@xia-sc/dsh-git 0.6.0 → 0.7.0

package/README.en.md

@@ -35,6 +35,9 @@ new-branch-from-base.
   (the top row with the Git title — press, drag, release; it stays where
   dropped and is clamped inside the viewport; header buttons/inputs never
   start a drag; double-click the header to snap back to center).
+  The header's right side is, in order, **⚙ Settings** (the commit-message
+  language — see "The commit area and AI drafting"), **↻ Refresh** and
+  **– Collapse**.
   A "＋ New branch" button beside the branch switcher opens an inline form:
   new branch name + base-branch picker (local branches or full remote refs
   like `origin/feature/x`) — confirming creates the branch from the base and
@@ -119,11 +122,30 @@ The commit area follows the real order of operations: **stage all → draft →
 - **✨ AI draft**: sends the selected change set (diffstat + diff, truncated)
   to the model the current session has selected and drops the generated
   message into the input. Edit it, or just write your own.
+- **Commit-message language (⚙ in the header)**: `Auto` by default — the model
+  follows the language already used by the repository's commits and comments
+  (the historical behaviour). Pick one of the presets (简体中文 / 繁體中文 /
+  English / 日本語 / 한국어 / Français / Deutsch / Español / Русский) or
+  `Custom…` and type a language name, and the draft is **forced** to write the
+  whole message — subject and body — in that language, with the system prompt
+  saying outright that it overrides the code comments, the past commit subjects
+  and the diff. A repository whose comments are English is exactly what drags
+  "Auto" off course, which is what this switch is for. The choice lives in the
+  browser's `localStorage` (key `dsh-git.commitLanguage`), applies to every
+  workspace and survives a reload; when storage is unavailable it silently
+  falls back to `Auto`. A custom name is validated by the host for shape and
+  length (≤ 60 chars, no line feed, quote or colon that could open a prompt
+  rule of its own) and reports `invalid-language` when it does not fit.
 
 The model route comes from the current session's `modelSelection` projection
 (pending pick first, then last used), falling back to the host's first
-registered route. Failures are reported in the last-operation output with a
-localized sentence (no changes / no model configured / draft failed, …).
+registered route. The request carries the **current session id** (`sessionId`):
+some gateways (the opencode-style routes on this machine, for one) require a
+session-affinity header, and the host forwards a session id to its adapter only
+when the request has one — without it the gateway answers `MissingSessionID`.
+Failures are reported in the last-operation output with a localized sentence
+(no changes / no model configured / draft failed, …); an unrecognized failure
+code leads with the localized sentence and appends the host's own diagnosis.
 
 ## Architecture
 
@@ -232,7 +254,7 @@ shell metacharacters, and leading dashes are all recorded verbatim.
 | `commit` | `{ cwd, message }` | `{ message }`; `missing-author` error when `user.name/email` unset |
 | `push` | `{ cwd }` | `{ message }` (120s timeout) |
 | `log` | `{ cwd, count? }` | `{ repo, commits: [{sha, author, subject, refs}] }` (clamped 1..50) |
-| `generateMessage` | `{ cwd, mode?, provider?, model? }` | `{ message, mode, provider, model }`. `mode` is `staged` (default) / `unstaged` / `all`; anything else is `invalid-mode`. Failure code in `error.details.code`: `no-changes`, `no-provider`, `no-model`, `llm-truncated` (the output cap ran out before any text was written), `llm-empty`, `cancelled`, `llm-failed`. |
+| `generateMessage` | `{ cwd, mode?, provider?, model?, sessionId?, language? }` | `{ message, mode, provider, model }`. `mode` is `staged` (default) / `unstaged` / `all`; anything else is `invalid-mode`. `sessionId` is an optional non-empty string (over 200 chars is `invalid-session`); the panel sends the current session id so session-affine gateways can route the call. `language` is an optional **language name** (the ⚙ setting; absent, `null`, an empty string and `auto` all mean "follow the repository") written into the system prompt to force the whole message into that language; a name that is too long (> 60 chars) or carries a line feed, quote or colon is `invalid-language`. Failure code in `error.details.code`: `no-changes`, `no-provider`, `no-model`, `llm-truncated` (the output cap ran out before any text was written), `llm-empty`, `cancelled`, `llm-failed`. |
 
 > A failed result carries `error.code === "internal"` on the wire (the Connection
 > envelope only requires a string), with the plugin's own diagnostic in
@@ -293,7 +315,7 @@ shell metacharacters, and leading dashes are all recorded verbatim.
 - The browser bundle is hand-written (no build step); edits to `lib/client.js`
   are picked up on refresh (no-cache), host-side edits need a `dsh web`
   restart.
-- Tests (`npm test` runs all four):
+- Tests (`npm test` runs all five):
   - `node test/smoke.mjs` — route, envelope, endpoint dispatch and input
     validation (no git spawn: the session sandbox blocks child-process piped
     stdio);
@@ -308,6 +330,14 @@ shell metacharacters, and leading dashes are all recorded verbatim.
     removed line starting with `--`), the row renderer, the diff pane's header,
     and `act()`'s result plumbing and localization (needs a react/react-dom copy,
     e.g. via `DSH_GIT_REACT_ROOT`; SKIPs without one).
+  - `node test/slot-mount.mjs` — mounts both seats on the real
+    `SlotCore`/`SlotRegistry` with the real renderer (SKIPs without a host profile).
+  - `npm run test:ui:settings` — **real browser** offline regression
+    (playwright-core + local Chrome; needs neither `dsh web` nor authentication):
+    the script serves this checkout over loopback, mounts the client half with the
+    React UMD build, and then really clicks the ⚙ settings popover, switches the
+    language, and checks both the `localStorage` persistence and the `language`
+    the draft request carries; it writes `test/ui/settings-popover.png`.
 - `npm run test:commit` — **end-to-end**: really spawns git in a throwaway
   repository, commits through the plugin's own `/dsh-git-rpc/commit` route, and
   reads the message back with `git log --format=%B` (multi-line, CRLF, non-ASCII,

package/README.md

@@ -24,7 +24,8 @@ DeepSeek Harness Web GUI 的完整 Git 管理插件，形态为一个**可折叠
   （push 的 sideband banner、`LF will be replaced by CRLF` 这类提示）收在右侧的"详情 ▾"里，点开才展开，
   不会被变更列表和最近提交顶到看不见的地方。面板**可通过顶栏拖动**（按住带 Git 标题的
   那一行，拖到哪里就停在哪里，不会拖出视口；顶栏上的按钮/输入框不会触发
-  拖动；双击顶栏回到居中位置）。
+  拖动；双击顶栏回到居中位置）。顶栏右侧依次是 **⚙ 设置**（提交信息语言，
+  见下文「提交区与 AI 起草」）、**↻ 刷新**、**– 收起**。
   分支切换器旁边的"＋ 新建分支"按钮会展开一个内联表单：新分支名 + 基分支
   选择器（本地分支或 `origin/feature/x` 这样的完整远端引用）——确认后从
   该基分支创建新分支并切换过去。
@@ -83,10 +84,22 @@ DeepSeek Harness Web GUI 的完整 Git 管理插件，形态为一个**可折叠
   提交真正会记录的内容**——用其他依据生成的描述可能与实际提交不符。
 - **✨ AI 生成**：把选中的改动（diffstat + diff，截断后）交给当前会话所选
   模型，生成的提交信息直接填入输入框；不满意可改，也可以直接手写。
+- **提交信息语言（顶栏 ⚙ 设置）**：默认「自动」——让模型跟随仓库现有提交与
+  注释的语言（历史行为）。选中某个语言（简体中文 / 繁體中文 / English / 日本語 /
+  한국어 / Français / Deutsch / Español / Русский）或「自定义…」手填一个语言名后，
+  生成时会在 system prompt 里**强制**整条提交信息（主题 + 正文）只用该语言，
+  并明确写清它覆盖代码注释、历史提交与 diff 的语言——仓库注释是英文时，
+  「自动」会被它们带跑，这正是这个开关要解决的问题。设置存在浏览器的
+  `localStorage`（键 `dsh-git.commitLanguage`），对所有工作区生效、刷新后保留；
+  存储不可用时静默回落到「自动」。自定义语言名由宿主按形状与长度（≤ 60 字符、
+  无换行/引号/冒号等可自开规则的字符）校验，非法时报 `invalid-language`。
 
