dsh-claude-style 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to `dsh-claude-style` are documented here, newest first.
 
+## [0.7.2] - 2026-09-25
+
+[中文](#cn-0.7.2) | [English](#en-0.7.2)
+
+<h3 id="cn-0.7.2">新增功能</h3>
+
+- **账号位置的头像改为玩家自己的皮肤**：启动器记下了玩家导入的皮肤，宿主半边把那张规范化贴图以只读路由发给浏览器，浏览器按启动器账号列表相同的裁法取头部——脸的 8×8 贴图块按盒子的 1/18 内缩，帽子层铺满整个盒子。头部按**方形**绘制，不用账号头像那条路径的圆形遮罩：它画到盒子边缘，任何圆角都会切掉它的像素。没有头像、头像文件已删、图取不到时显示 Claude 徽标。
+- **权限档位改为跟随宿主目录**：权限控件（输入框分段控件与它的弹层）不再写死四档，段位与行都按宿主的 `permissionPresets` 目录构建——目录里有的档位才画，宿主没提供的整条不出现，第三方插件注册的档位因此成为一等公民：auto mode 插件的 `auto-mode` 会以 **Auto mode** 出现在弹层里，并在分段控件里占用 **Auto** 那一格（部署同时提供宿主内置 Auto review 时，内置档退居弹层、把格子让给部署自己的自动档）。档位名与说明仍由皮肤给（皮肤不认识的档位用宿主自己的名字与说明，机器值不上屏），行保持纯文字——预设声明的 `icon` 也不画，档位列表读起来是一份清单。切换仍走宿主的 `/permission <preset>`。
+
+### 体验优化
+
+- **工作台首页在还没选工作区时也显示用量面板与权限分段**：刚打开、尚无会话的首页此前只有问候语和输入框；现在用量面板照常出现在两者之间，输入框下方显示 Read / Edit / Auto / Yolo 分段，停在新会话的默认权限上，点它和点输入框一样打开工作区选择。
+- **工作台首页「先选工作区」的虚线框只框住单行输入框**：虚线框此前连同输入框下方的工具行一起框进去，比输入框高出一截；现在虚线画在单行输入框本身，指针移上去时变色的提示不变。
+
+### 问题修复
+
+- 修复 **选中划过行内代码时代码段显示为一块偏浅的独立高亮**：芯片的半透明底色画在选中高亮之上，把芯片内的选中色混浅了一档；现在芯片内的选中色预先抵消这层罩色，整段选区呈现统一的选中色，聚焦与失焦、深色与浅色下一致。
+- 修复 **窗口较矮时工作台首页被用量面板撑出窗口**：面板放不下时整页向下延伸，问候语被顶出窗口上沿；现在面板在问候语与输入框之间自己滚动，底边渐隐，滚到底时渐隐消失，问候语、上下文行与输入框都留在窗口内。
+
+<h3 id="en-0.7.2">New Features</h3>
+
+- **The account row's mark becomes the player's own skin**: the launcher stores every imported skin as a normalized texture atlas, and the host half serves it over a read-only route. The browser crops the head the way the launcher's own account list does — the face's 8×8 texel block inset by 1/18 of the box, with the hat layer over the whole box. The head is drawn **square** rather than under the round mask the avatar-photo path uses, because it reaches the box's edges and any rounding would shave its pixels off. With no picture, a deleted file, or a picture that cannot be served, the Claude mark shows.
+- **The permission ladder now follows the host catalog**: the permission control (the composer's segmented group and its popover) no longer hardcodes four tiers. Both the segments and the rows are built from the host's `permissionPresets` catalog, so a deployment offers exactly the tiers it configures and a tier no one serves is absent rather than drawn dead. A tier a third-party plugin registers is therefore a first-class entry: the auto mode plugin's `auto-mode` appears as **Auto mode** in the popover and takes the **Auto** slot of the segmented group (when the deployment also serves the host's built-in Auto review, that one stays in the popover and the slot goes to the deployment's own tier). Names and descriptions still come from the skin — a tier it does not know reads with the host's own name and description, never with its machine id — and the rows stay text-only: a preset's declared `icon` is not drawn either, so the ladder reads as one list. Switching still goes through the host's `/permission <preset>`.
+
+### Improvements
+
+- **The Studio home shows the usage panel and the permission segments before a workspace is picked**: a fresh home with no session yet showed only the greeting and the input box; the usage panel now sits between them as usual, and the Read / Edit / Auto / Yolo segments show under the input box, resting on the preset a new session starts in — pressing them opens the workspace picker, the same as pressing the input box.
+- **The Studio home's dashed "pick a workspace" ring outlines the single-line input box alone**: the ring used to take in the toolbar row under the input box and stood a row taller than it; it is now drawn on the input box itself, and still changes colour under the pointer.
+
+### Bug Fixes
+
+- Fixed **inline code showing a separate, lighter highlight when selected**: the chip's translucent wash painted over the selection and lightened it inside the chip; the in-chip selection paint now pre-compensates for that wash, so a selection crossing inline code is one even colour, focused or blurred, dark or light.
+- Fixed **the usage panel pushing the Studio home past a short window**: when the panel did not fit, the whole page grew downward and the greeting ran off the top; the panel now scrolls between the greeting and the composer with its bottom edge fading out (the fade lifts at the end of the scroll), and the greeting, the context row and the input box stay in the window.
+
+**Full Changelog**: [v0.7.1...v0.7.2](https://github.com/Nwflower/dsh-claude-style/compare/v0.7.1...v0.7.2)
+
 ## [0.7.1] - 2026-09-25
 
 [中文](#cn-0.7.1) | [English](#en-0.7.1)

package/README.en.md

@@ -63,13 +63,13 @@ Keep only one theme enabled at a time. After installation, **restart `dsh web`**
 ## Features
 
