@toddzheng024/dscode-desktop 0.7.41 → 0.7.44

package/README.md

@@ -3,7 +3,7 @@
 DSCODE adds a coding preset, browser workflows, cross-session collaboration,
 memory and task management to the official DeepSeek Harness Desktop application.
 
-**Version:** 0.7.41 · **Harness runtime:** 0.2.0-rc.2
+**Version:** 0.7.44 · **Harness runtime:** 0.2.0-rc.2
 
 Preview release candidate; publication is a separate step.
 
@@ -48,7 +48,7 @@ public release; a candidate build alone does not publish a package.
 ## Install a published version
 
 After this version is available on npm, enter
-`@toddzheng024/dscode-desktop@0.7.41` in **Plugins → Add plugin**,
+`@toddzheng024/dscode-desktop@0.7.44` in **Plugins → Add plugin**,
 review the installation, install, then choose **Enable now**. Using the exact
 version keeps the installation tied to these instructions and compatibility
 requirements. The `preview` tag tracks the current Desktop preview release.

package/cordis.patch.yml

@@ -54,6 +54,10 @@
       name: "@toddzheng024/dscode-desktop/openrouter"
       config:
         providerName: dscode-openrouter
+    - id: dscode-antigravity
+      name: "@toddzheng024/dscode-desktop/antigravity"
+    - id: dscode-openai
+      name: "@toddzheng024/dscode-desktop/openai"
     - id: dscode-grok
       name: "@toddzheng024/dscode-desktop/grok"
     - id: dscode-opencode-go
@@ -103,7 +107,7 @@
       config:
         id: dscode
         name: "DSCODE"
-        description: "持久 Shell 编码环境，保留 Skills、压缩、目标、子代理与工作流。"
+        description: "Coding tools with file-version checks, persistent shells, skills, compaction, goals and subagents."
         order: 0
         plugins:
           # The `dscode` agent preset: the full coding agent, mounted once per process.
@@ -162,6 +166,11 @@
               dshHome: !!js 'process.env.DSCODE_INSTRUCTION_HOME'
               maxBytes: 65536
 
+          # Host owns fs-sandbox and the session-scoped fs-observation-policy. Mount only
+          # the model-facing tools here, so filesystem access keeps those shared guards.
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+
           - id: persistent-shell
             name: cordis:group
             group: true
@@ -187,7 +196,7 @@
                     * When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
                     * Network access depends on the task environment. Prefer configured mirrors/proxies when they are available.
                     * State is persistent across command calls and discussions with the user.
-                    * To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.
+                    * Use read for text files, edit for targeted replacements, and write for creating files. Use this shell for rg/rg --files searches, builds, tests and batch operations.
                     * Please avoid commands that may produce a very large amount of output.
                     * Please run long lived commands in the background, e.g. 'sleep 10 &' or start a server in the background.
 

package/docs/CHANGELOG.md

@@ -10,6 +10,45 @@ Per-release notes live in [`docs/releases/`](releases/); the entries below summa
 
 ## [Unreleased]
 
+## [0.7.44] - 2026-10-13
+
+### Fixed
+
+- Exercise interactive Ink rendering in the terminal viewport fixture under CI, preserving the live-frame and resize assertions that the CI log-output mode suppressed. The shipped renderer is unchanged.
+- Carry forward all 0.7.43 provider, file-tool and terminal changes below. The 0.7.43 candidate failed before publication; 0.7.44 is their first published release once its release gates pass.
+
+## [0.7.43] - 2026-10-12 (unpublished candidate)
+
+### Added
+
+- Add a native OpenAI/ChatGPT provider with independent account authorization, explicit API-key billing, per-session Standard/Fast/Ultrafast selection, completed-response replay, and a 272,000-token auto-compaction trigger independent of model capacity. The footer distinguishes requested speed from server-confirmed speed; other accounts' entitlement and accelerated performance still require live verification.
+- Add a community Antigravity Gemini model provider: `/antigravity login` authorizes a Google account, `/provider antigravity` keeps the DSCODE agent and tools, and `/antigravity models` refreshes the account catalog. Preserve native signatures through completed tool rounds and session replay; bound connection stalls and reject truncated tool responses. This uses internal model endpoints, not ACP. Live Google authorization and account access are not established by the synthetic integration tests.
+
+### Fixed
+
+- Yield between bounded terminal input bursts so fast typing or unbracketed pastes do not chain hundreds of React updates. Preserve key order, complete escape sequences and atomic bracketed pastes, and cancel queued input when the terminal unmounts.
+- Accept valid OpenAI SSE responses without a `Content-Type` header and recover completed output items when the terminal response contains an empty output array. Require successful response completion before tool commits, and continue rejecting incomplete or explicitly non-SSE responses. Live installed-binary checks cover repository edits, shell tests, file creation and persisted-session resume.
+- Refresh the OpenAI speed footer while idle after `/speed`, without waiting for another model request or a change in token statistics. Live Fast and Ultrafast requests reported Standard service for the tested account; the footer displays the server's actual tier.
+- Retain a pending OpenAI client registration when code exchange fails, so a new login can request fresh authorization without registering the client again. Keep pending registrations separate from verified accounts, reject stale writes after account changes, and admit only one concurrent login attempt. The original cause of a server-side `invalid_grant` response still requires live diagnosis.
+- Discover `/openai`, `/speed` and `/antigravity` in terminal command completion before the first conversation starts. Show registered argument hints beside command descriptions; opening completion does not create a conversation or start authentication.
+- Restore the bordered snowflake welcome card and fill unused terminal height above the input from startup. Reset the renderer's height ledger before a full replay so resize, Ctrl+L and clear do not retain stale padding. Native transcript scrollback remains available.
+- Keep tool failures visible in quiet chat, with a bounded error and history details available through Ctrl+O. Show the current tool target and its own elapsed time instead of only the tool name and total turn time. Cache streaming line wrapping across appends, preserving Unicode boundaries and rebuilding on resize or replacement.
+- Keep persistent Bash commands running until their completion marker instead of returning partial output while a foreground process still owns the terminal. Commands receive EOF on stdin unless they provide explicit input, preventing an input reader from consuming the next tool call. Remove the five-second idle-input interruption heuristic so silent work can complete; timeout and cancellation still reset the shell.
+
+### Changed
+
+- Simplify default terminal themes with shared shortcuts, aligned replies, blank space between turns and neutral file paths and metrics. Keep one animated activity marker and compact compaction status. Preserve permission badges when long session titles need shortening, and retain extra animation in Prismatic and Rainbow.
+- Show file-change summaries in quiet chat and bounded coloured diffs in verbose mode. Capped counts are labelled as displayed portions. History, diff and selection panels use spare terminal height while reserving room for the input and status bars, with less blank space in short windows.
+- Enable dedicated `read`, `edit` and `write` tools in the DSCODE preset, using the Host's filesystem sandbox and per-session file-version checks. Reads provide numbered windows; edits use exact text replacement and reject ambiguous or stale changes. Keep the persistent shell for search, builds, tests and multi-file patches. Shell reads do not establish file-tool observations, and resumed sessions must read files again before editing.
+
+## [0.7.42] - 2026-10-12
+
+### Fixed
+
+- Allow complete archive file listings above Node's default subprocess buffer limit. Version 0.7.41 failed with `ENOBUFS` before replacing the application; user data and the installed package were retained.
+- Let the shell installer repair 0.7.41 with the newly verified package's updater, retaining target ownership and active-session checks. Rerun the curl installer once, then use `dscode update` for subsequent upgrades.
+- Require full candidate archive replacement and effective user-setting preservation in both architecture qualification jobs. Small updater fixtures did not expose the original failure.
+
 ## [0.7.41] - 2026-10-12
 