 生成用的模型路由取当前会话的 `modelSelection` 投影（待生效的选择优先，
-其次是上次实际使用），取不到时回落到宿主注册的第一条路由。失败会以
-本地化文案显示在"上次操作输出"里（无可用改动 / 未配置模型 / 生成失败等）。
+其次是上次实际使用），取不到时回落到宿主注册的第一条路由。请求会带上**当前会话 id**
+（`sessionId`），因为部分网关（例如本机配置的 opencode 系路由）要求会话亲和头，
+而宿主只在请求带 `sessionId` 时才把它转给适配器——不带就会被网关以
+`MissingSessionID` 拒掉。失败会以本地化文案显示在"上次操作输出"里
+（无可用改动 / 未配置模型 / 生成失败等；未知失败码先给本地化短句，再附宿主的原始诊断）。
 
 ## 架构
 
@@ -180,7 +193,7 @@ dsh plugin --profile web remove @xia-sc/dsh-git
 | `commit` | `{ cwd, message }` | `{ message }`；未配置 `user.name/email` 时报 `missing-author` 错误 |
 | `push` | `{ cwd }` | `{ message }`（120s 超时） |
 | `log` | `{ cwd, count? }` | `{ repo, commits: [{sha, author, subject, refs}] }`（钳制 1..50） |
-| `generateMessage` | `{ cwd, mode?, provider?, model? }` | `{ message, mode, provider, model }`。`mode` 为 `staged`（默认）/`unstaged`/`all`，非法值报 `invalid-mode`；失败码见 `error.details.code`：`no-changes`、`no-provider`、`no-model`、`llm-truncated`（输出上限用尽、一个字都没写出来）、`llm-empty`、`cancelled`、`llm-failed`。 |
+| `generateMessage` | `{ cwd, mode?, provider?, model?, sessionId?, language? }` | `{ message, mode, provider, model }`。`mode` 为 `staged`（默认）/`unstaged`/`all`，非法值报 `invalid-mode`；`sessionId` 为可选的非空字符串（超过 200 字符报 `invalid-session`），面板会带上当前会话 id 供需要会话亲和的网关路由。`language` 是可选的**语言名**（顶栏 ⚙ 里的设置；缺失、`null`、空串与 `auto` 都表示「跟随仓库」），它会被写进 system prompt 强制整条信息只用该语言；形状或长度不合法（> 60 字符、含换行/引号/冒号等）报 `invalid-language`。失败码见 `error.details.code`：`no-changes`、`no-provider`、`no-model`、`llm-truncated`（输出上限用尽、一个字都没写出来）、`llm-empty`、`cancelled`、`llm-failed`。 |
 
 > 失败结果的 `error.code` 在线路上固定为 `"internal"`（Connection 信封只要求它是字符串），
 > 插件自己的诊断码放在 `error.details.code`；客户端按该码做本地化文案。
@@ -234,7 +247,14 @@ dsh plugin --profile web remove @xia-sc/dsh-git
     diff 解析器（行号 / 分类 / `--` 开头的删除行）、行渲染、差异面板标题栏与
     `act()` 的结果回传/本地化（需要一份 react/react-dom，可用
     `DSH_GIT_REACT_ROOT` 指定，找不到则 SKIP）。
-  - 也提供 `npm test`（依次跑四个）。
+  - `node test/slot-mount.mjs` —— 用真实 `SlotCore`/`SlotRegistry` 与真渲染器把两个
+    座位挂起来（找不到宿主包则 SKIP）。
+  - `npm run test:ui:settings` —— **真实浏览器**离线回归（playwright-core + 本机
+    Chrome，既不需要 `dsh web` 也不需要认证）：脚本自己起回环 http 服务，用
+    React UMD 挂载客户端半边，真点 ⚙ 设置弹层、切换语言、验证 `localStorage`
+    持久化与「✨ AI 生成」请求里带的 `language`；截图落在
+    `test/ui/settings-popover.png`。
+  - 也提供 `npm test`（依次跑五个）。
   - `npm run test:commit` —— **端到端**：在临时仓库里真起 git，走插件的
     `/dsh-git-rpc/commit` 路由提交，再用 `git log --format=%B` 逐字节比对提交
     信息（多行、CRLF、中文、前导 `-`、shell 元字符等），并确认非法信息被拒且

package/lib/client.js

@@ -76,6 +76,28 @@ window.__ModuleLoader__.load({
 			"generate.truncated": "模型还没写出提交信息就用完了 token 上限（思考模型会先花掉这份预算），再点一次通常即可",
 			"generate.cancelled": "生成已取消",
 			"generate.failed": "生成失败",
+			"generate.failedDetail": "生成失败：{message}",
+			"generate.failedRoute": "生成失败：{message}（模型路由 {provider} / {model}）",
+			// Settings popover (the header's ⚙). The commit-message language is a
+			// forced output rule, not a hint: the host turns it into an explicit
+			// override in the system prompt.
+			"settings.aria": "Git 设置",
+			"settings.title": "设置",
+			"settings.close": "关闭",
+			"settings.language": "提交信息语言",
+			"settings.language.auto": "自动（跟随仓库）",
+			"settings.language.zh-CN": "简体中文",
+			"settings.language.zh-TW": "繁體中文",
+			"settings.language.en": "English",
+			"settings.language.ja": "日本語",
+			"settings.language.ko": "한국어",
+			"settings.language.fr": "Français",
+			"settings.language.de": "Deutsch",
+			"settings.language.es": "Español",
+			"settings.language.ru": "Русский",
+			"settings.language.custom": "自定义…",
+			"settings.language.customPlaceholder": "例如：Esperanto",
+			"settings.language.hint": "「AI 生成」只用所选语言写提交信息，不受代码注释与历史提交影响；「自动」跟随仓库。",
 			"commit.placeholder": "提交信息（可多行，Ctrl+Enter 提交）…",
 			"commit.empty": "请输入提交信息",
 			"changes.title": "变更",
@@ -180,6 +202,28 @@ window.__ModuleLoader__.load({
 			"generate.truncated": "The model hit its token cap before writing anything (a reasoning model spends that budget thinking first) — trying again usually works",
 			"generate.cancelled": "Draft cancelled",
 			"generate.failed": "Draft failed",
+			"generate.failedDetail": "Draft failed: {message}",
+			"generate.failedRoute": "Draft failed: {message} (route {provider} / {model})",
+			// Settings popover (the header's ⚙). The commit-message language is a
+			// forced output rule, not a hint: the host turns it into an explicit
+			// override in the system prompt.
+			"settings.aria": "Git settings",
+			"settings.title": "Settings",
+			"settings.close": "Close",
+			"settings.language": "Commit message language",
+			"settings.language.auto": "Auto (follow the repository)",
+			"settings.language.zh-CN": "简体中文",
+			"settings.language.zh-TW": "繁體中文",
+			"settings.language.en": "English",
+			"settings.language.ja": "日本語",
+			"settings.language.ko": "한국어",
+			"settings.language.fr": "Français",
+			"settings.language.de": "Deutsch",
+			"settings.language.es": "Español",
+			"settings.language.ru": "Русский",
+			"settings.language.custom": "Custom…",
+			"settings.language.customPlaceholder": "e.g. Esperanto",
+			"settings.language.hint": "The AI draft is written in the chosen language only, whatever the comments and past commits use; Auto follows the repository.",
 			"commit.placeholder": "Commit message (multi-line allowed, Ctrl+Enter commits)…",
 			"commit.empty": "Enter a commit message",
 			"changes.title": "Changes",
@@ -240,6 +284,90 @@ window.__ModuleLoader__.load({
 			"status.changed": "changed"
 		};
 