 1. **Theme** — applies globally the moment it is installed, with nothing to configure. Light mode uses ivory `#FCFCFB`, dark mode warm black `#141413`, and both share the same ember orange `#D97757` action accent; light/dark follows the system color mode.
-2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Read / Edit / Auto / Yolo — the Auto tier appears only when the host has the built-in auto review enabled), a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color.
+2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Read / Edit / Auto / Yolo) with its tier list under it, a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color. The permission tiers come from the host's own catalog: a deployment draws exactly the tiers it configures, and a tier a third-party plugin registers (the auto mode plugin's `auto-mode`, say) appears in the list and takes the Auto slot; the list stays text-only, so a tier's declared glyph is not drawn.
 3. **Model picker** — a new two-level popover. The first level lists the official service plus the quick providers selected in settings; "More models" opens a second level grouped by provider. Every row carries its vendor lockup and a description, and the footer holds the reasoning-effort slider (stepless — it snaps to the nearest level on release) together with the "More models" entry. The second level aligns its bottom edge with the first, providers already shown on the first level are not repeated, and models without thinking support get no slider. Hovering opens the popover after a 100 ms dwell and closes it after 150 ms; the gap between the two cards does not count as leaving.
 4. **Workspace** — the sidebar's "Workspace" heading becomes an **Active / Archived** segmented control. Active keeps the host's session tree, while Archived is the skin's own flat list (title, time, and per-row unarchive and delete icon buttons). Rows match the host's session rows measurement for measurement (row x=12 / width 251 / height 28 / title x=36).
 5. **Sidebar** — the New session and Plugins rows take Claude's real shape: no background at rest, a background on hover, the "＋" of New session set inside a circular chip, and both icons rotating 90° clockwise on hover (four-fold symmetric glyphs, so they land back on themselves). The account drawer and the ban-screen easter egg remain as they were.
-6. **Account area** — the nickname and the picture each follow one fixed order. Nickname: the custom nickname → the signed-in account's name → the HDSL launcher's account name → the last probed system user → the freshly probed system user → `User`. Picture: the signed-in account's avatar → the HDSL launcher's avatar → the Claude mark. The account profile is fetched from the server only at startup, on hot reload, and on sign-in and sign-out — never polled. The HDSL contract is read once by the host half and forwarded over two read-only routes (`GET /dsh-claude-style/hdsl` for the metadata, `GET /dsh-claude-style/hdsl-skin.png` for the avatar image; neither carries the avatar file's absolute path, and both sit behind the host's request fence). A contract version that is missing or unknown voids the whole group, and a deleted avatar file falls back to the mark. The account popover remains the host's own: the host's account row is the entry point, and the popover lists the account header, the other plugins' footer entries, and the host's own Settings / Feedback / Sign out, each keeping its original copy, order, and click behavior. On hosts without an account area (Web), the plugin builds a popover with the same look. The card uses a pure white background and spans the sidebar's width.
+6. **Account area** — the nickname and the picture each follow one fixed order. Nickname: the custom nickname → the signed-in account's name → the HDSL launcher's account name → the last probed system user → the freshly probed system user → `User`. Picture: the signed-in account's avatar → the HDSL launcher's avatar → the Claude mark. The account profile is fetched from the server only at startup, on hot reload, and on sign-in and sign-out — never polled. The HDSL contract is read once by the host half and forwarded over two read-only routes (`GET /dsh-claude-style/hdsl` for the metadata, `GET /dsh-claude-style/hdsl-skin.png` for the avatar image; neither carries the avatar file's absolute path, and both sit behind the host's request fence). A contract version that is missing or unknown voids the whole group, and a deleted avatar file falls back to the mark. What the launcher publishes is a skin sheet rather than a finished avatar, so that picture is cropped into the head first — the face's 8×8 texel block inset by 1/18 of the box with the hat layer over the whole box, drawn square so no rounding shaves its pixels. The account popover remains the host's own: the host's account row is the entry point, and the popover lists the account header, the other plugins' footer entries, and the host's own Settings / Feedback / Sign out, each keeping its original copy, order, and click behavior. On hosts without an account area (Web), the plugin builds a popover with the same look. The card uses a pure white background and spans the sidebar's width.
 7. **Conversation views** — in the desktop Windows titlebar mode, the Conversation / Trajectory control sits centered and always visible on the titlebar row (the same row as the New session button). On wide windows with a short title it stays on the title's row; otherwise it keeps its own row below the title.
-8. **Home layouts** — the new-conversation page comes in two layouts, Studio by default and switchable in the settings page at any time: **Classic** is the centered headline over the composer card, the headline drawn from a pool of greetings for the time of day (a few each for morning, midday, afternoon, evening and night, plus a few for any hour) and redrawn each time the new-conversation page comes back; **Studio** pins the greeting to the top left as one fixed line ("What's up next, <user>?"), docks the composer in the conversation's single-line form at the window's bottom edge with a row of hairline context chips above it, and sets the greeting and a 480px usage panel against the composer's left edge: an Overview tab with six stat cells (sessions, messages, total tokens, active days, peak hour, favorite model) and a twenty-six-week per-day heat grid of square cells in equal columns, a Models tab stacking each day's per-model tokens into one bar over a ranked model list (swatch, name, input and output, share; past six rows it folds behind a "show more" row, and the open list folds back with "show less"), and All / 30d / 7d range pills at the top right, which the peak hour and the multiplier line follow too; once the picked range's total passes one book, a multiplier line appears under the grid, naming one of eleven books (Animal Farm to In Search of Lost Time) drawn afresh each time the new-conversation page comes back. The numbers are rolled up by the plugin's host half: with `dsh-cost-meter` installed it reads that plugin's ledger cache directly (read-only — their file is never written), and without it the host half folds the local session logs itself, caching per log by size and modification time. Both sources answer each model's four buckets and each day's per-model tokens, with one model served by several providers counted as one row; the ledger keeps no hours, so the peak hour is always folded per day from the local session logs; when the roll-up cannot answer, the panel falls back to the projection block each host session row carries. The panel draws its skeleton first and does not shift when the numbers land.
+8. **Home layouts** — the new-conversation page comes in two layouts, Studio by default and switchable in the settings page at any time: **Classic** is the centered headline over the composer card, the headline drawn from a pool of greetings for the time of day (a few each for morning, midday, afternoon, evening and night, plus a few for any hour) and redrawn each time the new-conversation page comes back; **Studio** pins the greeting to the top left as one fixed line ("What's up next, <user>?"), docks the composer in the conversation's single-line form at the window's bottom edge with a row of hairline context chips above it, and sets the greeting and a 480px usage panel against the composer's left edge: an Overview tab with six stat cells (sessions, messages, total tokens, active days, peak hour, favorite model) and a twenty-six-week per-day heat grid of square cells in equal columns, a Models tab stacking each day's per-model tokens into one bar over a ranked model list (swatch, name, input and output, share; past six rows it folds behind a "show more" row, and the open list folds back with "show less"), and All / 30d / 7d range pills at the top right, which the peak hour and the multiplier line follow too; once the picked range's total passes one book, a multiplier line appears under the grid, naming one of eleven books (Animal Farm to In Search of Lost Time) drawn afresh each time the new-conversation page comes back. The numbers are rolled up by the plugin's host half: with `dsh-cost-meter` installed it reads that plugin's ledger cache directly (read-only — their file is never written), and without it the host half folds the local session logs itself, caching per log by size and modification time. Both sources answer each model's four buckets and each day's per-model tokens, with one model served by several providers counted as one row; the ledger keeps no hours, so the peak hour is always folded per day from the local session logs; when the roll-up cannot answer, the panel falls back to the projection block each host session row carries. The panel draws its skeleton first and does not shift when the numbers land. Before a workspace is picked (a fresh start, no session yet), the usage panel and the Read / Edit / Auto / Yolo permission segments still show; the segments rest on the preset a new session starts in, and pressing them opens the workspace picker, the same as pressing the input box, whose dashed "pick a workspace" ring now outlines the single-line input box alone. When the window is too short for the whole panel, the panel scrolls between the greeting and the composer with its bottom edge fading out, and the page no longer runs past the window.
 9. **The pixel crab** — in the Studio layout, Claude Code's pixel crab stands on the new-conversation composer card's top edge, near its right end (the Classic layout has none). When it is clicked or the pointer leaves it (and on its own every half minute or so while the page is open), it plays Claude Code's fishing routine: a half turn and a wink, the rod raised and cast down onto the card's edge, a spell of fishing side-on, and the rod put away as it turns back — about three seconds. With reduced motion requested (Windows' "Show animations in Windows" turned off, for one), it moves only when clicked.
 