 ### Changed

package/docs/antigravity.md

@@ -0,0 +1,41 @@
+# Antigravity
+
+DSCODE can use Gemini through a Google account with Antigravity access. This is a community model-provider integration, adapted from [pi-antigravity](https://github.com/Rahularya01/pi-antigravity/tree/d59d22bfebd9e44f2fd4a31bf5954a23fb9b043a), not a Google-supported API or an ACP connection. DSCODE keeps its own tools, permissions, conversation history and agent loop. The Antigravity application and CLI do not need to be running.
+
+## Sign in
+
+1. Run `/antigravity login` in DSCODE. It opens Google sign-in in your browser and waits in the background for up to five minutes.
+2. Complete the browser authorization, then run `/antigravity` to check whether sign-in completed.
+3. Run `/provider antigravity`. Use `/model` to choose Gemini and `/effort` to select one of that model's reasoning levels.
+
+The authorization page uses Google's Antigravity installed-app client. It requests Cloud Code Assist/Antigravity, cloud-platform, profile, email, logging and configuration scopes. The callback listens only on `127.0.0.1:51121`; the browser returns to `http://localhost:51121/oauth-callback`. If another login occupies that port, finish or cancel it before retrying. On a remote machine, forward that loopback port to the computer running DSCODE before signing in. Authorization codes should not be pasted into a chat or command history.
+
+The account must have an enabled Cloud Code Assist project. DSCODE checks the account's project information and project list; if neither returns a project, finish setup in Antigravity and retry. It does not invent a cloud project or provision a paid project.
+
+## Commands
+
+| Command | Result |
+|---|---|
+| `/antigravity` or `/antigravity status` | Read the stored login state and the result of the last sign-in attempt |
+| `/antigravity login` | Start Google sign-in; an existing pending attempt is reused |
+| `/antigravity models` | Refresh and display the Gemini catalog, or label the fallback catalog when discovery is unavailable |
+| `/antigravity cancel` | Cancel the pending browser login |
+| `/antigravity logout` | Remove this DSCODE login |
+
+DSCODE stores its own access token, refresh token and project ID under `ANTIGRAVITY_OAUTH` in its credential store. For a self-contained terminal installation this is `$DSCODE_HOME/credentials.yaml`, normally `~/.local/share/dscode-state/credentials.yaml`, with owner-only permissions. Legacy installations retain their configured credential path. Tokens are refreshed automatically and are never placed in model prompts. Existing Pi, Gemini CLI and Antigravity CLI credential files are not read or modified. Logout removes the local copy; it does not revoke the grant at Google.
+
+## Models and conversations
+
+The fallback catalog contains Gemini 3.8, 3.7, 3.6 and 3.5 Flash (low/medium/high) and Gemini 3.1 Pro (low/high). This fallback is not evidence of account entitlement. After sign-in, DSCODE discovers the account's Gemini models and caches the list for five minutes in the current process. A successful discovery replaces the fallback, including when no supported Gemini model is returned. Known families retain their context and output limits; unknown discovered families use conservative limits unless the service supplies them. `/antigravity models` forces a refresh.
+
+Text, image attachments and screenshots from tools use DSCODE's durable attachment service. A catalog entry explicitly marked as text-only will not send image data. Signed thinking and tool-call metadata are kept with completed model responses and replayed to the same runtime model after a session resumes. On a provider, model or reasoning-level switch that changes the runtime model, earlier tool calls and their results are represented as historical text so incompatible signatures are not reused.
+
+The initial integration offers Gemini only. It does not expose Antigravity's Claude/GPT models, image generation, Google Search grounding, account rotation or an Antigravity agent backend. DSCODE's existing web tools retain their own provider configuration; signing in here does not authorize those services. Ultra is not an advertised Gemini reasoning level.
+
+## Failures and limits
+
+The model request waits up to 30 seconds for response headers and up to 120 seconds without new stream data. Active streams may run longer. These limits are configurable through `headerTimeoutMs` and `streamIdleTimeoutMs` in the `dscode-antigravity` Host plugin. Cancellation closes the request; a missing completion marker or truncated tool response fails instead of committing a tool call. Transient errors use the existing Harness retry policy. A quota or authorization failure is not worked around by changing accounts or endpoints.
+
+Model access and quotas are determined by Google for the signed-in account. DSCODE does not estimate a per-token price or promise that any specific subscription will permit a request. This transport depends on internal Cloud Code Assist endpoints and client request formats; server changes can require a compatibility update. HTTP diagnostics report status and error category without echoing response bodies or credentials. A revoked login requires `/antigravity login` again.
+
+Automated verification uses synthetic token/model responses, the real loopback callback, the Harness provider registry, and a temporary credential store. Google consent, account entitlement and live model generation require verification with the user's account; automated tests do not establish those results.

package/docs/distribution.md

@@ -8,7 +8,7 @@ macOS 14+ is supported. Git is used for repository and patch operations. Google
 
 ```sh
 mkdir dscode-app
-tar -xzf dscode-0.7.41-darwin-arm64-standalone.tar.gz -C dscode-app
+tar -xzf dscode-0.7.44-darwin-arm64-standalone.tar.gz -C dscode-app
 ./dscode-app/dscode
 ```
 
@@ -19,7 +19,7 @@ The optional installer downloads and verifies the same package:
 ```sh
 curl -fsSL https://raw.githubusercontent.com/qiz029/dscode/main/install.sh | sh
 # Pin an exact release:
-curl -fsSL https://raw.githubusercontent.com/qiz029/dscode/main/install.sh | sh -s -- 0.7.41
+curl -fsSL https://raw.githubusercontent.com/qiz029/dscode/main/install.sh | sh -s -- 0.7.44
 # Or install an already unpacked package, without a download:
 sh dscode-app/install.sh
 ```
@@ -40,7 +40,7 @@ The application does not import `~/.dsh` configuration, Hub tokens or the old `~
 
 ```sh
 dscode update             # newest published self-contained release
-dscode update 0.7.41      # an exact release, including an explicit rollback
+dscode update 0.7.44      # an exact release, including an explicit rollback
 ```
 
 Exit running DSCODE sessions and schedulers first. Startup and update share kernel admission locks; each running child retains protection even if its launcher is killed. Both the program location and the selected data directory are protected. Concurrent ordinary sessions from the same package remain supported. A different package must wait until those sessions exit before taking over the same data directory. The stable `dscode-app` profile preserves native model/settings edits in `cordis.patch.yml` across upgrades and package relocation. Generated application defaults live in a separate private base bundle under the data directory.
@@ -49,6 +49,8 @@ The updater downloads a matching platform archive from GitHub, requires its publ
 
 A default update never downgrades an application newer than the published release. An explicit version may downgrade only to another self-contained package; older source/prebuilt releases are refused. `/update` schedules this same updater after the TUI exits. Its version check uses GitHub, not npm.
 
+Version 0.7.41 has an archive-listing buffer bug in its updater. Rerun the `curl` installation command once to repair that version using the new package's updater. The repair retains the same session locks, checksum checks and external user data. From 0.7.42 onward, use `dscode update` normally. Homebrew installations continue to use `brew upgrade dscode`.
+
 ## Migration from older DSCODE installations
 
 Old installations remain usable. New archives have a `-standalone` suffix so an old updater refuses them instead of applying the wrong installation or state-migration procedure. Check `type -a dscode` and `dscode --version` before changing your command link; npm, Homebrew and source links may coexist. Install the new package in a separate program directory and remove or rename an old command link only after identifying its owner.
@@ -67,7 +69,7 @@ Automatic credential merging and conversion of future incompatible session schem
 
 The release build generates `artifacts/dscode.rb` from the exact two application archives and their checksums. The new formula installs the complete package into `libexec`, links only `dscode`, and has no Node/npm dependency. Its marker makes `dscode update` direct users to `brew upgrade dscode`; Homebrew replaces the whole package, never a separate Hub profile.
 
-The maintained tap must adopt this generated formula and switch its updater from npm versions to GitHub release formulas. The repository build does not silently publish changes to the external `qiz029/homebrew-tap` repository. Until that migration is published, use the direct archive or installer; the existing tap may still install the legacy launcher.
+The maintained [qiz029/homebrew-tap](https://github.com/qiz029/homebrew-tap) uses this generated formula. Its daily and on-demand updater follows GitHub releases, verifies the formula digest and both archive checksums, and rejects incomplete releases before changing the tap. The repository build produces the formula; tap synchronization remains a separate publication step.
 