+		/**
+		 * Commit-message languages the settings panel offers: first the `auto`
+		 * entry (the historical "follow the repository" behaviour), then the
+		 * presets.
+		 *
+		 * `directive` is the language NAME handed to the host, which turns it
+		 * into an explicit override in the system prompt. The panel owns this
+		 * mapping so the host needs no language table of its own and a custom
+		 * entry can send any name at all. The names are bilingual on purpose:
+		 * the model reads them unambiguously whichever UI locale is active.
+		 */
+		var LANGUAGE_PRESETS = [
+			{ id: "auto", directive: undefined },
+			{ id: "zh-CN", directive: "Simplified Chinese (简体中文)" },
+			{ id: "zh-TW", directive: "Traditional Chinese (繁體中文)" },
+			{ id: "en", directive: "English" },
+			{ id: "ja", directive: "Japanese (日本語)" },
+			{ id: "ko", directive: "Korean (한국어)" },
+			{ id: "fr", directive: "French (français)" },
+			{ id: "de", directive: "German (Deutsch)" },
+			{ id: "es", directive: "Spanish (español)" },
+			{ id: "ru", directive: "Russian (русский)" }
+		];
+		/** The custom entry: not a preset, its directive is the user's own text. */
+		var LANGUAGE_CUSTOM_ID = "custom";
+		/** Every id the select can carry, `custom` included. */
+		var LANGUAGE_IDS = LANGUAGE_PRESETS.map(function (preset) { return preset.id; }).concat([LANGUAGE_CUSTOM_ID]);
+		/**
+		 * Where the setting lives. Global by design: it is a user preference about
+		 * how the panel writes, not state of any one repository.
+		 */
+		var LANGUAGE_STORAGE_KEY = "dsh-git.commitLanguage";
+
+		/**
+		 * The page's `localStorage`, or null when there is none.
+		 *
+		 * Reached through `window`, never as a bare `localStorage`: a test or
+		 * server-side render has no storage (Node >= 22 even ships an experimental
+		 * global that logs a warning and then throws), and a browser can refuse it
+		 * outright (private mode, blocked site storage). None of that is an error
+		 * here — the setting falls back to `auto`.
+		 */
+		function pageStorage() {
+			try {
+				if (typeof window === "undefined" || window === null) return null;
+				var store = window.localStorage;
+				return store === undefined || store === null ? null : store;
+			} catch (error) {
+				return null;
+			}
+		}
+
+		/**
+		 * Read the persisted language setting.
+		 * @returns `{ id, text }`, or null when nothing is stored/readable.
+		 */
+		function readStoredLanguage() {
+			try {
+				var store = pageStorage();
+				if (store === null) return null;
+				var raw = store.getItem(LANGUAGE_STORAGE_KEY);
+				if (raw === null || raw === "") return null;
+				var parsed = JSON.parse(raw);
+				if (parsed === null || typeof parsed !== "object") return null;
+				return {
+					id: typeof parsed.id === "string" ? parsed.id : "auto",
+					text: typeof parsed.text === "string" ? parsed.text : ""
+				};
+			} catch (error) {
+				return null;
+			}
+		}
+
+		/** Persist the language setting, ignoring a storage that refuses to write. */
+		function writeStoredLanguage(id, text) {
+			try {
+				var store = pageStorage();
+				if (store === null) return;
+				store.setItem(LANGUAGE_STORAGE_KEY, JSON.stringify({ id: id, text: text }));
+			} catch (error) {
+				// Quota or private mode: the choice still holds for this page.
+			}
+		}
+
 		/** React.createElement shorthand. */
 		function h(type, props) {
 			var children = Array.prototype.slice.call(arguments, 2);
@@ -251,7 +379,12 @@ window.__ModuleLoader__.load({
 			panel: {
 				position: "fixed",
 				// Sit above the composer card so the expanded panel never covers
-				// the input box (the input.left pill sits in the tool row).
+				// the input box. 168px is a measurement of the composer stack
+				// (card + tool row + the dock band), not a published contract:
+				// ui-conversation keeps that geometry in its own module CSS
+				// (`--dsh-composer-stack-gap` etc.). If the composer grows or
+				// shrinks, re-measure here and in DIFF_PANEL_HEIGHT below — the
+				// panel is anchored by `bottom`, so both move together.
 				bottom: 168,
 				left: "50%",
 				transform: "translateX(-50%)",
@@ -326,12 +459,85 @@ window.__ModuleLoader__.load({
 				boxSizing: "border-box",
 				cursor: "pointer"
 			},
+			// The same ghost button while its popover is open: an accent fill, not a
+			// second button shape, so the header keeps one visual language.
+			iconButtonActive: {
+				background: "color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d6bfe) 16%, transparent)",
+				border: "1px solid color-mix(in srgb, var(--dsw-alias-state-business-primary, #4d6bfe) 45%, transparent)",
+				color: "var(--dsw-alias-state-business-primary, #4d6bfe)"
+			},
 			body: {
 				flex: "1",
 				minHeight: 0,
 				padding: "10px 12px 12px",
 				overflowY: "auto"
 			},
+			// Covers the whole panel — header included — while the popover is open, so
+			// a click on anything else inside the panel closes the settings. Kept
+			// `absolute` on purpose: the panel rides `transform: translateX(-50%)`
+			// while centered, and a transformed ancestor both re-parents a `fixed`
+			// child and clips it to the panel's `overflow: hidden` anyway.
+			settingsBackdrop: {
+				position: "absolute",
+				top: 0,
+				right: 0,
+				bottom: 0,
+				left: 0,
+				zIndex: 2,
+				background: "transparent"
+			},
+			// Anchored under the header's right edge, inside the panel's own fixed
+			// box. Absolute (not fixed) so it moves with the panel when dragged.
+			settingsPopover: {
+				position: "absolute",
+				top: 42,
+				right: 8,
+				zIndex: 3,
+				width: 236,
+				// Never taller than the panel that holds it (the short-window case),
+				// in which case the popover scrolls instead of being clipped.
+				maxHeight: "calc(100% - 52px)",
+				overflowY: "auto",
+				display: "flex",
+				flexDirection: "column",
+				gap: 8,
+				padding: 10,
+				border: "1px solid var(--dsw-alias-border-l1, rgba(127,127,127,0.3))",
+				borderRadius: 10,
+				background: "var(--dsw-alias-bg-base, #1e1e1e)",
+				boxShadow: "var(--dsw-shadow-lv2, 0 8px 32px rgba(0,0,0,0.45))",
+				boxSizing: "border-box",
+				cursor: "default",
+				textAlign: "left"
+			},
+			settingsHead: {
+				display: "flex",
+				alignItems: "center",
+				gap: 8
+			},
+			settingsTitle: {
+				flex: "1",
+				minWidth: 0,
+				fontSize: 12,
+				fontWeight: 600,
+				color: "var(--dsw-alias-label-primary, #e5e7eb)"
+			},
+			settingsRow: {
+				display: "flex",
+				alignItems: "center",
+				gap: 8,
+				minWidth: 0
+			},
+			settingsLabel: {
+				flex: "none",
+				fontSize: 12,
+				color: "var(--dsw-alias-label-secondary, #c8ccd2)"
+			},
+			settingsHint: {
+				fontSize: 11,
+				lineHeight: "16px",
+				color: "var(--dsw-alias-label-secondary, #c8ccd2)"
+			},
 			row: {
 				display: "flex",
 				alignItems: "center",
@@ -878,6 +1084,33 @@ window.__ModuleLoader__.load({
 			return text.length > max ? text.slice(0, max - 1) + "…" : text;
 		}
 