 ## Disabling and uninstalling

package/README.md

@@ -63,13 +63,13 @@ dsh plugin --profile web add Nwflower/dsh-claude-style         # GitHub 源
 ## 特点
 
 1. **主题** —— 安装即全局生效，无需配置。亮色象牙白 `#FCFCFB`、暗色暖黑 `#141413`，两套画布共用同一个操作强调色陶烬橙 `#D97757`；亮暗跟随系统颜色模式切换。
-2. **输入框** —— 输入框整块重做：权限分段控件（只读 / 工作区 / 自动审查 / Yolo，自动审查档位仅在宿主启用内置自动审查时出现）、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。
+2. **输入框** —— 输入框整块重做：权限分段控件（只读 / 编辑 / 自动 / Yolo）与它下方的档位列表、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。权限档位取自宿主的权限目录：宿主配置了哪几档就画哪几档，第三方插件注册的档位（例如 auto mode 插件的 `auto-mode`）会自动出现在列表里并占用「自动」那一格；列表保持纯文字，档位自己声明的图标不画。
 3. **模型选择器** —— 全新的两级弹层：一级列官方服务与设置页勾选的快捷供应商，「更多模型」二级按供应商分组；每行带厂商锁定标与说明文案，底部是推理等级推条（无极滑动，松手对齐最近档位）与「更多模型」入口。二级底边与一级对齐，一级已显示的供应商不再重复；模型不支持思考时不画推条。悬停停留 100ms 打开、离开 150ms 关闭，两卡之间的空隙不算离开。
 4. **工作区** —— 侧栏「工作区」标题改成 **进行中 / 已归档** 分段控件：进行中沿用宿主的会话树，已归档是皮肤自己的平铺列表（标题、时间、每行「取消归档」与「删除」两个图标按钮）。行排版与宿主的会话行逐项一致（行 x=12 / 宽 251 / 高 28 / 标题起点 x=36）。
 5. **侧栏** —— 新会话与插件两行取 Claude 真机形状：默认无底色、hover 才有底色，新会话的「＋」套一枚圆形底，两行图标 hover 顺时针转 90°（四重对称图形，转回原位）；底部账户抽屉、封号彩蛋一并保留。
-6. **账号区** —— 昵称与头像各走一条固定顺序。昵称：自定义昵称 → 官方账号昵称 → HDSL 启动器昵称 → 上次探测到的系统用户名 → 本次探测到的系统用户名 → `User`；头像：官方账号头像 → HDSL 启动器头像 → Claude 徽标。官方账号资料只在启动、热重载、登录与登出时向服务器读取，不轮询；HDSL 契约由宿主半边读一次后经两条只读路由转发（`GET /dsh-claude-style/hdsl` 回账号元数据、`GET /dsh-claude-style/hdsl-skin.png` 回头像图片，都不含头像文件的绝对路径，并过宿主的请求栅栏），契约版本读不到或不认识时整组忽略，头像文件被删除时回落到徽标。账号弹层沿用宿主自带的那一个：宿主的账号行就是入口，弹层里依次是账号头部、其它插件的页脚条目与宿主自己的「设置 / 意见反馈 / 退出登录」，各行的文案、顺序与点击行为保持宿主原样；宿主没有账号区的环境（Web）由插件自建同样外观的弹层。弹层卡片为纯白背景、宽度与侧栏一致。
+6. **账号区** —— 昵称与头像各走一条固定顺序。昵称：自定义昵称 → 官方账号昵称 → HDSL 启动器昵称 → 上次探测到的系统用户名 → 本次探测到的系统用户名 → `User`；头像：官方账号头像 → HDSL 启动器头像 → Claude 徽标。官方账号资料只在启动、热重载、登录与登出时向服务器读取，不轮询；HDSL 契约由宿主半边读一次后经两条只读路由转发（`GET /dsh-claude-style/hdsl` 回账号元数据、`GET /dsh-claude-style/hdsl-skin.png` 回头像图片，都不含头像文件的绝对路径，并过宿主的请求栅栏），契约版本读不到或不认识时整组忽略，头像文件被删除时回落到徽标。启动器给的是皮肤贴图而不是成品头像，因此账号位置的头像由贴图裁出：脸部 8×8 贴图块按盒子 1/18 内缩、帽子层铺满整盒，方形绘制不被圆角裁切。账号弹层沿用宿主自带的那一个：宿主的账号行就是入口，弹层里依次是账号头部、其它插件的页脚条目与宿主自己的「设置 / 意见反馈 / 退出登录」，各行的文案、顺序与点击行为保持宿主原样；宿主没有账号区的环境（Web）由插件自建同样外观的弹层。弹层卡片为纯白背景、宽度与侧栏一致。
 7. **对话视图** —— 对话 / 轨迹控件在桌面 Windows 标题栏模式下居中常显在标题栏那一行（与新会话按钮同一行）；宽窗口且标题较短时它停在标题那一行，否则留在标题下方自己那一行。
-8. **首页版面** —— 新会话页有两套版面，默认是工作台，在设置页随时切换：**经典**是居中大标题加输入卡片，标题按时段从一组问候里抽一句（早上、午间、下午、晚上、深夜各有几句，另有几句不分时段），每次回到新会话页换一句；**工作台**把标题移到左上并固定为一句「What's up next, 用户名？」，输入框改用对话内的单行样式贴住窗口底部、上方一行细边框上下文胶囊，标题与一块 480px 窄栏用量面板贴着输入框左缘排布：概览页签是六个数字格（会话数、消息数、Token 总量、活跃天数、高峰时段、最常用模型）与 26 周按天热力图（等分列方格），模型页签是每天一根按模型颜色堆叠的柱子加一份模型排行（色块、模型名、输入与输出、占比，超过六行折成「再显示 N 个」，展开后可「收起」），右上角的「全部 / 30 天 / 7 天」切换统计范围（高峰时段与趣味行一并跟随）；所选范围内的用量超过一本书时，热力图下方出现倍数趣味行，书目共十一本（《动物农场》到《追忆似水年华》），每次回到新会话页随机换一本。数据由插件的宿主半边汇总：装了 `dsh-cost-meter` 时直接读它的账本缓存（只读，不写对方文件），没有时读本机会话日志自己算，并按日志的文件大小与修改时间增量缓存；两种来源都按模型给出四类 token、按天给出各模型的 token，同一模型经不同提供方的用量合成一行；账本不记小时，高峰时段始终由本机会话日志按天算出；汇总不可用时面板改用宿主会话列表每行自带的投影值。数字没到之前面板先画骨架，位置在填充前后不变。