 ## Build and release
 

package/docs/dscode-ultra.md

@@ -8,9 +8,21 @@ The preset combines the pinned minimal preset's owner-scoped persistent shell wi
 
 The preset also registers a `review` tool and `/review` command backed by one independent, read-only model request over the selected Git diff. The main agent is guided to call it after code changes and focused checks, before its final reply. This is a diff-only review, not a tool-using subagent or a substitute for tests; it does not change Ultra delegation policy. See [TUI review usage](tui-commands.md).
 
-The model uses `bash` for file reads, searches and edits instead of separate `read`, `write`, `edit`, `glob` and `grep` tools. `cd`, exports, functions and background jobs persist across calls for the same agent. Each child gets a separate shell. By default children share workspace files; the parent can explicitly set `worktree: true` on `subagent` or `subagent_fork` to give a child an isolated Git checkout.
+The model uses dedicated file tools for text files:
 
-`apply_patch` is available in the harness shell PATH and wraps `git apply`. Feed it a **standard unified diff**, not the Codex `*** Begin Patch` format. Git is required. `apply_patch --check` checks hunks without writing. This works outside a Git repository too.
+| Tool | Behavior |
+| --- | --- |
+| `read(file_path, offset?, limit?)` | Returns numbered UTF-8 lines with pagination. `offset` starts at 1; a call returns at most 2,000 lines and 50 KiB, with individual lines capped at 2,000 characters. |
+| `edit(file_path, old_string, new_string, replace_all?)` | Replaces exact text. The match must be unique unless `replace_all` is explicitly enabled. |
+| `write(file_path, content)` | Creates a file or atomically replaces its full contents. Prefer `edit` for targeted changes. |
+
+Editing or overwriting an existing file requires a prior `read` in the same session. Changes made by another session, editor or shell invalidate the observed version: the operation fails without overwriting them, and the model must re-read and reconcile before retrying. Successful writes and edits refresh that observation, so consecutive edits do not require redundant reads. Creating a new file does not require a prior read and refuses to clobber a concurrently created file. A partial read records the file version; it does not prove that the model has seen the whole file. Observations do not survive session resume. A shell read or search does not establish a file-tool observation.
+
+File-tool relative paths resolve against the session workspace, independently of shell `cd`. The tools use the Host filesystem sandbox and approval mechanism; unread or stale-file rejection is not a reason to bypass the guard through the shell. Read results carry line-window metadata, and edits and overwrites carry diff metadata for the terminal and Desktop views. New-file creation returns a confirmation rather than a result diff. When attachment storage is available, the same plugin also exposes `read_image`; execution requires an image-capable model.
+
+The model keeps `bash` for searches with `rg`/`rg --files`, builds, tests and batch operations. There are no separate `glob` or `grep` tools. `cd`, exports, functions and background jobs persist across calls for the same agent. Each child gets a separate shell and independent file observations. By default children share workspace files; the parent can explicitly set `worktree: true` on `subagent` or `subagent_fork` to give a child an isolated Git checkout.
+
+`apply_patch` remains available in the harness shell PATH for multi-file patches and wraps `git apply`. Feed it a **standard unified diff**, not the Codex `*** Begin Patch` format. Git is required. `apply_patch --check` checks hunks without writing. This works outside a Git repository too. It checks patch context, not the file tools' observed versions; shell mutations remain subject to the active OS sandbox.
 
 ```sh
 apply_patch <<'PATCH'
@@ -23,11 +35,12 @@ diff --git a/example.txt b/example.txt
 PATCH
 ```
 
-`/shell` lists the current session's terminals. `/shell reset` closes them while the agent is idle. Timeout, cancellation, `exit`, reset and host restart discard shell state; the next call starts at the session workspace. Conversation resume restores messages and files, **not** an OS process or its exports. Interactive foreground programs that require stdin are not supported by this tool. Background work can use shell job control; `shell_retry` also exposes the existing tracked background-job mechanism.
+`/shell` lists the current session's terminals. `/shell reset` closes them while the agent is idle. Timeout, cancellation, `exit`, reset and host restart discard shell state; the next call starts at the session workspace. Conversation resume restores messages and files, **not** an OS process or its exports. Commands receive EOF on stdin by default; pipelines, heredocs and explicit input redirections still work. The tool waits for the command's completion marker, rather than treating a terminal readiness hint or partial output as completion. Silent work is not interrupted merely because it looks idle. Programs that explicitly open the terminal for interactive input are unsupported and may need cancellation or the command timeout. Background work can use shell job control; `shell_retry` also exposes the existing tracked background-job mechanism.
 
 Normal persistent commands keep the active OS sandbox and do not each incur an LLM review. After a genuine sandbox denial, the model may use `shell_retry` for a single fresh-shell retry, with explicit `workdir`, wider `sandbox_permissions` and justification. This uses the original escalation approval seam and auto reviewer. Reviewer input resolves relative workdir against the session workspace and explicitly identifies the environment as fresh. It cannot see or rely on the persistent shell's exports/functions. Rejected approval prevents execution. Sandbox mode changes while persistent terminals exist are rejected upstream; close them with `/shell reset` first when changing permission modes that also change sandbox policy.
 
 Hooks which should cover both execution paths should match `^(bash|shell_retry)$`.
+Hooks that also cover text-file access should include `read`, `edit` and `write`; include `read_image` for image reads.
 