+		/**
+		 * The model route one session's AI draft should use, or null to let the
+		 * host fall back to its first registered provider route.
+		 *
+		 * Two host generations carry the same `modelSelection` projection: the
+		 * row's own `projectionValues` (present since 0.1.6) and, since 0.1.7,
+		 * the snapshot's per-session `projectionsBySession[id].values`. Read the
+		 * row first, then the shared record, so neither generation loses a route
+		 * the user already chose. `next` (a pending pick) beats `lastUsed`.
+		 *
+		 * @param summary - `byId[sessionId]` row, when the snapshot has one.
+		 * @param sessions - the whole `useSessions` snapshot (may be undefined).
+		 * @param sessionId - the bound session id, or null/undefined.
+		 * @returns `{ provider, model }`, or null.
+		 */
+		function sessionModelRoute(summary, sessions, sessionId) {
+			var selection = summary && summary.projectionValues ? summary.projectionValues.modelSelection : undefined;
+			if (!selection && sessionId !== null && sessionId !== undefined && sessions && sessions.projectionsBySession) {
+				var record = sessions.projectionsBySession[sessionId];
+				selection = record && record.values ? record.values.modelSelection : undefined;
+			}
+			if (!selection) return null;
+			var effective = selection.next || selection.lastUsed;
+			if (!effective || !effective.provider || !effective.model) return null;
+			return { provider: effective.provider, model: effective.model };
+		}
+
 		/**
 		 * Strip ANSI/VT escape sequences from git's human-readable output.
 		 *
@@ -1100,8 +1333,13 @@ window.__ModuleLoader__.load({
 				commit: function (cwd, message) { return rpc(ctx, "commit", { cwd: cwd, message: message }); },
 				push: function (cwd) { return rpc(ctx, "push", { cwd: cwd }); },
 				log: function (cwd) { return rpc(ctx, "log", { cwd: cwd, count: 10 }); },
-				generateMessage: function (cwd, mode, provider, model) {
-					return rpc(ctx, "generateMessage", { cwd: cwd, mode: mode, provider: provider, model: model });
+				generateMessage: function (cwd, mode, provider, model, sessionId, language) {
+					// The session travels with the request: session-labelled
+					// providers reject an unidentified call, and the host forwards
+					// a session id to its adapter only when one is present.
+					// `language` is the forced output language from the settings
+					// popover; absent means "let the model follow the repository".
+					return rpc(ctx, "generateMessage", { cwd: cwd, mode: mode, provider: provider, model: model, sessionId: sessionId, language: language });
 				}
 			};
 
@@ -1113,6 +1351,16 @@ window.__ModuleLoader__.load({
 			 */
 			var sessionId = null;
 
+			// The commit-message language setting, read once from storage. It is
+			// deliberately NOT state of one Session: it is a preference of the user
+			// about how the panel writes, shared by every workspace and kept across
+			// reloads. idleState() republishes it on every emit, so a refresh, a
+			// workspace switch and a status read all keep it — a hard-coded `auto`
+			// in idleState() would silently reset the setting on the next read.
+			var storedLanguage = readStoredLanguage();
+			var languageId = storedLanguage !== null && LANGUAGE_IDS.indexOf(storedLanguage.id) >= 0 ? storedLanguage.id : "auto";
+			var languageText = storedLanguage !== null ? storedLanguage.text : "";
+
 			function idleState() {
 				return {
 					sessionId: sessionId,
@@ -1134,7 +1382,10 @@ window.__ModuleLoader__.load({
 					busy: null,
 					refreshing: false,
 					lastResult: null,
-					panelOpen: false
+					panelOpen: false,
+					settingsOpen: false,
+					generateLanguage: languageId,
+					generateLanguageText: languageText
 				};
 			}
 
@@ -1169,6 +1420,7 @@ window.__ModuleLoader__.load({
 						phase: "error",
 						error: status && status.error ? String(status.error.message || "git status failed") : "git status failed",
 						panelOpen: state.panelOpen,
+						settingsOpen: state.settingsOpen,
 						lastResult: state.lastResult
 					});
 				}
@@ -1188,6 +1440,7 @@ window.__ModuleLoader__.load({
 					remote: bv !== null && Array.isArray(bv.remote) ? bv.remote : [],
 					commits: lv !== null && Array.isArray(lv.commits) ? lv.commits : [],
 					panelOpen: state.panelOpen,
+					settingsOpen: state.settingsOpen,
 					lastResult: state.lastResult
 				});
 			}
@@ -1222,6 +1475,7 @@ window.__ModuleLoader__.load({
 						phase: "error",
 						error: error && error.message ? String(error.message) : String(error),
 						panelOpen: state.panelOpen,
+						settingsOpen: state.settingsOpen,
 						lastResult: state.lastResult
 					}));
 				});
@@ -1294,8 +1548,57 @@ window.__ModuleLoader__.load({
 				});
 			}
 
+			/**
+			 * Open/close the workbench. Closing it also drops the settings popover:
+			 * the panel component keeps its state while collapsed (it renders
+			 * nothing), so a popover left open would spring back over the next open.
+			 */
 			function setPanelOpen(open) {
-				emit(Object.assign({}, state, { panelOpen: open === true }));
+				emit(Object.assign({}, state, {
+					panelOpen: open === true,
+					settingsOpen: open === true ? state.settingsOpen : false
+				}));
+			}
+
+			/** Open/close the header's settings popover. */
+			function setSettingsOpen(open) {
+				emit(Object.assign({}, state, { settingsOpen: open === true }));
+			}
+
+			/**
+			 * Persist the commit-message language. The settings popover is the only
+			 * writer; both seats read it back through the shared state, so the select
+			 * always shows what the next draft will actually ask for.
+			 * @param id - a preset id, or `custom`.
+			 * @param text - the custom language name (read only for `custom`).
+			 */
+			function setGenerateLanguage(id, text) {
+				languageId = LANGUAGE_IDS.indexOf(id) >= 0 ? id : "auto";
+				// Kept verbatim: this value is echoed back into a controlled text
+				// field, and trimming on every keystroke eats the space a user just
+				// typed. The directive is trimmed where it is actually read.
+				languageText = typeof text === "string" ? text : "";
+				writeStoredLanguage(languageId, languageText);
+				emit(Object.assign({}, state, {
+					generateLanguage: languageId,
+					generateLanguageText: languageText
+				}));
+			}
+
+			/**
+			 * The language directive to send with a draft. `undefined` means "follow
+			 * the repository" — which is also what an EMPTY custom field means: an
+			 * empty string would be rejected by the host's validation instead of
+			 * drafting, and "I typed nothing yet" must not break the button.
+			 * @returns the language NAME, or undefined.
+			 */
+			function languageDirective() {
+				if (languageId === LANGUAGE_CUSTOM_ID) {
+					var trimmed = languageText.trim();
+					return trimmed === "" ? undefined : trimmed;
+				}
+				var preset = LANGUAGE_PRESETS.filter(function (entry) { return entry.id === languageId; })[0];
+				return preset === undefined ? undefined : preset.directive;
 			}
 
 			return {
@@ -1305,6 +1608,9 @@ window.__ModuleLoader__.load({
 				bindSession: bindSession,
 				act: act,
 				setPanelOpen: setPanelOpen,
+				setSettingsOpen: setSettingsOpen,
+				setGenerateLanguage: setGenerateLanguage,
+				languageDirective: languageDirective,
 				verbs: verbs
 			};
 		}
@@ -1320,6 +1626,73 @@ window.__ModuleLoader__.load({
 			fontWeight: 600
 		};
 
