a `chord.prefix` that is not a modifier chord or that takes a key
+the surface or the prompt bar answers, and `prefix:` beside
+`keys.chord.prefix:`, which are the same row under two names.
+
+Two rows count as one press when some sequence reaches both, not merely when they
+are spelled alike, because one press can arrive as several bytes and one byte can
+spell several keys. A bare terminal reports Return for `enter` and `ctrl+m`, a
+line feed for `ctrl+j` and, without the keyboard protocol, Return as well, one
+control byte carries both `ctrl+-` and `ctrl+_`, and an escape with a letter
+reaches `alt+up` as readily as `alt+p`.
+
+A key the surface or a chord answers is a key the library never sees: that is
+how `ctrl+y` shows nested calls instead of yanking a line in the editor.
+`/keys` names every shadow your map introduces, and moving the surface key
+hands the library its own key back.
+
+Left alone, because they are typing rather than commands: the keys a question's
+filter narrows with and the ones that leave its free-text row, the digits and
+row `0` that name an option, and the mouse.
+
 One residual escapes that promise, and it is not the surface's to close. After a
 component returns its rows, the framework appends a reset to each row and closes
 the hyperlink it wraps them in, so a session can still receive a bare `ESC[0m`
@@ -244,17 +436,63 @@ The package is a Cordis plugin bundle that stacks over `@deepseek-ai/dsh-base`:
 - `@deepseek-ai/dsh-agent-presets` is the roster of modes, holding the id a session starts in when nobody names one.
 - `@deepseek-ai/dsh-code-runtime-worker-thread` and `@deepseek-ai/dsh-cordis-host-runner` are the host machinery PTC mode and creator mode need; only the Web bundle shipped them, so a terminal profile has to mount them to offer those modes at all.
 - `@sagmans/dsh-tui` owns the terminal: it creates or resumes one agent through `ctx.agents`, folds `session/event` into transcript rows and work state, renders them with `@earendil-works/pi-tui`, and releases the terminal on exit, on a boot failure, and on a signal.
+- `@sagmans/dsh-tui/todo-guard` is the one advisory row this bundle adds to the agent plane: it watches the harness's own `todos` and `plan` projections and rides the next tool result with a reminder when a plan ages. See [Todo discipline](#todo-discipline).
+
+A question whose id ends in `:secret` declares its typed answer a credential: the bar hides everything but its first and last four characters, and the free-text row a question with options offers is labelled `API KEY`. Wording is not a declaration, because hiding every question that mentions a key would hide answers their authors meant to be read.
 
 The fold is durable-only: the live stream decorates the row that is still being written, and everything else — cards, reasoning, work state, compaction markers — comes from the log, so a resumed session renders what the live one did. Subagent start and finish are the exception: they arrive as service events, and the transcript shows them as decoration because the durable record of a delegation is the tool call that asked for it.
 
 Tool cards are folded by default: a card draws its header and nothing else, so a long read, diff, or search cannot bury the conversation. A shell card is the exception, because its output is the answer the reader asked for: it names the tool in its header, always shows the command that ran, keeps the last 20 output rows, and adds a hint naming the rows it dropped. `Ctrl+O` opens every card to its header plus every retained row.
 
-A PTC card is the one card with children: every call the `run_code` program dispatched hangs off the card that made it, and each draws under the header as the tool's own name and argument, wrapping rather than being cut. `Ctrl+Y` folds them away again, and `subcalls: collapsed` starts every session folded; see [Theme](#theme).
+A PTC card is the one card with children: every call the `run_code` program dispatched hangs off the card that made it, and each draws under the header as the tool's own name and argument, wrapping rather than being cut. `Ctrl+Y` folds them away again, and `subcalls: collapsed` starts every session folded; see [Settings](#settings).
 
 A card's header names the tool, then the argument the call was made with — a path or a command — in the `tool.args` colour, then the facts the result measured: a read reports its line range, line count, and token size; a file change that carried no prior content to compare against reports its lines and tokens; one that did reports added, changed, and removed lines as `+n ~n -n` in green, yellow, and red. Each stat is its own token, so any of them can be recoloured or hidden independently.