 ## Ultra effort
 

package/docs/openai.md

@@ -0,0 +1,64 @@
+# OpenAI and ChatGPT
+
+DSCODE's native `openai` provider calls the Responses API and keeps DSCODE's own agent loop, tools, permissions and conversation storage. It supports either [Sign in with ChatGPT](https://developers.openai.com/siwc/token-sharing-open-source) for eligible plan usage or a separately billed OpenAI API key. It does not launch the Codex agent or connect through ACP.
+
+## Sign in with ChatGPT
+
+Command completion is available before the first conversation: type `/ope` to find `/openai`, with its supported arguments shown in the hint. Completion inserts the command name; enter the argument, such as `login`, yourself.
+
+1. Run `/openai login` and complete **Continue with ChatGPT** in the browser. A loopback listener waits up to five minutes while the terminal remains usable.
+2. Run `/openai status` to check the result and selected billing method.
+3. Run `/provider openai`, then `/model` and `/effort` to choose an available model and reasoning effort. `/provider codex` is an alias.
+
+DSCODE registers itself under its own name using OpenAI's dynamic public-client flow. It generates a stable host ID, PKCE verifier, state and OIDC nonce, then validates the returned identity token against OpenAI's JWKS. Returning sign-ins reuse the account's issued client ID. The browser callback uses `127.0.0.1`, an available local port, and `/auth/callback`. Remote terminals require port forwarding for that exact callback address. Do not paste authorization codes or tokens into the conversation.
+
+The initial choice is ChatGPT plan usage. A missing permission or exhausted allowance stops the request; it never switches automatically to an API key. Use `/openai consent` to request plan-use permission for a saved registration. This flow depends on the account's plan, workspace policy and access granted to DSCODE. Review usage and access at [ChatGPT Settings → Usage](https://chatgpt.com/settings/usage).
+
+If `/openai status` reports `invalid_grant` during sign-in, run `/openai login` again and use the newly opened browser page. DSCODE retains the issued client ID as a pending registration and requests a fresh code with new PKCE and state values. The pending registration survives restart but is not a signed-in account; only verified credentials enable the provider. `/openai login new` deliberately starts another registration. Changing accounts or billing, or logging out, clears the pending retry. Do not reuse an earlier authorization URL.
+
+## Use an API key
+
+Run `/openai api-key` to select API billing, then `/login openai` to save the key in the masked terminal credential form. Alternatively, supply `OPENAI_API_KEY` in the environment that launches DSCODE. Run `/provider openai` after setup.
+
+Switch back with `/openai use <client-id>` or `/openai login`. The current selection is saved across restarts. Account or billing switches cancel active OpenAI requests in this Host; other running Hosts use the updated selection for their next request.
+
+## Speed and reasoning
+
+`/speed` shows the requested tier, last confirmed tier and available choices for the selected model. Use `/speed standard`, `/speed fast` or `/speed ultrafast`; a running turn must stop before changing speed. `/effort` controls reasoning separately. For example, `high` reasoning and `ultrafast` speed can be combined when the model supports both.
+
+The selected speed is recorded in the conversation and survives resume. The provider's `serviceTier` setting supplies the default for conversations without an explicit choice. The footer refreshes a changed selection even while idle, marks it unconfirmed before a completed response, and shows a change such as `fast → default` when the server reports a different tier. The connector never silently retries an unsupported tier at a different speed.
+
+Fast and Ultrafast consume more usage or cost more. Model catalogs are not proof of entitlement. [OpenAI's speed documentation](https://learn.chatgpt.com/docs/agent-configuration/speed) describes current ChatGPT plan requirements; [API Fast](https://developers.openai.com/api/docs/guides/fast-mode) and [API Ultrafast](https://developers.openai.com/api/docs/guides/ultrafast-mode) describe API availability and billing. `priority` in a catalog is treated as the Fast tier.
+
+## Context and model discovery
+
+OpenAI conversations automatically compact at **272,000 estimated input tokens**, checked at step boundaries. The model's actual context window remains separate. If a smaller model's safe input budget requires an earlier trigger, that earlier threshold applies. The retained tail is scaled below the trigger, and the model-switch preview uses the same threshold. This is a local pressure policy, not a guarantee about server tokenization or billing.
+
+The provider loads the selected account's model catalog from `/v1/models` and caches it for five minutes. `/openai models` refreshes it. Account changes clear the cache. Model context, modalities, reasoning options and service tiers use advertised metadata when present. The fallback entries for GPT-6.1 Sol and GPT-6 Astra use a 1,050,000-token context and a 128,000-token output reserve. Unknown discovered models without context metadata use a conservative 32,000-token context and 8,192-token output reserve. A successfully returned empty catalog stays empty; a failed discovery is labeled as such.
+
+## Accounts and credentials
+
+| Command | Behavior |
+|---|---|
+| `/openai login` | Sign in again to the selected registration, or create the first one |
+| `/openai login new` | Register an additional account or workspace |
+| `/openai accounts` | List saved registrations with distinct client IDs |
+| `/openai use <client-id>` | Select a saved ChatGPT registration |
+| `/openai consent` | Request plan-use permission for the selected registration |
+| `/openai api-key` | Explicitly choose API billing |
+| `/openai status` | Show selected billing and sign-in status |
+| `/openai models` | Refresh and display model and speed choices |
+| `/openai cancel` | Cancel browser sign-in |
+| `/openai logout` | Revoke the selected renewable ChatGPT session and clear its local tokens |
+
+The account file is `openai/accounts.json` beside the terminal's shared credential file: normally `$DSCODE_HOME/openai/accounts.json`, or `~/.dscode/openai/accounts.json` for legacy profiles. Desktop stores it under its DSH home. The file has owner-only permissions and is atomically replaced. A kernel lock serializes refresh, login, account changes and logout across processes. Registrations and the host ID remain after logout; access, refresh and retained ID tokens are removed. If remote revocation cannot be confirmed, the command says so. API keys remain in the existing credential store. Existing Codex credential files are not read or modified.
+
+## Transport and verification limits
+
+The connector uses HTTP/SSE at the public Responses endpoint, with a 30-second response-header timeout and a 120-second stream-idle timeout. `headerTimeoutMs` and `streamIdleTimeoutMs` in the `dscode-openai` plugin configure those limits. Active streams can last longer. Completed responses retain native reasoning items for replay to the same model and account; switching either prevents incompatible encrypted reasoning from being reused. Images use DSCODE's durable attachment service.
+
+The ChatGPT direct route can omit the `Content-Type` header and return an empty output array in the final event. DSCODE parses the SSE body and retains complete `response.output_item.done` items for that case. A successful `response.completed` event is still required before any tool call is committed; partial deltas, interrupted streams and explicitly non-SSE responses are not treated as successful output.
+
+ChatGPT plan requests follow the [preview restrictions](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations): stateless input history, `store: false`, `stream: true`, namespaced local tools, and no unsupported sampling or output-budget fields. Hosted OpenAI tools are not enabled. A stream must reach `response.completed` before any tool call is committed. Incomplete, failed and interrupted responses cannot execute a partially received tool call.
+
+Automated tests use generated signing keys, local OAuth callbacks, temporary stores and synthetic model responses. Live Google or OpenAI credentials are not involved in those tests. Separate live checks with the installed binary verified repository edits, shell tests, file creation, persisted-session resume and terminal reporting. Fast and Ultrafast requests completed but the server reported Standard service for the tested account; these checks do not establish accelerated performance or other accounts' entitlement.

package/docs/releases/0.7.41.md

@@ -12,13 +12,16 @@ DSCODE supplies its own Harness home and private runtime, discards inherited DSH
 
 ## Whole-package upgrades
 
+Public installation passed, but a real full-archive upgrade subsequently exposed an `ENOBUFS` error while listing the archive. This fails before replacement and preserves the old application and user data. Version 0.7.42 fixes the updater. Users of 0.7.41 must rerun the curl installer once to receive the repair; Homebrew users run `brew upgrade dscode`.
+
+
 The updater checks the release digest, platform, version and bundled modules before replacing the application. Failed checks preserve the old version and failed swaps restore it. User data is never moved into the update staging tree. Kernel locks protect running sessions; successful updates keep the previous package. The default update does not downgrade and there is no npm fallback. Power-failure transactional recovery is not promised.
 
-The build also generates a Homebrew formula consuming the same archives. Adoption by the external tap is a separate publication step; the current tap must not be assumed migrated. Desktop remains a separate extension distribution.
+The build also generates a Homebrew formula consuming the same archives. The maintained Homebrew tap has adopted this formula and now follows verified GitHub release assets instead of npm launcher versions. Desktop remains a separate extension distribution.
 
 ## Verification
 
-The repository gate passed 1,147 unit/component cases with 80.00% measured first-party `.mjs` coverage. The normal-exit lease regression passed with the existing launcher lifecycle cases. The final provider, email and standalone data-isolation suite passed all 94 cases, and all 28 terminal rendering/panel cases passed. New cases cover environment and path isolation, installer checksum rejection, foreign-command protection, and successful/failed whole-package replacement without moving user data. Archive qualification uses an isolated home and deliberately unusable foreign Node/npm/DSH commands; digest-bound receipts record private native imports, PTY, cold composition, local Host diagnostics, shell installation and settings preservation. Intel rehearsal on Apple Silicon uses Rosetta; release CI also requires a separate Intel runner. See the [verification record](https://github.com/qiz029/dscode/blob/main/docs/verification.md).
+The Node 22 and Node 24 CI gates each passed 1,148 unit/component cases with 80.04% measured first-party `.mjs` coverage. The normal-exit lease regression passed with the existing launcher lifecycle cases. The final provider, email and standalone data-isolation suite passed all 94 cases, and all 28 terminal rendering/panel cases passed. New cases cover environment and path isolation, installer checksum rejection, foreign-command protection, and successful/failed whole-package replacement without moving user data. Archive qualification uses an isolated home and deliberately unusable foreign Node/npm/DSH commands; digest-bound receipts record private native imports, PTY, cold composition, local Host diagnostics, shell installation and settings preservation. Local Intel rehearsal used Rosetta; release CI also passed on a separate native Intel runner. See the [verification record](https://github.com/qiz029/dscode/blob/main/docs/verification.md).
 