+8. **首页版面** —— 新会话页有两套版面，默认是工作台，在设置页随时切换：**经典**是居中大标题加输入卡片，标题按时段从一组问候里抽一句（早上、午间、下午、晚上、深夜各有几句，另有几句不分时段），每次回到新会话页换一句；**工作台**把标题移到左上并固定为一句「What's up next, 用户名？」，输入框改用对话内的单行样式贴住窗口底部、上方一行细边框上下文胶囊，标题与一块 480px 窄栏用量面板贴着输入框左缘排布：概览页签是六个数字格（会话数、消息数、Token 总量、活跃天数、高峰时段、最常用模型）与 26 周按天热力图（等分列方格），模型页签是每天一根按模型颜色堆叠的柱子加一份模型排行（色块、模型名、输入与输出、占比，超过六行折成「再显示 N 个」，展开后可「收起」），右上角的「全部 / 30 天 / 7 天」切换统计范围（高峰时段与趣味行一并跟随）；所选范围内的用量超过一本书时，热力图下方出现倍数趣味行，书目共十一本（《动物农场》到《追忆似水年华》），每次回到新会话页随机换一本。数据由插件的宿主半边汇总：装了 `dsh-cost-meter` 时直接读它的账本缓存（只读，不写对方文件），没有时读本机会话日志自己算，并按日志的文件大小与修改时间增量缓存；两种来源都按模型给出四类 token、按天给出各模型的 token，同一模型经不同提供方的用量合成一行；账本不记小时，高峰时段始终由本机会话日志按天算出；汇总不可用时面板改用宿主会话列表每行自带的投影值。数字没到之前面板先画骨架，位置在填充前后不变。还没选工作区时（刚打开、尚无会话），用量面板与 Read / Edit / Auto / Yolo 权限分段照常显示，分段停在新会话的默认权限上，点它和点输入框一样打开工作区选择；表示「先选工作区」的虚线框只框住单行输入框本身。窗口高度放不下整块面板时，面板在问候语与输入框之间自己滚动、底边渐隐，页面不会被撑出窗口。
 9. **像素螃蟹** —— 工作台版面的新会话页上，输入卡片上沿、靠右的位置站着 Claude Code 的像素螃蟹（经典版面没有）。点它一下、或指针从它身上移开时（页面开着时也会每隔二三十秒自己来一次），它会照 Claude Code 的样子钓一次鱼：半转身眨眼，举起鱼竿甩到卡片边上，侧身钓一会儿，再收竿转回正面，前后约三秒。系统要求减少动态效果时（例如 Windows 关掉了「在 Windows 中显示动画」），它只在被点击时才动。
 
 ## 停用与卸载

package/docs/STYLE.md

@@ -221,7 +221,21 @@ removes the contest.
 **The usage panel.** It is a `conversation.input.dock` entry (the host's list
 seat between the greeting and the card; a list seat keys its entries by `id`),
 and it renders only in the hero phase — the host mounts that same seat inside a
-conversation, where the todo, queue and goal bars hang on it.
+conversation, where the todo, queue and goal bars hang on it. The seat is scoped
+to a session, so the cold start screen (no session yet, the card waiting for a
+workspace) has none; there the skin mounts the same component on a
+`display: contents` element of its own (`.dsh-claude-home-seat`) and drops it
+once the host's dock arrives. A window too short for the whole panel shrinks the
+panel, never the page: the greeting keeps the top edge, the chips and the card
+keep the bottom, and the panel scrolls between them with a 32px fade over its
+bottom edge that lifts over the last 32px of travel.
+
+The cold start card waits for a workspace: the host marks it with a dashed ring
+and makes every control on it inert, so a press anywhere opens the workspace
+picker. In the studio form the ring sits on the single-line input box itself
+(the host's dashed stroke and colours, flat, no drop shadow), and the permission
+segments fill the card's empty mode strip on the preset a new session starts in
+— disabled, like the rest of the card's controls.
 