+		/**
+		 * The settings popover: one row per setting, anchored under the header.
+		 *
+		 * Pure and exported, so the render test can drive it directly — SSR runs no
+		 * effects and the popover starts closed, so a static panel render never
+		 * contains it. Everything it needs arrives through `spec`; the store's
+		 * `generateLanguage` stays the single source of truth (the select is
+		 * controlled), so the popover cannot drift from what the next draft sends.
+		 *
+		 * @param spec - `{ t, language, customText, onLanguage, onCustomText, onClose }`.
+		 * @returns the popover element.
+		 */
+		function settingsView(spec) {
+			var t = spec.t;
+			var children = [
+				h("div", { key: "head", style: S.settingsHead }, [
+					h("span", { key: "title", style: S.settingsTitle }, t("settings.title")),
+					h("button", {
+						key: "close",
+						type: "button",
+						style: S.iconButton,
+						onClick: spec.onClose,
+						title: t("settings.close"),
+						"aria-label": t("settings.close"),
+						"data-dsh-git": "settings-close"
+					}, "×")
+				]),
+				h("div", { key: "language", style: S.settingsRow }, [
+					h("span", { key: "label", style: S.settingsLabel }, t("settings.language")),
+					h("select", {
+						key: "select",
+						style: S.select,
+						value: spec.language,
+						title: t("settings.language"),
+						"aria-label": t("settings.language"),
+						"data-dsh-git": "settings-language",
+						onChange: function (event) { spec.onLanguage(event.target.value); }
+					}, LANGUAGE_IDS.map(function (id) {
+						return h("option", { key: id, value: id, style: OPTION_STYLE }, t("settings.language." + id));
+					}))
+				])
+			];
+			// The free-form name only exists behind its own entry: a text field
+			// shown beside the preset list would read as "type here too".
+			if (spec.language === LANGUAGE_CUSTOM_ID) {
+				children.push(h("input", {
+					key: "custom",
+					type: "text",
+					style: S.input,
+					value: spec.customText,
+					placeholder: t("settings.language.customPlaceholder"),
+					title: t("settings.language.customPlaceholder"),
+					"aria-label": t("settings.language.customPlaceholder"),
+					"data-dsh-git": "settings-language-text",
+					onChange: function (event) { spec.onCustomText(event.target.value); }
+				}));
+			}
+			children.push(h("div", { key: "hint", style: S.settingsHint }, t("settings.language.hint")));
+			return h("div", {
+				key: "settings",
+				style: S.settingsPopover,
+				role: "dialog",
+				"aria-label": t("settings.title"),
+				"data-dsh-git": "settings-popover"
+			}, children);
+		}
+
 		/** One branch option list; remote picks carry the DWIM-able short name. */
 		function branchOptions(state, t) {
 			var local = state.local.map(function (entry) {
@@ -1800,10 +2173,14 @@ window.__ModuleLoader__.load({
 			// with "selector is not a function".
 			var sessions = useSessions(function (s) { return s; });
 
-			// NOTE: the shell's seed react-dom is an experimental 18.3.1-next
-			// build where React.useSyncExternalStore misbehaves (returns
-			// undefined / throws), so subscribe through the classic
-			// useState + useEffect pattern instead — safe on any React.
+			// NOTE: subscribe through the classic useState + useEffect pattern
+			// instead of React.useSyncExternalStore, so this store's own
+			// subscription is independent of whichever implementation the seed
+			// ships. This is about keeping one dependency out of the path, not a
+			// claim that the seeded build is broken: the framework's own
+			// `useSessions` prop already goes through the renderer's
+			// useSyncExternalStoreWithSelector, so an unusable seed would break
+			// the session list before it broke this panel.
 			var stateRef = React.useState(function () { return store.getSnapshot(); });
 			var state = stateRef[0];
 			var setState = stateRef[1];
@@ -1824,16 +2201,10 @@ window.__ModuleLoader__.load({
 			var sessionId = state.sessionId;
 			var currentSummary = sessionId !== null && sessions && sessions.byId ? sessions.byId[sessionId] : undefined;
 
-			// The session's own model route, when one is recorded: the durable
-			// `modelSelection` projection, pending pick first, last used second.
-			// Generation falls back to the host's first registered route.
-			var sessionRoute = (function () {
-				var selection = currentSummary && currentSummary.projectionValues ? currentSummary.projectionValues.modelSelection : undefined;
-				if (!selection) return null;
-				var effective = selection.next || selection.lastUsed;
-				if (!effective || !effective.provider || !effective.model) return null;
-				return { provider: effective.provider, model: effective.model };
-			})();
+			// The session's own model route, when one is recorded. Both projection
+			// surfaces it can come from are handled by sessionModelRoute; a
+			// missing route leaves generation to the host's first registered one.
+			var sessionRoute = sessionModelRoute(currentSummary, sessions, sessionId);
 
 			var messageRef = React.useState("");
 			var message = messageRef[0];
@@ -1869,6 +2240,13 @@ window.__ModuleLoader__.load({
 				setOutputOpen(false);
 			}, [state.lastResult]);
 
+			// Whether the header's ⚙ popover is open. It lives in the STORE, not in
+			// component state: the store already owns `panelOpen`, and closing the
+			// panel has to take the popover down with it (the component keeps its
+			// state while collapsed, since it renders null) — one owner, one rule.
+			var settingsOpen = state.settingsOpen === true;
+			function setSettingsOpen(open) { store.setSettingsOpen(open); }
+
 			// Branch the user picked while the tree is dirty: the pre-check
 			// shows a warning instead of switching immediately; the switch only
 			// runs via the "switch anyway" button (or once the tree is clean).
@@ -2129,6 +2507,11 @@ window.__ModuleLoader__.load({
 					transform: "none"
 				});
 			}
+			// The settings popover lives inside the panel's own box, and the
+			// single-column panel is content-sized: with a short body (the initial
+			// loading line, an error, an empty repository) `overflow: hidden` would
+			// clip it. 240px is the popover's own height plus the header band.
+			if (settingsOpen && panelStyle.height === undefined) panelStyle.minHeight = 240;
 