 Lint, both TypeScript configurations, native integration, package checks and 63 offline evaluations passed. After unifying the TUI startup lookup and `/update` routing with the package updater, lint, both TypeScript checks, documentation checks and 21 update/standalone regressions passed. The deferred updater has process tests; the TUI keyboard dispatch has no dedicated end-to-end interactive case.
 

package/docs/releases/0.7.42.md

@@ -0,0 +1,23 @@
+# DSCODE 0.7.42
+
+Whole-package updates now handle the complete archive, and the installer can repair the updater shipped in 0.7.41.
+
+## Full archive updates
+
+The real 0.7.41 archive has a file listing larger than Node's default subprocess output buffer. Public installation succeeded, but `dscode update` stopped with `ENOBUFS` before replacing the application. Increase the command buffer to a bounded 64 MiB. Digest, platform, version, native module and rollback checks remain in force. This does not add power-loss transaction guarantees.
+
+## Repairing 0.7.41
+
+Rerun the installation command once:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/qiz029/dscode/main/install.sh | sh
+```
+
+When the installed version is 0.7.41, the installer verifies a fresh package and uses its updater against the existing installation. The target's session locks, Homebrew ownership checks and external data directory still apply. This fixes the installed updater without requiring users to delete their program or settings. Later updates use `dscode update` normally. Homebrew users continue to run `brew upgrade dscode`.
+
+## Verification
+
+Regression coverage includes subprocess output above 1 MiB, installer repair routing, target active-session protection and Homebrew ownership rejection. The archive qualification now replaces an installation with the entire candidate archive on both architectures and checks that a saved native setting remains effective afterward; release metadata is local in this probe and the prior version is synthetic.
+
+The local repository gate and Node 22/24 CI passed lint, both TypeScript configurations, all 1,150 unit/component cases, native integration, package checks and 63 offline evaluations; measured first-party `.mjs` coverage was 80.04%. Both archives built, and release qualification passed on Apple Silicon and a native Intel runner, including real full-archive replacement. Public testing passed a fresh latest-version install from shell stdin without Node/npm/DSH, repair from the actual 0.7.41 release, a direct whole-package update from a disposable synthetic prior version, settings and data preservation, current-version no-op and native Host diagnostics. The existing global DSH home stayed unchanged. The maintained Homebrew tap now uses the published 0.7.42 archives and matching hashes. The separate Desktop public-install verification also passed, and both `latest` and `preview` select 0.7.42. Live provider inference and macOS permission dialogs are outside this verification; no power-loss recovery case is provided.

package/docs/releases/0.7.43.md

@@ -0,0 +1,41 @@
+# DSCODE 0.7.43
+
+Native OpenAI/ChatGPT and community Antigravity providers join file-version-checked coding tools, a clearer terminal and reliable non-interactive persistent Bash commands.
+
+This candidate failed the CI viewport tests and published no packages. See [0.7.44](0.7.44.md) for the corrected release.
+
+## OpenAI and ChatGPT
+
+Use `/openai login` and `/provider openai` for eligible ChatGPT plan usage, or explicitly choose API billing with `/openai api-key` and save a key through `/login openai`. DSCODE registers its own public client, validates the returned identity, serializes credential changes and retains a pending registration after a failed code exchange. A fresh login uses new PKCE and state values; an unverified registration never enables the provider. It does not read Codex credentials, launch Codex or silently fall back to API billing. See the [OpenAI guide](../openai.md).
+
+`/speed standard|fast|ultrafast` selects speed independently of `/effort`, persists across resume and refreshes the footer while idle. The footer reports the requested and server-confirmed tiers rather than assuming accelerated access. OpenAI conversations compact at 272,000 estimated input tokens, earlier when a smaller model's safe budget requires it; this trigger does not replace the model's context capacity.
+
+Responses must reach successful completion before tool calls are committed. Headerless SSE and terminal envelopes with an empty output array retain completed output items, including replayable reasoning. Interrupted, incomplete and explicitly non-SSE responses remain failures. Synthetic tests cover authorization, refresh, billing selection, durable attachments, transport cancellation and replay. Previously recorded installed-binary checks exercised live repository edits, shell tests, file creation and persisted-session resume. Fast and Ultrafast requests completed but reported Standard service for the tested account; accelerated performance, weekly allowance and other accounts' entitlement are not established. The original server-side cause of an observed `invalid_grant` remains unresolved.
+
+## Antigravity Gemini
+
+Use `/antigravity login`, then `/provider antigravity`, to call Gemini through a Google account while retaining DSCODE's own agent loop, tools and permissions. `/antigravity models` refreshes the account catalog. Completed signed thinking and tool-call metadata survive session replay; incompatible model switches use historical text instead of reusing signatures. Connection stalls are bounded and truncated tool responses cannot commit calls.
+
+This is a community integration using internal Cloud Code Assist endpoints, not a supported Google API or ACP connection. It offers Gemini only and does not rotate accounts, provision paid projects or bypass quotas. Automated callback, credential, transport and native Host probes use synthetic Google responses; live consent, entitlement and generation still need account-specific verification. See the [Antigravity guide](../antigravity.md).
+
+## File tools and persistent Bash
+
+The DSCODE preset now exposes `read`, `edit` and `write` through the Host's filesystem sandbox and per-session file-version policy. Reads return numbered windows, edits require an exact unambiguous match, and stale changes are rejected. Shell reads do not establish a file-tool observation, and resumed sessions must read files again before editing. Persistent Bash remains the tool for searches, builds, tests and multi-file patches; these tools do not widen permissions.
+
+Bash commands now receive EOF on stdin unless they supply explicit input, and wait for their completion marker rather than returning partial output while a foreground process still owns the terminal. The five-second idle-input interruption heuristic is removed so silent work can finish. Timeout, cancellation and process exit still reset shell state; long-running services should be started in the background. Native probes cover file-tool observations and shell recovery.
+
+## Terminal layout, input and feedback
+
+The bordered snowflake welcome card and full-height layout keep the composer at the bottom from startup. Full replay resets the renderer's height ledger so resize, Ctrl+L and session changes do not retain stale padding. Default themes use aligned replies, restrained colours and one activity marker; Prismatic and Rainbow retain decorative animation. Long titles preserve permission badges, and history, diff and selection panels use available height while reserving space for input and status bars.
+
+Quiet chat keeps bounded tool errors and file-change summaries visible. Verbose mode shows bounded coloured diffs, with capped counts labelled as displayed portions. The activity line identifies the current target and that tool's elapsed time. Streaming wrapping is cached across appends while preserving Unicode boundaries and rebuilding on resize or replacement; native transcript scrollback remains available.
+
+Input draining yields between bounded bursts to avoid chained React updates during fast typing or unbracketed pastes. Key order, split escape sequences and atomic bracketed pastes are preserved, and unmount cancels queued input. Mounted composer, viewport, rendering and input-stream regressions exercise these behaviours. Provider command completion discovers `/openai`, `/speed` and `/antigravity` before the first conversation without starting an Agent or authentication.
+
+## Installation and verification
+
+The terminal remains a self-contained macOS package with its private Node and pinned Harness. Update with `dscode update` after exiting running sessions and schedulers. Users still on 0.7.41 should rerun the shell installer once to repair its updater; Homebrew installations continue through `brew upgrade dscode`. The Desktop plugin remains a separate release surface targeting Harness 0.2.0-rc.2.
+
+Before publication, documentation links and README agreement, lint, both TypeScript configurations and all 1,236 unit/component cases passed. Measured first-party `.mjs` line coverage was 80.96%; the terminal's TypeScript is outside that coverage metric and checked separately. The initial session-sandbox test attempt failed on nested macOS sandbox operations and inherited installation variables; the successful rerun used a normal execution environment with those variables cleared. Native integration, package integrity/export checks and all 63 offline evaluations also passed. The automatic independent diff review could not complete because the pending diff exceeded its 160 KiB input limit; no clean review result is claimed. Release CI must build both complete archives and qualify the exact candidates on Apple Silicon and Intel before attaching them; those publication results are not claimed by the local checks above.
+
+Real Google consent and inference, accelerated OpenAI performance, other accounts' model access, macOS permission dialogs and power-loss update recovery have no automated acceptance case in this release.