 
 The bundle also takes the base's global agent rows out of the composition, twenty-three of them. Every one is a row the shipped modes supply per session instead, so leaving it mounted registers the same tool names in two layers and doubles each prompt section it owns. What stays mounted is the host: sessions, storage, models, permissions, jobs, and the command registry.
 
+### Todo discipline
+
+The todo tool and its list belong to the agent; this bundle owns the surface and one advisory guard. `@sagmans/dsh-tui/todo-guard` mounts host-plane, reads the harness's own `todos` and `plan` projections, and — when a non-empty list has gone a threshold of model steps without a `todo_write`, or a long turn has produced no list at all — rides the next tool result with a model-visible reminder. It never vetoes a call, never steers a stopped turn, and never adds a prompt section, so its request prefix stays stable across deployments. A reminder costs the loop one extra model step to consume; the per-turn cap bounds that. It stays silent in plan mode, in a mode whose catalog has no `todo_write`, and when the projections are absent.
+
+| Option | Default | Effect |
+|---|---|---|
+| `staleSteps` | `6` | model steps a non-empty open list may age before the guard speaks |
+| `missingListSteps` | `12` | steps in a turn before the guard suggests a first list |
+| `maxRemindersPerTurn` | `3` | hard cap on reminders, and on the extra steps they cost, per turn |
+| `previewItems` | `5` | open items quoted in a reminder; the rest become a count |
+
+Override them from the home-level patch, which outranks the profile's own layers. An id-targeted patch replaces the whole config, so restate every field you keep:
+
+```yaml
+# $DSH_HOME/cordis.patch.yml
+- id: tui-todo-guard
+  config:
+    staleSteps: 4
+    missingListSteps: 12
+    maxRemindersPerTurn: 3
+    previewItems: 5
+```
+
+The list the dock and `/todo` draw follows the same lifetime every other surface shows: it is cleared when the next turn opens, because a fresh task must not inherit the previous turn's checklist.
+
+## Herdr
+
+[Herdr](https://github.com/herdrdev/herdr) is a terminal multiplexer for coding agents. When it starts this surface in one of its panes it exports `HERDR_ENV=1`, `HERDR_PANE_ID`, and `HERDR_SOCKET_PATH`, and the pane reports what it is doing over that socket — as the agent `dsh`, under the source `custom:dsh-tui`. Away from Herdr (an ordinary terminal, SSH, tmux) the reporter is inert: no socket is opened, and nothing reaches the screen the reader owns.
+
+| This surface | Herdr |
+|---|---|
+| the screen is taken, before any session opens | `idle`, claiming the pane's agent row |
+| `turn/start` | `working` |
+| an approval, a question, or a picker takes the keyboard | `blocked`, with that card's title sent along |
+| the decision settles | `working` if a turn is open, otherwise `idle` |
+| `turn/end` | `idle` |
+| a session opens, resumes, forks, or is switched to | its id and reason, plus the `dsh_session` / `dsh_cwd` pane tokens |
+| exit, signal, or boot failure | `herdr pane release-agent`, so no row is left waiting on a process that is gone |
+
+A wait outranks a running turn: a turn waiting on a human is not making progress, and the wait is the only thing worth acting on from a wall of panes. Reports are sequenced per source, so a delivery that arrives late cannot undo the state the surface already moved past, and a state Herdr is already showing is not sent again. A report is only counted as made when Herdr acknowledges it: one that failed is tried again — soon after, then with a growing wait — and a session identity Herdr never confirmed travels with the next report of any kind. The retry cannot wait for another state change, because the pane may have nothing left to say: a turn that ended while the socket was down produces no further event. States still waiting to be sent are collapsed into the newest one, so a socket that was down for a minute is told where the pane is rather than where it has been. The release carries the next number in that same sequence for the same reason: Herdr reads one that cannot beat the pane's last report as stale, and a stale release leaves the row waiting on a process that is gone. It also stops reporting first — a claim landing after the release would take the row back for a process that is leaving — and the report already on the wire is waited for before the row goes back, because Herdr ignores the release of a pane nothing has claimed yet and that late report would then claim it. What is still waiting behind it is dropped rather than sent.