 The panel is Claude Code's dashboard shape: a flat warm-gray wash (a
 `color-mix` of the label tone at 4% over the card tone, which flips with the

package/docs/architecture.md

@@ -119,15 +119,15 @@
 
 ## D15. HDSL 账号契约：宿主半边转发，浏览器半边只认一条回退顺序
 
-- **背景**：HDSL 启动器用 `HDSL_` 前缀的环境变量向实例公布「这是谁」：账号显示名、供应商、账号种类、头像来源，以及玩家头像 PNG 的绝对路径；`HDSL_ACCOUNT_CONTRACT` 是唯一必需键，读不到它整组作废。浏览器半边读不到进程环境，头像又是启动器数据目录里的一张图，两者都只能由宿主半边转发。
+- **背景**：HDSL 启动器用 `HDSL_` 前缀的环境变量向实例公布「这是谁」：账号显示名、供应商、账号种类、头像来源，以及玩家头像贴图的绝对路径；`HDSL_ACCOUNT_CONTRACT` 是唯一必需键，读不到它整组作废。浏览器半边读不到进程环境，贴图又只有绝对路径，两者都只能由宿主半边转发。启动器的皮肤是一张 64×64（或整数倍）的贴图集，不是成品头像：脸只是其中 (8,8) 起的 8×8 贴图块，帽子层在 (40,8)。
 - **决定**：
-  - 宿主半边只信 `process` 与 `user-env` 两层（项目目录的 `.env` 会随仓库被克隆，没有资格声明玩家是谁），契约版本不等于 `1` 时回 `{ contract: false }`，其余字段一律不看。
-  - 新增两条私有路由，与 `/username` 同级过 `refusalOf` 栅栏：`GET /dsh-claude-style/hdsl` 回账号元数据，**不含**头像文件的绝对路径；`GET /dsh-claude-style/hdsl-skin.png` 回头像字节——路径只来自环境，永远不来自请求，读不到就回 404 让浏览器回退。
-  - 读环境走 harness 自带的 `@deepseek-ai/dsh-launch-environment`（`launchEnvironmentOf(ctx)`）。解析方式与 schemastery 相同：`createRequire(process.argv[1]).resolve()` 拿到真实路径后动态 `import`。这是 AGENTS 记录在案的第二条例外，理由与 D10 相同——`link:` 安装的插件真实路径在 profile 树之外，普通 import 解析不到，而解析不到时皮肤必须照常加载。
+  - 宿主半边读 harness 启动时填好的启动环境快照（`ctx.launchEnvironment`，也就是 `launchEnvironmentOf(ctx)` 内部读的那个槽位），只信 `process` 与 `user-env` 两层（项目目录的 `.env` 会随仓库被克隆，没有资格声明玩家是谁），契约版本不等于 `1` 时回 `{ contract: false }`，其余字段一律不看。**不 import** harness 自带的启动环境包：`link:` 安装的插件解析不到它（与 `resolveSchemaFactory` 同一类问题），而那个包要读的正是这个槽位；宿主没填槽位就是没有契约。
+  - 新增两条私有路由，与 `/username` 同级过 `refusalOf` 栅栏：`GET /dsh-claude-style/hdsl` 回账号元数据，**不含**头像文件的绝对路径；`GET /dsh-claude-style/hdsl-skin.png` 回贴图字节——路径只来自环境，永远不来自请求，读不到就回 404 让浏览器回退。契约在进程生命周期内不变，宿主半边读一次并记住。
   - 浏览器半边把昵称与头像各收敛成一条回退顺序：昵称 = 自定义昵称 → 官方账号昵称 → HDSL 昵称 → 探测昵称缓存 → 探测昵称 → `User`；头像 = 官方账号头像 → HDSL 头像 → Claude 徽标（样式表里的底色标记）。官方账号资料与 HDSL 契约各自推给 `src/context/host.js` 的身份存储，两个消费点（欢迎语、账号行）只读这一处。
-- **理由**：契约在进程生命周期内不变，读一次就够，所以路由只转发、不轮询；把两条链收在一处，欢迎语、账号行、封号彩蛋不会各自漂移；缓存探测到的系统用户名，是为了刷新页面时欢迎语不再从 `User` 跳一次。
-- **代价**：桌面端宿主的账号行由宿主自己渲染，插件只在自建账号行上画头像，所以 HDSL 头像在桌面端只作用于插件自己的表面。
-- **重审条件**：HDSL 契约递增版本、或宿主提供「显示名 / 头像」的统一服务时，改接那一处，删掉本插件的转发路由。
+  - 头像不是直接贴上去的：启动器给的是贴图集，浏览器按启动器账号列表同样的裁法取头部（脸的 8×8 贴图块按盒子 1/18 内缩、帽子层铺满整盒）画进 64×64 画布再缩到账号位的尺寸，方形绘制不被圆角裁切；贴图只以裁出的头部出现，加载完成前、图取不到、契约没带图、文件被删时都显示徽标。画完主动叫一次 pass：贴图加载不改 DOM，没有 pass 会自己来。
+- **理由**：契约读一次就够，所以路由只转发、不轮询；把两条链收在一处，欢迎语、账号行、封号彩蛋不会各自漂移；缓存探测到的系统用户名，是为了刷新页面时欢迎语不再从 `User` 跳一次；裁脸几何与启动器账号列表一致，同一个玩家在启动器与皮肤里长得一样。
+- **代价**：桌面端宿主的账号行由宿主自己渲染，插件只在自建账号行上画头像，所以 HDSL 头像在桌面端只作用于插件自己的表面；只有玩家自选的本地图片能画，启动器内置的默认形象（steve/alex 等）没有像素可用，回退到徽标；契约在进程生命周期内不变，玩家中途换皮肤要下次启动才生效。
+- **重审条件**：HDSL 契约递增版本（其 v2 计划里有按指纹取图的媒体通道与账号 UUID）时，取图改为优先走该通道、以指纹作缓存键，按玩家存储的数据改用 UUID 作键；宿主提供「显示名 / 头像」的统一服务时，改接那一处，删掉本插件的转发路由。
 