package/docs/releases/0.7.44.md

@@ -0,0 +1,43 @@
+# DSCODE 0.7.44
+
+Native OpenAI/ChatGPT and community Antigravity providers join file-version-checked coding tools, a clearer terminal and reliable non-interactive persistent Bash commands.
+
+## Interactive terminal verification
+
+The viewport fixture explicitly selects interactive Ink rendering even when the test runner sets `CI=true`. Ink otherwise suppresses live frames and resize listeners, which caused all four viewport cases to fail in the 0.7.43 release attempt despite passing locally. The assertions and shipped renderer are unchanged. Version 0.7.43 published no packages; this release includes its provider, file-tool and terminal changes described below.
+
+## OpenAI and ChatGPT
+
+Use `/openai login` and `/provider openai` for eligible ChatGPT plan usage, or explicitly choose API billing with `/openai api-key` and save a key through `/login openai`. DSCODE registers its own public client, validates the returned identity, serializes credential changes and retains a pending registration after a failed code exchange. A fresh login uses new PKCE and state values; an unverified registration never enables the provider. It does not read Codex credentials, launch Codex or silently fall back to API billing. See the [OpenAI guide](../openai.md).
+
+`/speed standard|fast|ultrafast` selects speed independently of `/effort`, persists across resume and refreshes the footer while idle. The footer reports the requested and server-confirmed tiers rather than assuming accelerated access. OpenAI conversations compact at 272,000 estimated input tokens, earlier when a smaller model's safe budget requires it; this trigger does not replace the model's context capacity.
+
+Responses must reach successful completion before tool calls are committed. Headerless SSE and terminal envelopes with an empty output array retain completed output items, including replayable reasoning. Interrupted, incomplete and explicitly non-SSE responses remain failures. Synthetic tests cover authorization, refresh, billing selection, durable attachments, transport cancellation and replay. Previously recorded installed-binary checks exercised live repository edits, shell tests, file creation and persisted-session resume. Fast and Ultrafast requests completed but reported Standard service for the tested account; accelerated performance, weekly allowance and other accounts' entitlement are not established. The original server-side cause of an observed `invalid_grant` remains unresolved.
+
+## Antigravity Gemini
+
+Use `/antigravity login`, then `/provider antigravity`, to call Gemini through a Google account while retaining DSCODE's own agent loop, tools and permissions. `/antigravity models` refreshes the account catalog. Completed signed thinking and tool-call metadata survive session replay; incompatible model switches use historical text instead of reusing signatures. Connection stalls are bounded and truncated tool responses cannot commit calls.
+
+This is a community integration using internal Cloud Code Assist endpoints, not a supported Google API or ACP connection. It offers Gemini only and does not rotate accounts, provision paid projects or bypass quotas. Automated callback, credential, transport and native Host probes use synthetic Google responses; live consent, entitlement and generation still need account-specific verification. See the [Antigravity guide](../antigravity.md).
+
+## File tools and persistent Bash
+
+The DSCODE preset now exposes `read`, `edit` and `write` through the Host's filesystem sandbox and per-session file-version policy. Reads return numbered windows, edits require an exact unambiguous match, and stale changes are rejected. Shell reads do not establish a file-tool observation, and resumed sessions must read files again before editing. Persistent Bash remains the tool for searches, builds, tests and multi-file patches; these tools do not widen permissions.
+
+Bash commands now receive EOF on stdin unless they supply explicit input, and wait for their completion marker rather than returning partial output while a foreground process still owns the terminal. The five-second idle-input interruption heuristic is removed so silent work can finish. Timeout, cancellation and process exit still reset shell state; long-running services should be started in the background. Native probes cover file-tool observations and shell recovery.
+
+## Terminal layout, input and feedback
+
+The bordered snowflake welcome card and full-height layout keep the composer at the bottom from startup. Full replay resets the renderer's height ledger so resize, Ctrl+L and session changes do not retain stale padding. Default themes use aligned replies, restrained colours and one activity marker; Prismatic and Rainbow retain decorative animation. Long titles preserve permission badges, and history, diff and selection panels use available height while reserving space for input and status bars.
+
+Quiet chat keeps bounded tool errors and file-change summaries visible. Verbose mode shows bounded coloured diffs, with capped counts labelled as displayed portions. The activity line identifies the current target and that tool's elapsed time. Streaming wrapping is cached across appends while preserving Unicode boundaries and rebuilding on resize or replacement; native transcript scrollback remains available.
+
+Input draining yields between bounded bursts to avoid chained React updates during fast typing or unbracketed pastes. Key order, split escape sequences and atomic bracketed pastes are preserved, and unmount cancels queued input. Mounted composer, viewport, rendering and input-stream regressions exercise these behaviours. Provider command completion discovers `/openai`, `/speed` and `/antigravity` before the first conversation without starting an Agent or authentication.
+
+## Installation and verification
+
+The terminal remains a self-contained macOS package with its private Node and pinned Harness. Update with `dscode update` after exiting running sessions and schedulers. Users still on 0.7.41 should rerun the shell installer once to repair its updater; Homebrew installations continue through `brew upgrade dscode`. The Desktop plugin remains a separate release surface targeting Harness 0.2.0-rc.2.
+
+The original 0.7.43 candidate passed the following local checks: documentation links and README agreement, lint, both TypeScript configurations and all 1,236 unit/component cases passed. Measured first-party `.mjs` line coverage was 80.96%; the terminal's TypeScript is outside that coverage metric and checked separately. The initial session-sandbox test attempt failed on nested macOS sandbox operations and inherited installation variables; the successful rerun used a normal execution environment with those variables cleared. Native integration, package integrity/export checks and all 63 offline evaluations also passed. The automatic independent diff review could not complete because the pending diff exceeded its 160 KiB input limit; no clean review result is claimed. For 0.7.44, `CI=true npm run check` passed outside the session sandbox after the fixture correction: lint, both TypeScript configurations, all 1,236 unit/component cases (80.94% first-party `.mjs` line coverage), native integration, package checks and all 63 offline evaluations. The four viewport cases also passed in a focused `CI=true` run. Release CI must build both complete archives and qualify the exact candidates on Apple Silicon and Intel before attaching them; those publication results are not claimed by the local checks above.
+
+Real Google consent and inference, accelerated OpenAI performance, other accounts' model access, macOS permission dialogs and power-loss update recovery have no automated acceptance case in this release.