+
+Herdr persists a session reference only for its own built-in integrations, so this pane's session identity travels as metadata tokens instead: a script or a companion plugin reads them back with `herdr pane get <id>` and resumes that exact conversation with `dsh --profile tui --resume=<id>`. Herdr holds a token value up to 80 characters and shortens anything longer, so a session id or directory that cannot be sent whole has its token cleared instead: a shortened path would read as a different directory, and a pane must not claim one. What Herdr cannot do is identify the process itself — its detection table and its screen rules both name built-in agents only — so a pane that has not reported yet reads as an ordinary pane, and is not yet a target: `herdr agent wait` on it fails with `agent_not_found` until the first report lands. Herdr 0.9.1 also keeps the title that accompanies a `blocked` state without showing it anywhere, so a reader sees the state and reads the card on screen.
+
 ## Development
 
 ```sh
@@ -300,40 +538,59 @@ The automated checks drive a real PTY, but they run on this machine's terminal.
 | that turn in a terminal narrower than a call's own argument | the argument wraps onto continuation rows indented to the same two spaces, with no ellipsis |
 | that same turn, then `ctrl+y` | the lines fold away; `ctrl+y` again draws them back |
 | `dsh-tui: { subcalls: collapsed }` in `$DSH_HOME/settings.yaml`, then a PTC turn | the card arrives alone, and editing the document to `inline` unfolds a running session |
+| a reply carrying a mermaid fence | it draws as box art at the transcript width, with the prose around it untouched |
+| that reply in a terminal narrower than the drawing | the fence stays source, and widening the window draws it without a new turn |
+| `dsh-tui: { mermaid: off }` in `$DSH_HOME/settings.yaml`, then a mermaid reply | the fence stays source; editing the value to `streaming` draws a settled reply without a restart |
+| type the start of a prompt already recorded | the rest of the newest match follows the cursor in a faint shade; `ctrl+e` takes it whole, the word-right key takes one word, and both keys do their old job when nothing is offered |
+| `ctrl+r`, then a fragment | reverse search opens seeded with the bar's draft; `enter` puts a prompt back, `esc` keeps the draft |
+| `dsh-tui: { history: { ghost: false } }`, then type a known prefix | no suggestion is drawn, and `ctrl+r` still searches |
+| `/history clear`, then `/history` | the notice reports the count forgotten, and the second reports `1 prompt recorded` — the check line is itself recorded |
+| `/model` on a configured profile | the picker lists only the configured providers' advertised models, heads itself with the route in force, and typing filters it while later rows stream in; `esc` or Ctrl+C leaves without changing the route, and `enter` chains into the route's reasoning efforts |
 | `/preset` on a fresh session | the picker lists four modes, marks the current one, and the switch survives a resume |
 | `/preset minimal` after a turn | refused, naming the reason; the session keeps the mode it composed with |
 | `--resume --preset <mode>` and then picking a session that runs another mode | the list stays open and says why that row cannot be taken; `esc` leaves the picker |
 | `dsh --profile tui --preset nope` | exits non-zero naming the modes that do exist, before the alternate screen appears |
 | arrow keys in a picker, or on a question's options, in a terminal that reports key events (Kitty, WezTerm, Ghostty, iTerm2) | one press moves one row, and holding a key still repeats; a terminal that sends only the legacy sequence behaves the same |
 | resize the window mid-turn | the transcript rewraps; the dock, editor, and status row stay put |
-| a 40-column terminal | rows end in `…` instead of wrapping into the next line |
+| a 40-column terminal | transcript and card rows end in `…` instead of wrapping into the next line |
+| a question with a long option at 40 columns | the option wraps onto rows indented under its label, and `0. other — type your own answer` sits under the list |
+| press `0` on a question, type an answer, press Enter | the editor under row `0` shows the text as it is edited, and the model receives it as that question's answer |
+| type a prompt without sending it, then answer a question | the prompt bar steps aside while the question is open and holds the same prompt again afterwards |
 | `echo hi \| dsh --profile tui` | refuses with a non-zero exit and a message naming the TTY requirement |
+| `/stash`, `/stash-pop` in one terminal | the footer shows `stash 1` after the stash and the draft returns to the editor after the pop |
+| a second `dsh --profile tui` in the same directory | `/stash-list` shows the draft the first terminal parked |
+| `dsh --profile tui` in another directory | `/stash-list` says `no stashed drafts`, even though the first directory still has one |
+| hand-edit `$DSH_HOME/tui-stash/<key>.json` into invalid JSON, then `/stash-list` | the surface reports the quarantine path, starts empty, and leaves the moved file readable |
 | `/quit`, Ctrl+C while idle, `kill -TERM <pid>` | the shell returns with cursor, echo, mouse, and title restored |
 
 ## Releasing
 
 Published artefacts carry a provenance attestation, which only a CI provider can issue, so releases ship from the tag workflow rather than a laptop.