 ## D16. 弹层共用两条基准：一个停留时长，一次只开一张卡
 
@@ -140,3 +140,11 @@
 - **理由**：停留时长是同一个交互问题（路过还是停留），分处写必然漂移；互斥此前成对硬编码，新增弹层时要记得改 N 处，登记表把它变成一次登记。
 - **代价**：登记表是模块级状态，特性卸载必须 `unregisterPopover`，否则旧一代的关闭函数留在表里。
 - **重审条件**：宿主提供统一的弹层管理（全局互斥或焦点陷阱）时，改接宿主的机制，删掉本插件的登记表。
+
+## D17. 权限档位以宿主目录为准，皮肤只做表现层
+
+- **背景**：权限控件（输入框分段控件与它的弹层）此前把四档写死在两张常量表里，只对内置 `auto`（Auto review）做一次目录判定。于是第三方插件注册的权限档位看不见也点不到——例如 auto mode 插件的 `auto-mode`（宿主 `permissionPresets` 目录里的一等条目：确定性规则 + 两阶段分类器），而且会话已经处于该档位时，触发键上会显示机器值 `auto-mode`。宿主的目录是「当前可选档位」的权威：`PermissionCatalog.options` 由宿主按贡献顺序给出，`PresetOption` 只有 `value` / `name` / `description`（部署打上 automode 提供的补丁或宿主将来原生支持时另有 `icon`）。
+- **决定**：段位与弹层行都按宿主目录构建——目录里有的档位才画，宿主没提供的整条不出现（不再有「画出来再隐藏」）；`PERMISSION_SEGMENTS` 只描述**格子**，每格列出可绑定的档位、按先后取第一个宿主提供的（部署自己的自动档优先于宿主内置的 Auto review），一格都绑不上就不画。档位名与说明来自皮肤的 `PERMISSION_PRESETS`，皮肤不认识的档位用目录自带的 `name`/`description`，永不把机器值上屏（宿主的 `custom` 用宿主自己的词）。行的内容是纯文字：档位声明的 `icon`（部署方写在预设上的 SVG 路径，宿主原生会忽略、由第三方补丁开启）**不画**——同一条列表里只有第三方档位带图标会读成两种东西，档位之间的区别交给名字与说明。切换仍走宿主的 `/permission <preset>`（与 automode 的 `/auto` 是同一条写入路径）。
+- **理由**：目录变化时皮肤不再漏档位；第三方档位成为一等公民而皮肤不需要认识它；名字由皮肤给、档位由宿主提供，两件事各自独立，接入新档位不用改皮肤代码，也不必让第三方为图标去打宿主 `node_modules` 的补丁。
+- **代价**：档位集合变化时要重建行与段位（此前只改显隐）；皮肤的表现表是一张白名单，不认识的档位会以宿主给的名字出现（可能不够 Claude 风味）但不会消失。
+- **重审条件**：宿主原生支持预设 `icon`、且界面上有了统一的档位图形语言时，再考虑把图标画回来。

package/lib/client.js

@@ -260,40 +260,51 @@ window.__ModuleLoader__.load({
       'Spinning', 'Twisting', 'Unfurling', 'Unravelling', 'Vibing', 'Whirring'
     ]
 
-    /** Segment label and the shipped /permission preset it selects. */
+    /**
+     * Claude-flavored presentation of the permission presets, keyed by preset
+     * id. The host's catalog decides WHICH presets a deployment offers — a
+     * third-party plugin's ride in it, the auto mode plugin's `auto-mode` among
+     * them — and this table decides how a known one reads. A preset the table
+     * does not know falls back to the name the catalog carries, so nothing the
+     * host offers is ever hidden and a machine id is never shown.
+     */
+    var PERMISSION_PRESETS = {
+      'read-only': { label: 'Read only', desc: '仅读取文件与分析，不修改代码' },
+      'workspace-write': { label: 'Accept edits', desc: '允许编辑工作区文件' },
+      'auto-mode': { label: 'Auto mode', desc: '规则放行常规操作，其余由分类器裁决' },
+      'auto': { label: 'Auto review', desc: '无沙箱运行，调用前由模型审查' },
+      'danger-full-access': { label: 'Full access', desc: '自动执行，无需反复确认' }
+    }
+
+    /**
+     * The control's segments, in slot order. Each slot lists the presets it may
+     * bind to, best first: the deployment's own auto tier wins the slot over the
+     * host's built-in Auto review, and a slot none of whose presets the host
+     * offers is not drawn at all.
+     */
     var PERMISSION_SEGMENTS = [
-      { label: 'Read', preset: 'read-only' },
-      { label: 'Edit', preset: 'workspace-write' },
-      { label: 'Auto', preset: 'auto' },
-      { label: 'Yolo', preset: 'danger-full-access' },
+      { label: 'Read', presets: ['read-only'] },
+      { label: 'Edit', presets: ['workspace-write'] },
+      { label: 'Auto', presets: ['auto-mode', 'auto'] },
+      { label: 'Yolo', presets: ['danger-full-access'] }
     ]
 
-    /** In-conversation permission popover options matching Claude Code desktop style. */
-    var PERMISSION_OPTIONS = [
-      {
-        preset: 'read-only',
-        label: 'Read only',
-        desc: '仅读取文件与分析，不修改代码'
-      },
-      {
-        preset: 'workspace-write',
-        label: 'Accept edits',
-        desc: '允许编辑工作区文件'
-      },
-      {
-        preset: 'auto',
-        label: 'Auto review',
-        desc: '无沙箱运行，调用前由模型审查'
-      },
-      {
-        preset: 'danger-full-access',
-        label: 'Full access',
-        desc: '自动执行，无需反复确认'
-      }
-    ]
+    /** Popover row order; a preset the host offers but this list does not know follows in catalog order. */
+    var PERMISSION_ORDER = ['read-only', 'workspace-write', 'auto-mode', 'auto', 'danger-full-access']
 