package/docs/tui-commands.md

@@ -10,8 +10,11 @@ If a provider rejects a request for content filtering, the turn stops with a `CO
 | --- | --- |
 | `/email` | `i`: connect IMAP with a masked application password; `r`: sync. Browse, preview, and press Enter to steer email directly into this session. [Email interface](email.md). |
 | `/status` | Session ID, workspace, model route, permission mode, recorded token totals/context pressure, tool/plugin counts. Unknown usage stays unknown. `/review-usage` reports the independent reviewer separately. |
-| `/provider [deepseek\|openrouter\|grok\|opencode-go\|custom]` | For self-hosted or private APIs, `/provider custom` opens [Custom model providers](custom-providers.md). Saved custom services also appear by name in the picker: Enter switches to their current or first configured model. The Custom entry adds or edits services. Switch the session between DeepSeek's official API, OpenRouter, Grok and OpenCode Go. Without an argument, open a picker (↑↓ choose, Enter switch, Esc close) that shows each provider's key status. OpenRouter is DSCODE's own adapter over OpenRouter's live model listing (cached for a day in `$DSH_HOME/openrouter-models.json`, settings in the `llm-openrouter` section; `/model` offers DSCODE's curated list from that listing rather than all of it); a switch asks for the key when none is stored, then moves to the counterpart of the current model and keeps the effort when the target offers it. When the new model would compact the current context, the switch asks first. Ultra works on both routes: on OpenRouter it sends `xhigh` plus the collaboration policy, and `low` is sent as `high`, which is how DeepSeek itself answers low. The footer shows the active provider's remaining balance (for OpenRouter, the account's remaining credits, or the key's own remaining limit when OpenRouter refuses the key those) and records the cost OpenRouter reports for each call (estimated from list prices only when it reports none); the 🔥/❄️ peak marker appears only for DeepSeek, because OpenRouter bills no peak window. OpenCode Go serves its chat-completions models to an OpenCode account login, never a key: before `/opencode login` the switch names that command instead of asking for a key, and the footer shows the subscription's usage instead of a cost; see [OpenCode Go](opencode-go.md). Stop a running turn first. |
+| `/provider [deepseek\|openrouter\|grok\|opencode-go\|antigravity\|openai\|custom]` | For self-hosted or private APIs, `/provider custom` opens [Custom model providers](custom-providers.md). Saved custom services also appear by name in the picker: Enter switches to their current or first configured model. The Custom entry adds or edits services. Switch the session between DeepSeek's official API, OpenRouter, Grok, OpenCode Go, Antigravity and OpenAI. Without an argument, open a picker (↑↓ choose, Enter switch, Esc close) that shows each provider's key status. OpenRouter is DSCODE's own adapter over OpenRouter's live model listing (cached for a day in `$DSH_HOME/openrouter-models.json`, settings in the `llm-openrouter` section; `/model` offers DSCODE's curated list from that listing rather than all of it); a switch asks for the key when none is stored, then moves to the counterpart of the current model and keeps the effort when the target offers it. When the new model would compact the current context, the switch asks first. Ultra works on both routes: on OpenRouter it sends `xhigh` plus the collaboration policy, and `low` is sent as `high`, which is how DeepSeek itself answers low. The footer shows the active provider's remaining balance (for OpenRouter, the account's remaining credits, or the key's own remaining limit when OpenRouter refuses the key those) and records the cost OpenRouter reports for each call (estimated from list prices only when it reports none); the 🔥/❄️ peak marker appears only for DeepSeek, because OpenRouter bills no peak window. OpenCode Go serves its chat-completions models to an OpenCode account login, never a key: before `/opencode login` the switch names that command instead of asking for a key, and the footer shows the subscription's usage instead of a cost; see [OpenCode Go](opencode-go.md). Stop a running turn first. |
 | `/model` | Picker for the session's current provider only, listed alphabetically by the displayed model name (digits compare naturally, so GLM 5.2 precedes GLM 5.3). Typing searches as you type (BM25 over model name, id and provider; the word being typed matches prefixes) and narrows the list without re-ranking it; Enter focuses the first match, a second Enter selects it, Esc clears the search then closes, Tab opens the provider picker. |
+| `/antigravity [login\|status\|models\|cancel\|logout]` | Sign in with Google for the community [Antigravity](antigravity.md) Gemini provider. Login opens the browser and waits in the background; `/antigravity` shows the result. `/provider antigravity` selects it while retaining DSCODE tools and permissions. `models` refreshes the catalog; `cancel` stops sign-in and `logout` removes the local login. |
+| `/openai [login [new]\|status\|accounts\|use <id>\|consent\|api-key\|models\|cancel\|logout]` | Select ChatGPT plan usage or API-key billing for the native [OpenAI provider](openai.md); manage saved registrations and model discovery. |
+| `/speed [standard\|fast\|ultrafast]` | Select OpenAI service speed independently of `/effort`. Saved per conversation; `/speed` reports available choices and the last confirmed tier. Stop the running turn before changing it. |
 | `/opencode [login\|cancel\|logout]` | Sign in to OpenCode Go with an OpenCode account, the route's only credential. `login` shows a code, opens the console in the browser and waits in the background for up to ten minutes; the consent page names the OpenCode CLI, whose login client DSCODE uses. Without an argument it shows who is signed in or how the last attempt ended. The login is stored in `$DSCODE_HOME/credentials.yaml` and renews itself. See [OpenCode Go](opencode-go.md). |
 | `/openrouter` | OpenRouter account panel: the account balance, this key's limit and its spend today, this week and this month; with a management key, also every API key's usage and the last 30 days of spend by model and serving provider. `r` refreshes, `m` sets the management key (checked against OpenRouter, stored in `$DSCODE_HOME/credentials.yaml`, read-only use; `OPENROUTER_MANAGEMENT_KEY` also works). Saving the OpenRouter API key through `/provider openrouter` or `/login openrouter` offers the management key as an optional step. |
 | `/status` | Query the current session's provider, model and credential balance without a model turn. Supports DeepSeek API/account login and OpenRouter; account funds and key limits are labeled separately. Uses the active credential, refreshes on every call, and reports unsupported endpoints, missing credentials and query failures explicitly. Also available in [ACP](acp.md#current-credential-balance), which documents the lookup limits. |
@@ -37,7 +40,7 @@ If a provider rejects a request for content filtering, the turn stops with a `CO
 | `/review [--staged\|--base REF\|--commit REF] [--path RELATIVE_PATH]` | Independently review the selected Git diff in a read-only, tool-free model request. Default includes tracked and untracked uncommitted changes, and when there are none it reviews the commits made since the latest user task started (read from the HEAD reflog), so work that was committed or merged is still reviewed; `--commit` reviews a merge commit against its first parent; empty scopes do not call the model. Narrow large or unrelated diffs with `--path`. |
 | `/delegate <task>` | Hand the task to the main agent as coordinator: it records the parts on a delegate board, launches them as child agents with `worktree: true` in the background while child slots are free (five below Ultra, twenty at Ultra), answers the questions they send to `/`, verifies each finished worktree, and once every task is done merges the accepted ones into the main workspace with `git apply --3way`, leaving them staged and uncommitted. Refused unless the session starts at a clean Git repository root, and inside a child agent. See [Ultra](dscode-ultra.md#delegate-mode). |
 | `/delegate-dashboard` | Popup kanban of the current session's delegate board with four columns — pending, running, verifying, complete — and the child slots in use. A task is running while its child works or waits on an answer from the main agent (marked `?`), and verifying once the child has settled and the main agent has not yet recorded the result. Columns are divided by vertical rules and every task is its own bordered card with its id, child name and title; `▲` marks high priority and `▼` low. Pending cards run in launch order, ready ones first; a blocked task has a grey card with a hollow `◌` and names what it waits on (`after t1,t2`). Waiting cards lead their column. On a short terminal each card folds to one line so more of them fit, and a narrow terminal stacks the columns. It refreshes every second; Esc or q closes it. |
-| `/verbose` | Toggle verbose chat: thinking and tool calls appear dimmed as `· Thinking: …`, `· Tool Call: name args` and `  Output: …` (thinking capped at eight lines), with a blank line between blocks. The setting is saved per machine in `$DSCODE_HOME/tui/verbose.json`. Ctrl/Alt+R toggles the same setting; Ctrl+O still opens the full history inspector. |
+| `/verbose` | Toggle verbose chat: thinking and tool calls appear as `· Thinking: …`, `· Tool Call: name args` and `  Output: …` (thinking capped at eight lines), with a blank line between blocks. File-change cards include bounded, coloured diffs. With verbose off, tool failures and file-change summaries remain visible. The setting is saved per machine in `$DSCODE_HOME/tui/verbose.json`. Ctrl/Alt+R toggles the same setting; Ctrl+O opens the history inspector. |
 | `/mouse` | Toggle mouse capture. On (default) makes the wheel scroll the chat one row per notch, merging the notches that arrive in the same frame; off hands the mouse back to the terminal for drag-select and copy, leaving PageUp/PageDown to scroll the chat. While capture is on, hold Shift (Option in iTerm2, Fn in Terminal.app) to select text. The choice is saved per machine in `$DSCODE_HOME/tui/mouse.json`. |
 | `/language [code]` | Without an argument, open a picker (↑↓ choose, enter apply, esc close) for the interface language for DSCODE's own labels, notices, the status-line telemetry labels and the composer placeholder: `en` (default), `zh-CN`, `zh-TW`, `ja`, `ko`, `es`. Names and common aliases work too (`简体中文`, `jp`). The choice is saved per machine in `$DSCODE_HOME/tui/language.json`; `DSCODE_LANGUAGE` overrides it for one process. |
 | `/clear` | Start a fresh session and clear the screen after successful activation; the previous session remains available through `/resume`. Stop a running turn first. |
@@ -191,17 +194,19 @@ The launcher applies an idempotent, version-checked patch to the pinned `dsh-cod
 - Pasting or dropping an image file path shows `[Image 1]`, `[Image 2]` and so on in the composer; the image is sent as an attachment. On macOS, `Ctrl+V` attaches a screenshot or a copied image straight from the system clipboard; in a terminal that pastes an image as a temporary path, `Cmd+V` goes through the file-path entry point too. The first `Ctrl+V` compiles a local image-reading helper and needs Xcode Command Line Tools.
 - `dscode resume`: continues the most recent session; `dscode resume SESSION_ID`: resumes the named session. `--cwd DIRECTORY` may be appended. After a successful exit and save it prints the resume command for the current session.
 - A session's folder is chosen when it is created and never changes: resuming one, through `--resume`, `/resume`, `/search` or a queued switch, works in the folder the session is bound to, and the window's workspace, shell and durable log all follow that folder. A resume that leaves the folder `dscode` was launched in prints one warning notice naming both folders, so a window that silently changed project is visible. To reach another project's context from here, have an agent read that session or use `dscode send` across sessions instead of resuming it.
-- The main chat area hides thinking, tool arguments, tool results and completed tool calls; the dynamic area shows only the name of the tool currently running. User messages, agent prose, user shell command results and the necessary error/approval prompts are still shown. The complete record stays in the session and can be seen through the history detail or an export.
-- When a turn ends, the chat area draws a light separator line after that turn's last visible record; the next turn starts on a new line. Turn separators are kept when a session is resumed, and an export contains none.
+- The main chat area folds thinking and routine successful tool calls. Failed tools retain a bounded error summary; Ctrl+O opens details, with the shortcut shown once in the startup header. Successful edits and writes with structured diff metadata show the affected paths and added/removed line counts; counts marked "shown" describe only the displayed portion of a capped diff. Ctrl/Alt+R or `/verbose` expands bounded coloured diffs together with thinking and other calls. Tools without diff metadata retain their ordinary summary in verbose mode. User messages, agent prose, user shell command results and error/approval prompts remain visible. The complete record stays in the session for inspection or export.
+- A blank row separates completed turns. Quiet replies align with streaming prose and omit timestamps; verbose mode retains timestamps for inspection.
 - A sent user message uses its own light-grey background block in the main chat area; the background stays continuous when a long message wraps, and the dark and light themes adapt separately. A session export is still plain text.
 - CJK input-method positioning: after each frame the terminal's real cursor is synchronised to the composer's current character position (including CJK width, line wrapping and the composer's internal scroll), and the render position is restored before the redraw. A change here needs the TUI restarted; how the macOS candidate window appears still has to be verified in the terminal actually in use.
-- The screen is cleared on startup; the interface shows the most recent session content according to the terminal height, with the composer and status bar pinned to the bottom. The mouse wheel or PageUp/PageDown browses earlier messages in the main chat area, and following new messages resumes after scrolling back to the bottom; Ctrl+O shows the complete session record and `/export` exports it. The terminal scrollback no longer keeps appending completed messages.
+- The screen is cleared on startup. Settled messages append to native terminal scrollback, while the live tail stays bounded to leave room for the composer and status bar. Use the terminal's scrolling controls for earlier messages, Ctrl+O for history details, or `/export` for the complete record. During streaming, wrapped rows are reused as text arrives; resizing or replacing the text rebuilds the wrapping. History, diff and selection panels use the available height after reserving room for the composer, up to three status rows and a notice. Short windows omit decorative blank rows; very small windows keep a compact close/navigation hint.
 - The effort step of `/effort` and `/model` replaces the composer at the bottom. A model with four bands shows a horizontal `low → high → max → ultra` bar; arrow keys move, Enter applies, Esc cancels and restores the composer, and `o` switches straight to off. As the cursor reaches ultra a blue effect spreads from the centre outwards; after Enter applies, the composer plays a short central ripple. Nothing plays while animations are off. Other models still show the band list they provide. When switching models, a supported effort is preserved; otherwise the picker starts at the target model's default (for example, MiMo `medium` becomes DeepSeek's default `high`). The footer shows the selected model's effort without borrowing a previous request's value. If no default is advertised, the default selection has no effort label.
 