 
-1. Bump `version` in `package.json`, land it on `main` through a reviewed PR, and wait for CI to pass on the merged SHA.
+1. Bump `version` in `package.json` and move `CHANGELOG.md`'s `Unreleased` section to that version, land both on `main` through a reviewed PR, and wait for CI to pass on the merged SHA.
 2. Tag that SHA with a signed tag and push it. The tag ruleset admits repository admins only.
 3. `.github/workflows/release.yml` re-runs typecheck, tests, and the package smoke; the publish job then waits for a maintainer's approval on the `npm-release` environment before it publishes with OIDC trusted publishing and automatic provenance.
 
-The workflow stores no npm token: the registry trusts `release.yml` on the `npm-release` environment, and [`scripts/npm/release.py`](scripts/npm/release.py) creates both the environment and that trust. The full runbook is [RELEASE.md](RELEASE.md).
+The workflow stores no npm token: the registry trusts `release.yml` on the `npm-release` environment, and [`scripts/npm/release.py`](scripts/npm/release.py) creates both the environment and that trust. The full runbook is [RELEASE.md](RELEASE.md); the user-visible history is [CHANGELOG.md](CHANGELOG.md).
 
 ## Limitations
 
 - Two different things are called a preset. The agent mode (`--preset`, `/preset`) is fixed once a session has produced a turn; the permission preset (`/permission <preset>`, named in the status line) can change at any time.
-- `/model` changes the route and reasoning effort for the running session only. Catalog membership is advisory — an adapter may accept an id it does not advertise, while an explicit effort is checked against the route's own levels before it is applied.
+- `/model` changes the route and reasoning effort for the running session only. Catalog membership is advisory — an adapter may accept an id it does not advertise, while an explicit effort is checked against the route's own levels before it is applied. The picker offers the routes this deployment configured, not the ones it can prove credentialed: a provider whose key or sign-in is still missing appears like any other, and its first request names the missing credential.
 - Scrolling is the mouse wheel, or the terminal's own scrollback keys where it offers them.
 - A turn that ran longer than ten seconds rings the terminal bell when it ends, because the reader may have walked away; `--no-bell` turns that off.
-- The dock shows the goal, plan mode, the todo items still to do, and any background job or delegation still running; a settled item leaves rather than turns into a completed row. The transcript marks where older history was compacted away. `/plan` toggles plan mode; `/plan <message>` also steers that message, which is the base command's own behaviour.
+- The dock shows the goal, plan mode, the todo items still to do, and any background job or delegation still running; a settled item leaves rather than turns into a completed row, and the list clears when the next turn opens so a fresh task never inherits the previous one's checklist. The transcript marks where older history was compacted away. `/plan` toggles plan mode; `/plan <message>` also steers that message, which is the base command's own behaviour.
 - Background jobs and subagent runs are live process state, not durable events: they disappear when the run ends, and a resumed session starts with an empty board and roster.
 - A card reads its tool's own render intent through the agent whose session is on screen, so a stored session with no live agent — one this process is not running, or a child that has already finished — folds to the generic card instead of the tool's own.
-- Reading a child's conversation does not move the terminal: commands, approvals, and the status line stay with the session you launched, and the transcript is the only thing that switches.
+- Reading a child's conversation does not move the terminal: commands, approvals, and the status line stay with the session you launched, and the transcript is the only thing that switches. The status line carries the way back, read from the map in force, so a remap shows up without reopening the view.