 			if (cwd === null) {
 				// No Session bound (nothing to float over the input).
@@ -2155,6 +2538,19 @@ window.__ModuleLoader__.load({
 			}, [
 				h("span", { key: "title", style: S.title }, "⎇ " + t("panel.title")),
 				h("span", { key: "cwd", style: S.cwdPath, title: cwd }, shortText(cwd, 80)),
+				h("button", {
+					key: "settings",
+					type: "button",
+					// The panel's own settings live behind this gear rather than in
+					// the body: they configure how the panel writes (the commit
+					// message's language), not what this repository contains.
+					style: Object.assign({}, S.iconButton, settingsOpen ? S.iconButtonActive : null),
+					onClick: function () { setSettingsOpen(!settingsOpen); },
+					"aria-label": t("settings.aria"),
+					"aria-expanded": settingsOpen === true ? "true" : "false",
+					title: t("settings.aria"),
+					"data-dsh-git": "settings"
+				}, "⚙"),
 				h("button", {
 					key: "refresh",
 					type: "button",
@@ -2449,7 +2845,26 @@ window.__ModuleLoader__.load({
 					};
 					var text = known[details.code];
 					if (text === undefined) {
-						text = res && res.error && res.error.message ? String(res.error.message) : t("generate.failed");
+						// Unknown code (a transport failure, a provider rejection,
+						// …): lead with the localized sentence, keep the host's
+						// own words as the diagnosis, and name the route that
+						// failed — "which provider is broken" is the actionable
+						// part when a gateway refuses the call.
+						var detail = res && res.error && res.error.message ? String(res.error.message) : "";
+						var failedRoute = details.provider && details.model
+							? { provider: details.provider, model: details.model }
+							: null;
+						if (detail === "") {
+							text = t("generate.failed");
+						} else if (failedRoute !== null) {
+							text = t("generate.failedRoute", {
+								message: shortText(detail, 160),
+								provider: failedRoute.provider,
+								model: failedRoute.model
+							});
+						} else {
+							text = t("generate.failedDetail", { message: shortText(detail, 160) });
+						}
 					}
 					return { kind: "error", text: text };
 				}
@@ -2462,7 +2877,12 @@ window.__ModuleLoader__.load({
 							state.cwd,
 							generateMode,
 							route ? route.provider : undefined,
-							route ? route.model : undefined
+							route ? route.model : undefined,
+							state.sessionId === null ? undefined : state.sessionId,
+							// The forced output language from the settings popover;
+							// undefined ("auto", or an empty custom field) lets the
+							// model follow the repository instead.
+							store.languageDirective()
 						);
 					}, describeGenerate).then(function (res) {
 						if (res && res.ok === true && res.value && res.value.message) {
@@ -2604,7 +3024,29 @@ window.__ModuleLoader__.load({
 				onMouseLeave: function () { setResizeHover(false); }
 			});
 
-			return h("div", { "data-dsh-git": "panel", style: panelStyle, ref: panelRef }, [header, body, resizeHandle]);
+			// The settings popover and its click catcher sit ABOVE the body in the
+			// panel's own box: the backdrop closes the popover on any click that is
+			// not on the popover itself, which is what makes dismissal work without
+			// a document-level listener (SSR runs no effects, so a listener would
+			// also be untestable).
+			var settingsLayer = settingsOpen ? [
+				h("div", {
+					key: "settings-backdrop",
+					style: S.settingsBackdrop,
+					onClick: function () { setSettingsOpen(false); },
+					"data-dsh-git": "settings-backdrop"
+				}),
+				settingsView({
+					t: t,
+					language: state.generateLanguage,
+					customText: state.generateLanguageText,
+					onLanguage: function (value) { store.setGenerateLanguage(value, state.generateLanguageText); },
+					onCustomText: function (value) { store.setGenerateLanguage(LANGUAGE_CUSTOM_ID, value); },
+					onClose: function () { setSettingsOpen(false); }
+				})
+			] : [];
+
+			return h("div", { "data-dsh-git": "panel", style: panelStyle, ref: panelRef }, [header].concat(settingsLayer, [body, resizeHandle]));
 		}
 
 		/**
@@ -2641,7 +3083,8 @@ window.__ModuleLoader__.load({
 				? true
 				: (summary.retainedBy.mainView || 0) > 0;
 
-			// Classic subscription pattern (see GitFloatingPanel for why).
+			// Classic subscription pattern (see GitFloatingPanel's note: keep this
+			// store independent of the seed's useSyncExternalStore build).
 			var stateRef = React.useState(function () { return store.getSnapshot(); });
 			var state = stateRef[0];
 			var setState = stateRef[1];
@@ -2677,17 +3120,22 @@ window.__ModuleLoader__.load({
 			}
 
 			// Left-aligned compact pill in the row band ABOVE the composer card
-			// (conversation.input.dock). The padding-left mirrors the centered
-			// card's left margin, so the pill hugs the textarea's top-left
-			// corner instead of floating at the conversation column's edge.
+			// (conversation.input.dock). The row box is capped at the composer
+			// card's own width and centered — the same way ui-conversation's own
+			// dock occupant (QueueDock) aligns itself — so the pill hugs the
+			// textarea's top-left corner instead of floating at the conversation
+			// column's edge. `--dsh-composer-card-max-width` is ui-conversation's
+			// internal variable (no published contract, and 0.1.7 added a second
+			// value for the embedded body); the 778px fallback keeps this row sane
+			// if it is ever renamed.
 			return h("div", {
 				style: {
 					boxSizing: "border-box",
 					display: "flex",
 					justifyContent: "flex-start",
 					width: "100%",
-					paddingLeft: "calc((100% - var(--dsh-composer-card-max-width, 778px)) / 2)",
-					margin: "2px 0"
+					maxWidth: "var(--dsh-composer-card-max-width, 778px)",
+					margin: "2px auto"
 				},
 				"data-dsh-git": "dock-row"
 			}, h("button", {
@@ -2769,10 +3217,15 @@ window.__ModuleLoader__.load({
 			DIFF_ROW: DIFF_ROW,
 			stripAnsiEscapes: stripAnsiEscapes,
 			outputView: outputView,
+			settingsView: settingsView,
+			LANGUAGE_PRESETS: LANGUAGE_PRESETS,
+			LANGUAGE_CUSTOM_ID: LANGUAGE_CUSTOM_ID,
+			LANGUAGE_STORAGE_KEY: LANGUAGE_STORAGE_KEY,
 			sectionView: sectionView,
 			changeTagStyle: changeTagStyle,
 			panelBoxStyle: panelBoxStyle,
-			DIFF_PANEL_HEIGHT: DIFF_PANEL_HEIGHT
+			DIFF_PANEL_HEIGHT: DIFF_PANEL_HEIGHT,
+			sessionModelRoute: sessionModelRoute
 		};
 		return module.exports;
 	}

package/lib/index.js

@@ -24,7 +24,8 @@
  *   - `push`      → git push (current branch's upstream).
  *   - `log`       → recent commit summary lines.
  *   - `generateMessage` → draft a commit message from the working tree through
- *                   the shared LLM service (see the endpoint's own docs).
+ *                   the shared LLM service (see the endpoint's own docs); the
+ *                   caller may pin the message's language with `language`.
  *
  * Every git run goes through execFile with a fixed argument array (no shell),
  * a timeout, and strict input validation.
@@ -49,7 +50,6 @@
  * `/api` transport — loopback or a configured trusted authority, same-origin.
  */
 import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
 import { isAbsolute } from "node:path";
 