 ## DSCODE interface layout
 
-The startup header is a compact welcome box: on the left a pixel snowflake in three blues — six arms 60° apart around a bright hexagonal crystal, twelve lines tall, or eleven on terminals under 26 rows — and on the right a bold DSCODE wordmark with a thin divider that brands the box and lists the current model, effort, local version and project path. A narrow window or a short terminal compresses it to a three-line layout with ❄, keeping the last directory of a long path. A session title that changes while running still shows at the bottom. The body keeps the user and agent output, while thinking and tool-call history stay hidden.
+The startup welcome card has a rounded border. On ordinary terminals it shows a blue pixel snowflake beside the DSCODE wordmark, model, effort, version and project path, with shared shortcuts underneath. Narrow or short terminals use a compact bordered card; very short windows omit model and shortcut rows. The default themes keep the artwork still, while Prismatic and Rainbow retain decorative animation. Quiet file-change rows use a green completion mark, neutral paths and dim line counts. The body keeps user and agent output, tool failures and file-change summaries visible; thinking and routine tool-call history stay folded until verbose mode is enabled.
 
-Above the composer, thinking, the reply or the current tool and its description are shown uniformly, timed as the total for the turn. Only the running marker animates; the composer plays no wave. The sub-agent overview separates running / idle / done, and `/agents` shows the tasks and current activity.
+The interface fills the available terminal height from startup. Unused space sits above the composer, keeping the input and status footer at the bottom while reserving a terminal cursor row. Existing history counts toward that height and continues into native scrollback when the screen fills. Resizing, Ctrl+L and `/clear` recompute the layout; the welcome card is replayed without retaining the old frame's padding.
 
-The footer leads row 1 with the session name and the model with its effort, then the working directory, the permission badge and any task state. Row 2 places request TPS, session-average TPS, context and the loaded skill count on the left, with session cost, DeepSeek balance and peak/off-peak marker, optional last-turn cost and cache rate aligned together on the right. Space separates the groups; `·` separates figures within each group. At narrow widths the financial group moves to a third row before left-side figures are dropped. Average TPS yields before current TPS, context and skills. Extremely narrow terminals may omit the optional last-turn cost and clip the financial group. `/statusline` still customises every original item, and an existing custom configuration keeps working.
+Above the composer, the activity line shows thinking, replying or the current tool. A running tool shows its description or invocation preview (such as a file path), and elapsed time since that call started. With concurrent calls, it shows the most recently started active call and the number of other active calls. Thinking/replying, and older calls without a start timestamp, retain the labelled total turn time. The interruption hint stays visible when width permits. In the default themes, only the activity marker animates; reasoning, the streaming caret and footer remain steady, and compaction uses one status line. Prismatic and Rainbow retain their additional animation and compaction artwork. The composer plays no wave. The sub-agent overview separates running / idle / done, and `/agents` shows the tasks and current activity.
+
+The footer leads row 1 with the session name and the model with its effort, then the working directory, the permission badge and any task state. Row 2 places request TPS, session-average TPS, context and the loaded skill count on the left, with session cost, DeepSeek balance and peak/off-peak marker, optional last-turn cost and cache rate aligned together on the right. Space separates the groups; `·` separates figures within each group. At narrow widths the financial group moves to a third row before left-side figures are dropped. Average TPS yields before current TPS, context and skills; when both TPS readings are unknown, only one placeholder is shown. Default themes use neutral metric colours and reserve semantic colours for permission, warnings and errors. Shift+Tab still cycles permission presets without a permanent footer hint. Extremely narrow terminals may omit the optional last-turn cost and clip the financial group. `/statusline` still customises every original item, and an existing custom configuration keeps working.