 - Delete is unimplemented: the session store exposes no delete, and the surface does not reach around that seam into its files. `/fork` covers the case that needs it — it branches into a new session and leaves the original alone.
-- Approvals and questions render inline and take the keyboard; a question batch is answered in order.
-- Styling is per element and overridable; see [Theme](#theme). Shipped defaults are emitted as 24-bit colour where the terminal advertises it and degraded to 256 or 16 colours otherwise, so a light or dark terminal still follows its own palette where it has one.
-- Tool text, model text, and file content are escaped before rendering, so a hostile result cannot inject terminal control sequences; the cost is that a literal tab shows as \x09.
+- The prompt stash holds text only. It does not read Pi's `pi-stash` data, does not migrate an older key format, and keeps no pasted images: a draft larger than 1 MiB, or a bank larger than 16 MiB, is refused rather than stored — the cap is measured on the bytes the file will hold, escapes included, before anything is written, so a refusal cannot leave a bank that saves and then refuses to load. A corrupt bank is quarantined and reported, never repaired in place; a bank from a newer format is refused where it lies, so an older build cannot swallow a newer build's drafts.
+- Approvals and questions render inline and take the keyboard; a question batch is answered in order, and a question that lists options can always be answered with free text on row `0`.
+- Inside Herdr the pane reports its own state, and that report is the only thing that makes it an agent there: Herdr cannot start, resume, or prompt this surface, so launching and resuming stay with `dsh` itself (or a Herdr plugin that runs it).
+- Styling is per element and overridable; see [Settings](#settings). Shipped defaults are emitted as 24-bit colour where the terminal advertises it and degraded to 256 or 16 colours otherwise, so a light or dark terminal still follows its own palette where it has one.
+- Tool text, model text, and file content are escaped before rendering, so a hostile result cannot inject terminal control sequences; the cost is that a literal tab shows as \x09. A stashed draft is stripped of control and bidi characters instead, because it is restored into a live editor rather than drawn as text.
+- Mermaid fences draw in assistant replies only, and only at the top level of one: a fence nested in a list, quoted inside another fence, or carried by a prompt, a thought, or a tool card stays source. Author `:::class` styling and diagram links are ignored — the renderer reports what each run is, and the theme decides how it looks.
+- Prompt history is global to this machine, not per project: `$DSH_HOME/prompt-history.json` holds every submitted line, deduplicated exactly, and a file this build cannot parse is left untouched with writes refused so a newer format is never overwritten. Every write re-reads the file under a lock shared by sessions, so a second session's prompts are folded in rather than overwritten, and a lock whose holder stopped is reclaimed or reported instead of guessed at; control characters are spelled out before a prompt is stored. A multiline suggestion draws its first line with `↵` marking the fold. `history.ghost: false` keeps reverse search without the suggestion, `history.enabled: false` stops recording and offering it, and `NO_COLOR`/`--no-color` suppresses the ghost because text the reader cannot see but could still accept is worse than none.
 
 ## License
 

package/cordis.patch.yml

@@ -97,6 +97,20 @@
         color: !!js ctx.tuiStartup.color
         bell: !!js ctx.tuiStartup.bell
 
+    # Advisory todo discipline for every agent this profile runs. The tool and
+    # its list already exist per session; this row only notices when a plan has
+    # aged and rides the next tool result with a reminder. It is host-plane on
+    # purpose: it registers no tool, provides no service, and never gates a
+    # call, so it needs no preset and no realm. `staleSteps` and the rest are
+    # documented in the README and overridable from a profile patch.
+    - id: tui-todo-guard
+      name: '@sagmans/dsh-tui/todo-guard'
+      config:
+        staleSteps: 6
+        missingListSteps: 12
+        maxRemindersPerTurn: 3
+        previewItems: 5
+
     # The roster of agent compositions, and the mode a session starts in when
     # nobody names one. PTC leads because a flagless run should reach every tool
     # through one program rather than one shell call at a time. A profile patch

package/lib/agent/model.d.ts

@@ -1,4 +1,5 @@
 import type { Context } from '@deepseek-ai/cordis';
+import type { PickerRow } from '../ui/picker.ts';
 /** The route a reader chose for the next step. */
 export interface ModelChoice {
     readonly provider: string;
@@ -10,6 +11,13 @@ export interface ProviderEntry {
     readonly id: string;
     readonly name: string;
 }
+/** One route a configured provider advertises, as the picker lists it. */
+export interface ModelRoute {
+    readonly provider: string;
+    readonly model: string;
+    /** The adapter's display name; the id stays the value a request names. */
+    readonly name: string;
+}
 /** What a `/model` argument asks the surface to do. */
 export type ModelCommand = {
     readonly kind: 'current';
@@ -36,6 +44,24 @@ export type ModelCommand = {
  * id containing a slash as an effort the adapters in use do not mint.