 /** Stable Cordis plugin name. */
@@ -95,8 +95,28 @@ const LLM_STAT_MAX_CHARS = 2000;
 const LLM_MAX_TOKENS = 8192;
 /** Accepted `generateMessage` modes. */
 const GENERATE_MODES = ["staged", "unstaged", "all"];
+/**
+ * Longest session id this plugin will forward to the LLM service. Real ids are
+ * short branded strings; the cap only keeps a hostile caller from stuffing
+ * arbitrary text into a request header.
+ */
+const SESSION_ID_MAX_CHARS = 200;
 /** Default mode: the only one whose content is what `commit` will actually record. */
 const GENERATE_MODE_DEFAULT = "staged";
+/**
+ * Longest commit-message language directive the panel may send. The setting is
+ * a language NAME ("Simplified Chinese (简体中文)"), never a sentence, so a
+ * tight cap plus {@link LANGUAGE_DIRECTIVE} keep a caller from smuggling extra
+ * prompt rules into the system message.
+ */
+const LANGUAGE_MAX_CHARS = 60;
+/**
+ * Shape of an acceptable language directive: a letter or digit, then letters,
+ * digits, spaces and the punctuation real language names use. Deliberately no
+ * line feed, no control character and no `:` / `;` / quote — the characters
+ * that would let the value open a rule of its own inside the system prompt.
+ */
+const LANGUAGE_DIRECTIVE = /^[\p{L}\p{N}][\p{L}\p{N} .,()（）·'\-/+&]*$/u;
 
 /** A successful RPC result. */
 function ok(value) {
@@ -202,6 +222,27 @@ function validCwd(value) {
 	return typeof value === "string" && value.length > 0 && isAbsolute(value);
 }
 
+/**
+ * Read the caller's commit-message language setting.
+ *
+ * `undefined`/absent/`"auto"` all mean "follow the repository" (the historical
+ * behaviour), so the panel can send whatever its settings field holds without
+ * the host needing a language table of its own: the value is the language NAME
+ * the model should answer in, validated only for shape and length.
+ *
+ * @param raw - the caller's `language` argument.
+ * @returns `{ ok: true, value }` with the directive (or undefined for auto), or
+ *   `{ ok: false }` for anything that is not a plain language name.
+ */
+function readLanguage(raw) {
+	if (raw === undefined || raw === null) return { ok: true, value: undefined };
+	if (typeof raw !== "string") return { ok: false };
+	const trimmed = raw.trim();
+	if (trimmed === "" || trimmed.toLowerCase() === "auto") return { ok: true, value: undefined };
+	if (trimmed.length > LANGUAGE_MAX_CHARS || !LANGUAGE_DIRECTIVE.test(trimmed)) return { ok: false };
+	return { ok: true, value: trimmed };
+}
+
 /**
  * Validate a caller-supplied remote name (origin, upstream, …).
  * Plain segment: letters/digits/._- only.
@@ -682,8 +723,10 @@ function endpointFromPath(pathname) {
 
 /**
  * Read a request body with a hard byte cap.
- * Uses the classic data/end/error events rather than async iteration: the
- * IncomingMessage async iterator is not a stable path in this runtime.
+ * Deliberately uses the classic data/end/error events rather than async
+ * iteration: the host's own bridge does `for await (const chunk of req)`, and
+ * keeping this reader on the event API means one dependency fewer on an
+ * IncomingMessage behaviour this plugin cannot pin.
  * @param req - node:http request.
  * @param maxBytes - cap; exceeding it resolves to undefined.
  * @returns the utf8 body, or undefined on overrun/error/abort.
@@ -973,19 +1016,29 @@ async function readChangesForMode(rawCwd, mode, signal) {
 }
 
 /**
- * Frame one commit-message request. Kept language-neutral: the model is told to
- * match the codebase rather than to prefer either of this panel's locales.
+ * Frame one commit-message request.
+ *
+ * Without `language` the model is told to match the codebase rather than to
+ * prefer either of this panel's locales. With one, that rule is REPLACED by an
+ * explicit override: the user asked for a fixed language, and "follow the
+ * repository" is exactly the instruction a repository whose comments and past
+ * commits are in another language would otherwise win against.
+ *
  * @param stat - diffstat text (may be empty).
  * @param diff - unified diff text.
+ * @param language - language NAME the message must be written in, from
+ *   {@link readLanguage}; undefined follows the repository.
  */
-function generationPrompt(stat, diff) {
+function generationPrompt(stat, diff, language = undefined) {
 	const system = [
 		"You write one git commit message for the change set below.",
 		"Rules:",
 		"- Reply with the commit message only: no preamble, no quotes, no Markdown fences.",
 		"- One imperative subject line under 72 characters; add a short body only when the change needs it.",
 		"- Describe what changed and why, not how.",
-		"- Write in the language already used by the codebase's comments and existing commit subjects."
+		language === undefined
+			? "- Write in the language already used by the codebase's comments and existing commit subjects."
+			: `- Write the entire commit message — subject and body — in ${language}, and in no other language. The user chose this language explicitly, so it overrides the diff, the code comments and the existing commit subjects even when those are written in a different one. Do not translate the message back.`
 	].join("\n");
 	const body = [
 		"## Diffstat",
@@ -1038,17 +1091,21 @@ async function resolveLlmRoute(ctx, rawProvider, rawModel) {
  * Hand-built rather than imported from `@deepseek-ai/dsh-llm`: this package
  * deliberately declares no `@deepseek-ai/*` runtime imports, because a plugin
  * installed with pnpm `link:` resolves them from its own real source path,
- * where no host tree exists. The shape must stay exactly this: a fresh id, the
- * `user` role, one text block, and a plugin source.
+ * where no host tree exists.
+ *
+ * The shape is the host's documented hand-built one-shot input
+ * (`RequestUserInput`): the `user` role plus one text block, and deliberately
+ * **no `id` and no `source`**. dsh >= 0.1.7 retired the catch-all `plugin`
+ * source kind — `MessageSourceMap` has no such member ("each producer declares
+ * its own `kind` in its own module; there is no shared catch-all `plugin`
+ * kind", `dsh-llm/lib/types/message.d.ts`), and Session format v4 refuses
+ * `{kind:"plugin"}` outright (`dsh-session-format-v3-to-v4`). A one-shot
+ * request needs no durable identity: only `provider`/`model`/`messages`/… are
+ * read off {@link GenerateOptions}.
  * @param text - model-facing prompt body.
  */
 function generationMessage(text) {
-	return Object.freeze({
-		id: randomUUID(),
-		role: "user",
-		content: Object.freeze([Object.freeze({ type: "text", text })]),
-		source: Object.freeze({ kind: "plugin", plugin: name })
-	});
+	return { role: "user", content: [{ type: "text", text }] };
 }
 