-    /** The preset the auto-review integration registers, offered only while it is live. */
-    var AUTO_REVIEW_PRESET = 'auto'
+    /**
+     * What the control draws before the host's first catalog read settles: the
+     * shipped built-ins, with the auto slot left out the way the shipped picker
+     * renders nothing until its own catalog arrives.
+     */
+    var PERMISSION_SHIPPED_PRESETS = ['read-only', 'workspace-write', 'danger-full-access']
+
+    /**
+     * Names for host values that are never switch targets. `custom` is the
+     * host's own word for knob settings that match no preset, so the trigger
+     * reads that rather than the machine value.
+     */
+    var PERMISSION_CURRENT_LABELS = { custom: 'Custom' }
 
     /** Skin-owned class names, so nothing couples to hashed CSS-module classes. */
     var SEGMENTS_CLASS = 'dsh-claude-segments'
@@ -423,11 +434,16 @@ window.__ModuleLoader__.load({
     var AUTO_POPOVER_ALL = 'all'
     var AUTO_POPOVER_SCOPES = [AUTO_POPOVER_OFF, AUTO_POPOVER_ACCOUNT, AUTO_POPOVER_ALL]
     var DEFAULT_AUTO_POPOVER = AUTO_POPOVER_ALL
-    /** Route that resolves the host OS user once; never polled. */
+    /** Route that resolves the name this instance runs as, once; never polled. */
     var USERNAME_ROUTE = '/dsh-claude-style/username'
     /** Route that forwards the HDSL launcher's account contract; never polled. */
     var HDSL_ROUTE = '/dsh-claude-style/hdsl'
-    /** The player's own avatar, forwarded by the host half; 404 falls back to the mark. */
+    /**
+     * The player's own avatar, forwarded by the host half; 404 falls back to the
+     * mark. What the route serves is the launcher's normalized skin atlas, not a
+     * finished avatar, so the account row crops the head out of it
+     * (src/overrides/account/rows.js).
+     */
     var HDSL_SKIN_ROUTE = '/dsh-claude-style/hdsl-skin.png'
     /** Longest accepted custom username; mirrored by lib/index.js. */
     var USERNAME_MAX = 64
@@ -1101,6 +1117,30 @@ window.__ModuleLoader__.load({
       "  color: #000000 !important;",
       "}",
       "",
+      "/* Inline-code chips: Blink paints an inline box's own background ABOVE the",
+      "   selection highlight, so the chip's 5% wash (tokens.css",
+      "   --dsh-claude-inline-code-bg) tints whatever the selection paints and a",
+      "   selected chip reads as a separate, lighter block. These paints are the",
+      "   channel-wise inverse of that overlay — dark composites 5% white over the",
+      "   paint, light 5% black — so after the wash blends over them the result lands",
+      "   back on the two selection colours above. The chip's 1px border is outside",
+      "   ::selection's reach and keeps its own colour. */",
+      "body[data-dsh-claude-style] code:not(pre code)::selection {",
+      "  background-color: rgb(40, 94, 206) !important;",
+      "}",
+      "",
+      "body[data-dsh-claude-style][data-dsh-window-blur] code:not(pre code)::selection {",
+      "  background-color: rgb(196, 196, 195) !important;",
+      "}",
+      "",
+      "body[data-dsh-claude-style]:not([data-ds-dark-theme]) code:not(pre code)::selection {",
+      "  background-color: rgb(54, 107, 219) !important;",
+      "}",
+      "",
+      "body[data-dsh-claude-style]:not([data-ds-dark-theme])[data-dsh-window-blur] code:not(pre code)::selection {",
+      "  background-color: rgb(209, 209, 208) !important;",
+      "}",
+      "",
       "body[data-dsh-claude-style] :is(button, input, textarea, select, [role=\"button\"], [role=\"tab\"], [role=\"treeitem\"]) {",
       "  outline: none;",
       "}",
@@ -1836,6 +1876,28 @@ window.__ModuleLoader__.load({
       "body[data-dsh-claude-style][data-dsh-claude-composer-active][data-ds-dark-theme] [class*=\"composerStack\"]:not([data-composer-variant=\"hero\"]) [data-composer-card] [data-input-scroll] {",
       "  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.15) !important;",
       "}",
+      "/* No workspace picked yet: the host marks the card as a workspace picker with a",
+      "   dashed ring over its whole box. In the single-line form the card is the input",
+      "   box plus the toolbar row on the canvas, so the ring moves onto the input box",
+      "   itself — the host's dashed stroke and colours, hover included — and the",
+      "   card's own ring is dropped. The input box stays flat, the way the host's",
+      "   picker card drops its elevation. */",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [data-composer-card][data-composer-variant=\"inline\"][class*=\"_cardWorkspaceTrigger\"]::after,",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [class*=\"composerStack\"]:not([data-composer-variant=\"hero\"]) [data-composer-card][class*=\"_cardWorkspaceTrigger\"]::after {",
+      "  display: none !important;",
+      "}",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [data-composer-card][data-composer-variant=\"inline\"][class*=\"_cardWorkspaceTrigger\"] [data-input-scroll],",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [class*=\"composerStack\"]:not([data-composer-variant=\"hero\"]) [data-composer-card][class*=\"_cardWorkspaceTrigger\"] [data-input-scroll] {",
+      "  border-style: dashed !important;",
+      "  border-color: var(--dsw-alias-border-l4) !important;",
+      "  box-shadow: none !important;",
+      "  cursor: pointer !important;",
+      "  transition: border-color 100ms ease !important;",
+      "}",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [data-composer-card][data-composer-variant=\"inline\"][class*=\"_cardWorkspaceTrigger\"]:hover [data-input-scroll],",
+      "body[data-dsh-claude-style][data-dsh-claude-composer-active] [class*=\"composerStack\"]:not([data-composer-variant=\"hero\"]) [data-composer-card][class*=\"_cardWorkspaceTrigger\"]:hover [data-input-scroll] {",