  */
 export declare function parseModelArgument(argument: string, providers: readonly ProviderEntry[], current: ModelChoice | undefined): ModelCommand;
+/** The picker's stable id for one route. */
+export declare function modelRouteKey(route: {
+    readonly provider: string;
+    readonly model: string;
+}): string;
+/** Read a route key back; undefined for a string this surface never minted. */
+export declare function readModelRouteKey(key: string): {
+    provider: string;
+    model: string;
+} | undefined;
+/**
+ * How one advertised route appears in the picker.
+ *
+ * The name leads because it is what a reader recognizes, and the id follows
+ * only when it says something the name does not; the route in force carries
+ * its effort, since that is the other half of the choice on screen.
+ */
+export declare function describeModelRoute(route: ModelRoute, current: ModelChoice | undefined): PickerRow;
 /**
  * Own the reader's model choice for one session.
  *

package/lib/agent/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agent/model.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,YAAY,CAyBd;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;IAC5F,OAAO,CAAC,SAAS,CAA0B;IAE3C,sFAAsF;IACtF,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI;IAKhC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAUjC,OAAO,IAAI,WAAW,GAAG,SAAS;IAUlC;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAKhC,4EAA4E;IAC5E,KAAK,IAAI,IAAI;IAKb,OAAO,IAAI,IAAI;CAIhB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAcD,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAChD,SAAS,IAAI,SAAS,aAAa,EAAE,CAAA;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAA;IAC5F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;CAC5E,GAAG,SAAS,CA+BZ"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agent/model.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,YAAY,CAyBd;AAYD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAElG;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAI9F;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAajG;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;IAC5F,OAAO,CAAC,SAAS,CAA0B;IAE3C,sFAAsF;IACtF,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI;IAKhC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAUjC,OAAO,IAAI,WAAW,GAAG,SAAS;IAUlC;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAKhC,4EAA4E;IAC5E,KAAK,IAAI,IAAI;IAKb,OAAO,IAAI,IAAI;CAIhB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAcD,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAChD,SAAS,IAAI,SAAS,aAAa,EAAE,CAAA;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAA;IAC5F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;CAC5E,GAAG,SAAS,CA+BZ"}

package/lib/agent/model.js

@@ -40,6 +40,47 @@ export function parseModelArgument(argument, providers, current) {
     }
     return { kind: 'switch', choice: { provider: current.provider, model: trimmed } };
 }
+/**
+ * The separator inside a picker's route key.
+ *
+ * A picker settles on a string, so the pair has to survive one round trip
+ * without a reading that guesses which half is which: a model id may contain
+ * the slash a `provider/model` reading would split on, and no route id can
+ * contain this character.
+ */
+const ROUTE_KEY_SEPARATOR = '\u0000';
+/** The picker's stable id for one route. */
+export function modelRouteKey(route) {
+    return route.provider + ROUTE_KEY_SEPARATOR + route.model;
+}
+/** Read a route key back; undefined for a string this surface never minted. */
+export function readModelRouteKey(key) {
+    const at = key.indexOf(ROUTE_KEY_SEPARATOR);
+    if (at <= 0 || at === key.length - 1)
+        return undefined;
+    return { provider: key.slice(0, at), model: key.slice(at + 1) };
+}
+/**
+ * How one advertised route appears in the picker.
+ *
+ * The name leads because it is what a reader recognizes, and the id follows
+ * only when it says something the name does not; the route in force carries
+ * its effort, since that is the other half of the choice on screen.