 /**
@@ -1057,18 +1114,27 @@ function generationMessage(text) {
  * @param prompt - `{ system, body }` from {@link generationPrompt}.
  * @param route - `{ provider, model }` from {@link resolveLlmRoute}.
  * @param signal - cancellation (browser abort plus the server ceiling).
+ * @param sessionId - the caller's session, when it has one. Forwarded as
+ *   `GenerateOptions.sessionId`; adapters that need session affinity (they
+ *   receive it only when it is present — see `dsh-llm-pi-ai`'s options mapping)
+ *   reject an unidentified request outright, so an AI draft from the panel must
+ *   carry one.
  * @returns the trimmed message.
  * @throws on a terminal stream failure, an output cap hit before any text
  *   existed (`llm-truncated`), or genuinely empty output (`llm-empty`).
  */
-async function requestCommitMessage(ctx, prompt, route, signal) {
+async function requestCommitMessage(ctx, prompt, route, signal, sessionId = undefined) {
 	const options = {
 		provider: route.provider,
 		model: route.model,
 		messages: [generationMessage(prompt.body)],
 		system: prompt.system,
 		maxTokens: LLM_MAX_TOKENS,
-		signal
+		signal,
+		// Session-labelled routes (an "opencode go"-style gateway is the local
+		// example) answer 400 when the request carries no session identity, and
+		// the host's pi-ai adapter forwards this field only when it is present.
+		...(sessionId === undefined ? {} : { sessionId })
 	};
 	// Final text comes from the assembled blocks; the delta map is a fallback for
 	// an adapter that emits text without a closing `block-end`.
@@ -1108,13 +1174,26 @@ async function requestCommitMessage(ctx, prompt, route, signal) {
  * @param rawMode - `staged`, `unstaged`, or `all`.
  * @param rawProvider - caller's provider route (optional).
  * @param rawModel - caller's model id (optional).
+ * @param rawSessionId - caller's session id (optional; see
+ *   {@link requestCommitMessage} for why a session-scoped caller must send it).
+ * @param rawLanguage - language NAME the message must be written in (optional;
+ *   absent/`"auto"` follows the repository).
  * @param signal - transport cancellation.
  */
-async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, signal) {
+async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, rawSessionId, rawLanguage, signal) {
 	if (!validCwd(rawCwd)) return fail("invalid-cwd", "a valid absolute working directory is required");
 	if (rawMode !== undefined && rawMode !== null && !GENERATE_MODES.includes(rawMode)) {
 		return fail("invalid-mode", `mode must be one of ${GENERATE_MODES.join(", ")}`);
 	}
+	if (rawSessionId !== undefined && rawSessionId !== null
+		&& (typeof rawSessionId !== "string" || rawSessionId === "" || rawSessionId.length > SESSION_ID_MAX_CHARS)) {
+		return fail("invalid-session", "sessionId must be a non-empty string when present");
+	}
+	const language = readLanguage(rawLanguage);
+	if (language.ok !== true) {
+		return fail("invalid-language", `language must be a plain language name of at most ${LANGUAGE_MAX_CHARS} characters`);
+	}
+	const sessionId = typeof rawSessionId === "string" ? rawSessionId : undefined;
 	const mode = rawMode ?? GENERATE_MODE_DEFAULT;
 	const changes = await readChangesForMode(rawCwd, mode, signal);
 	if (changes.ok !== true) return changes;
@@ -1130,7 +1209,8 @@ async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, s
 	}
 	const prompt = generationPrompt(
 		clampForModel(changes.value.stat, LLM_STAT_MAX_CHARS),
-		clampForModel(changes.value.diff, LLM_DIFF_MAX_CHARS)
+		clampForModel(changes.value.diff, LLM_DIFF_MAX_CHARS),
+		language.value
 	);
 	// Bound the call even if the browser goes away without hanging up; the
 	// turn's own signal still cancels immediately.
@@ -1138,10 +1218,16 @@ async function gitGenerateMessage(ctx, rawCwd, rawMode, rawProvider, rawModel, s
 	const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
 	if (combined.aborted) return fail("cancelled", "generation was cancelled", { mode });
 	try {
-		const message = await requestCommitMessage(ctx, prompt, route, combined);
+		const message = await requestCommitMessage(ctx, prompt, route, combined, sessionId);
 		return ok({ message, mode, provider: route.provider, model: route.model });
 	} catch (error) {
-		return fail(error.pluginCode ?? "llm-failed", error instanceof Error ? error.message : String(error), { mode });
+		// The route rides along so the panel can name the provider that failed:
+		// a route-level gateway rejection otherwise reads as a plugin bug.
+		return fail(error.pluginCode ?? "llm-failed", error instanceof Error ? error.message : String(error), {
+			mode,
+			provider: route.provider,
+			model: route.model
+		});
 	}
 }
 
@@ -1187,7 +1273,7 @@ async function dispatch(ctx, endpoint, payload, signal) {
 		case "log":
 			return gitLog(args.cwd, args.count, signal);
 		case "generateMessage":
-			return gitGenerateMessage(ctx, args.cwd, args.mode, args.provider, args.model, signal);
+			return gitGenerateMessage(ctx, args.cwd, args.mode, args.provider, args.model, args.sessionId, args.language, signal);
 		default:
 			return fail("unknown-endpoint", `unknown git endpoint ${JSON.stringify(endpoint)}`);
 	}
@@ -1203,8 +1289,10 @@ function apply(ctx) {
 	// The channel runs git against caller-supplied absolute paths, so it must
 	// never mount unfenced: the connection service's Host/Origin + browser-cookie
 	// check is the only gate. `requestRejection` is the >= 0.1.5-rc.1 form of that
-	// check; an older host without it fails loudly instead of serving an open
-	// channel.
+	// check. An older host without it still gets no channel (this throws), but
+	// note the throw is *stderr-only* for the operator: dsh-app-boot treats
+	// non-required rows as optional, so this row is skipped with a warning rather
+	// than failing the boot. Never downgrade the guard to a pass-through.
 	const connection = ctx.get("connection");
 	if (connection === undefined || typeof connection.requestRejection !== "function") {
 		throw new Error(`${name}: this plugin requires dsh >= 0.1.5-rc.1 (connection.requestRejection is unavailable, so /dsh-git-rpc could not be fenced)`);
@@ -1213,7 +1301,15 @@ function apply(ctx) {
 		kind: "prefix",
 		path: RPC_CHANNEL,
 		handler: async (req, res) => {
-			const pathname = String(req.url ?? "/").split("?")[0];
+			// The host's own router matches on `new URL(req.url, "http://x").pathname`,
+			// so an absolute-form request target (a proxy in front of dsh web) must
+			// resolve here too. Origin-form targets are kept verbatim: `endpointFromPath`
+			// is the stricter reader (it rejects `.`/`..`/empty segments and anything
+			// outside the client's own segment pattern), and routing the raw target
+			// through the URL parser first would silently normalize a traversal
+			// attempt into a different endpoint instead of refusing it.
+			const rawTarget = String(req.url ?? "/");
+			const pathname = rawTarget.startsWith("/") ? rawTarget : new URL(rawTarget, "http://x").pathname;
 			const endpoint = endpointFromPath(pathname);
 			if (endpoint === undefined) {
 				sendEnvelope(res, 404, rpcError("invalid-request", "not-found", "not found", {}));
@@ -1289,4 +1385,4 @@ function apply(ctx) {
 // diff through git first, so `generateMessage` needs a real repository to reach
 // them) and the commit-message normalizer (pure, and the exact place the
 // subject+body regression lived).
-export { apply, clampForModel, generationPrompt, inject, name, normalizeCommitMessage, requestCommitMessage, resolveLlmRoute };
+export { apply, clampForModel, generationPrompt, inject, name, normalizeCommitMessage, readLanguage, requestCommitMessage, resolveLlmRoute };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xia-sc/dsh-git",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Complete Git management for the DeepSeek Harness Web GUI: branch switch, new-branch-from-base, fetch, pull, stage-all, commit (with AI-drafted message), push, status, and a click-to-open diff viewer (staged/unstaged, resizable) — as a collapsible floating panel that follows the current session's workspace.",
   "type": "module",
   "main": "lib/index.js",
@@ -39,9 +39,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node test/smoke.mjs && node test/host-mount.mjs && node test/generate.mjs && node test/render.mjs",
+    "test": "node test/smoke.mjs && node test/host-mount.mjs && node test/slot-mount.mjs && node test/generate.mjs && node test/render.mjs",
     "test:commit": "node test/commit.mjs",
     "test:diff": "node test/diff.mjs",
+    "test:ui:settings": "node test/ui/verify-settings.mjs",
     "prepublishOnly": "npm test"
   },
   "dsh": {
@@ -51,9 +52,12 @@
     "client": {
       "platform": "web",
       "inject": [
+        "@deepseek-ai/dsh-client-connection",
         "@deepseek-ai/dsh-client-locale",
         "@deepseek-ai/dsh-client-ui-conversation",
-        "@deepseek-ai/dsh-client-ui-layout"
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-session"
       ]
     }
   },