+ */
+export function describeModelRoute(route, current) {
+    const chosen = current !== undefined && current.provider === route.provider && current.model === route.model;
+    const description = [
+        route.provider,
+        route.model === route.name ? undefined : route.model,
+        chosen ? 'current' : undefined,
+        chosen && current.reasoningEffort !== undefined ? `effort ${current.reasoningEffort}` : undefined,
+    ].filter(part => part !== undefined && part !== '').join(' · ');
+    return {
+        label: route.name,
+        description: description === '' ? undefined : description,
+        current: chosen,
+    };
+}
 /**
  * Own the reader's model choice for one session.
  *

package/lib/agent/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/agent/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAA0B,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAuBxD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAmC,EACnC,OAAgC;IAEhC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE;aACtG,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IAC1G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,0CAA0C,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,EAAE,EAAE;SAC3G,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;AACnF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACL,SAAS,GAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;IACpF,SAAS,CAA0B;IAE3C,sFAAsF;IACtF,OAAO,CAAC,QAAiB;QACvB,IAAI,CAAC,SAAS,EAAE,EAAE,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,MAAmB;QACxB,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,MAAM,CAAC,eAAe,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;SACnE,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAA;QACtC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC3C,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;SACrG,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAmB;QACvB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;YAAE,OAAM;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAED,4EAA4E;IAC5E,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,SAAS,CAAA;QAClC,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,SAAS,CAAA;IACtC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,SAAS,EAAE,EAAE,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF;AAoBD,sEAAsE;AACtE,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAK7C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAA6B,CAAA;IACtD,IAAI,OAAO,GAAG,EAAE,aAAa,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,SAAS,GAAG,GAA6B,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC9F,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvH,OAAO;QACL,SAAS;QACT,MAAM,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YACvB,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,EAAE,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBACzD,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAClF,CAAC,CAAC,EAAE,CAAC,CAAA;QACT,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAA;YAChE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACzE,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAC7C,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBACrF,CAAC,CAAC,CAAC;wBACC,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;wBAC5D,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrF,CAAC;gBACJ,CAAC,CAAC,EAAE,CAAC,CAAA;YACP,OAAO;gBACL,OAAO;gBACP,GAAG,CAAC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/agent/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAA0B,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAgCxD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAmC,EACnC,OAAgC;IAEhC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE;aACtG,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IAC1G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,0CAA0C,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,EAAE,EAAE;SAC3G,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,QAAQ,CAAA;AAEpC,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,KAA4D;IACxF,OAAO,KAAK,CAAC,QAAQ,GAAG,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAAA;AAC3D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB,EAAE,OAAgC;IACpF,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAA;IAC5G,MAAM,WAAW,GAAG;QAClB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;QACpD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC9B,MAAM,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS;KAClG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,WAAW,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;QACzD,OAAO,EAAE,MAAM;KAChB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACL,SAAS,GAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;IACpF,SAAS,CAA0B;IAE3C,sFAAsF;IACtF,OAAO,CAAC,QAAiB;QACvB,IAAI,CAAC,SAAS,EAAE,EAAE,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,MAAmB;QACxB,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,MAAM,CAAC,eAAe,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;SACnE,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAA;QACtC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC3C,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;SACrG,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAmB;QACvB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;YAAE,OAAM;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAED,4EAA4E;IAC5E,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,SAAS,CAAA;QAClC,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,SAAS,CAAA;IACtC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,SAAS,EAAE,EAAE,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF;AAoBD,sEAAsE;AACtE,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAK7C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAA6B,CAAA;IACtD,IAAI,OAAO,GAAG,EAAE,aAAa,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,SAAS,GAAG,GAA6B,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC9F,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvH,OAAO;QACL,SAAS;QACT,MAAM,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YACvB,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,EAAE,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBACzD,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAClF,CAAC,CAAC,EAAE,CAAC,CAAA;QACT,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAA;YAChE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACzE,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAC7C,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBACrF,CAAC,CAAC,CAAC;wBACC,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;wBAC5D,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrF,CAAC;gBACJ,CAAC,CAAC,EAAE,CAAC,CAAA;YACP,OAAO;gBACL,OAAO;gBACP,GAAG,CAAC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}