+      "  border-color: var(--dsw-alias-state-business-primary) !important;",
+      "}",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active]:not([data-ds-dark-theme]) [data-composer-card][data-composer-variant=\"inline\"]:focus-within [data-input-scroll],",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active]:not([data-ds-dark-theme]) [class*=\"composerStack\"]:not([data-composer-variant=\"hero\"]) [data-composer-card]:focus-within [data-input-scroll] {",
       "  border-color: rgba(20, 20, 19, 0.18) !important;",
@@ -3194,14 +3256,6 @@ window.__ModuleLoader__.load({
       "  box-shadow: 0 1px 2px rgba(20, 20, 19, 0.08);",
       "}",
       "",
-      "/* Rows whose preset the host's permission catalog does not carry (the Auto",
-      "   review tier without the auto-review integration) are taken out of the",
-      "   control entirely. */",
-      "body[data-dsh-claude-style] .dsh-claude-segment[data-hidden],",
-      "body[data-dsh-claude-style] .dsh-claude-perm-popover .dsh-claude-popover-item[data-hidden] {",
-      "  display: none !important;",
-      "}",
-      "",
       "/* ---------- Claude Code layout: in-conversation permission popover ---------- */",
       "body[data-dsh-claude-style] .dsh-claude-perm-container {",
       "  position: relative !important;",
@@ -3478,6 +3532,35 @@ window.__ModuleLoader__.load({
       "  display: none !important;",
       "}",
       "",
+      "/* The launcher's own skin, when the instance was started with one: the head is",
+      "   a canvas cropped out of the texture the host serves (src/overrides/account/",
+      "   rows.js), so it is the picture, not the mark, that fills the box. The mark is",
+      "   dropped only while that canvas is mounted — a skin whose bytes never arrived",
+      "   leaves the attribute off and the mark in place. The pixels are a Minecraft",
+      "   head's 8×8 face, so they are scaled without smoothing.",
+      "   The box is square, not the circle the photo path uses: the head is drawn to",
+      "   the box's edges (the hat layer covers it, the face is inset by 1/18), so any",
+      "   rounding at all shaves the head's own pixels — the circle cut the four",
+      "   corners off. The launcher's own account list shows the head square for the",
+      "   same reason. */",
+      "body[data-dsh-claude-style] .dsh-claude-account-avatar[data-dsh-claude-skin] {",
+      "  position: relative !important;",
+      "  background-image: none !important;",
+      "  border-radius: 0 !important;",
+      "}",
+      "body[data-dsh-claude-style] .dsh-claude-account-avatar[data-dsh-claude-skin]::before {",
+      "  display: none !important;",
+      "}",
+      "body[data-dsh-claude-style] .dsh-claude-account-skin {",
+      "  position: absolute !important;",
+      "  inset: 0 !important;",
+      "  width: 100% !important;",
+      "  height: 100% !important;",
+      "  border-radius: inherit !important;",
+      "  pointer-events: none !important;",
+      "  image-rendering: pixelated;",
+      "}",
+      "",
       "/* The drawer's rows had no hover feedback at all: the only",
       "   `.dsh-claude-popover-item:hover` rule in the stylesheet is scoped to the model",
       "   picker. Give the account drawer the same affordance as the rest of the skin. */",
@@ -5506,9 +5589,18 @@ window.__ModuleLoader__.load({
       "  margin-bottom: 30px;",
       "}",
       "",
-      "body[data-dsh-claude-style][data-dsh-claude-home-layout=\"studio\"] [class*=\"_composerHero\"] > [data-slot=\"conversation.input.dock\"] > * {",
+      "/* The skin's own seat on the cold start screen, where the host renders no dock",
+      "   (src/overrides/home-layout.js); like the host's anchor it generates no box. */",
+      "body[data-dsh-claude-style] .dsh-claude-home-seat {",
+      "  display: contents;",
+      "}",
+      "",
+      "body[data-dsh-claude-style][data-dsh-claude-home-layout=\"studio\"] [class*=\"_composerHero\"] > :is([data-slot=\"conversation.input.dock\"], .dsh-claude-home-seat) > * {",
       "  order: 1;",
-      "  flex: 0 0 auto;",
+      "  /* A window too short for the whole panel shrinks the panel instead of the",
+      "     page: the greeting stays on the top edge, the context row and the card on",
+      "     the bottom, and the panel scrolls inside the room between them. */",
+      "  flex: 0 1 auto;",
       "  min-height: 0;",
       "  /* The panel is the narrow dashboard card, left-aligned on the composer's own",
       "     left edge; the free width to its right stays empty. The width is stated",
@@ -5584,7 +5676,7 @@ window.__ModuleLoader__.load({
       "  display: none;",
       "}",
       "",
-      "body[data-dsh-claude-style][data-dsh-claude-home-layout=\"studio\"] [class*=\"_composerHero\"] > [data-slot=\"conversation.input.dock\"] > .dsh-claude-home-panel {",
+      "body[data-dsh-claude-style][data-dsh-claude-home-layout=\"studio\"] [class*=\"_composerHero\"] > :is([data-slot=\"conversation.input.dock\"], .dsh-claude-home-seat) > .dsh-claude-home-panel {",
       "  display: flex;",
       "}",
       "",
@@ -5601,6 +5693,27 @@ window.__ModuleLoader__.load({
       "     the label tone over the card tone, which flips with the theme on its own. */",
       "  background: color-mix(in srgb, var(--dsw-alias-label-primary, #141413) 4%, var(--dsw-alias-bg-layer-2, #fbfbf9));",
       "  overflow: auto;",
+      "  /* Claude Code fades its dashboard into the context row when the window cuts",
+      "     it short. The mask's transparent 32px foot hangs below the box at rest, so",
+      "     a panel that fits is untouched; while the panel scrolls, the scroll-linked",
+      "     animation pulls the foot up over the bottom edge, and lowers it again over",
+      "     the last 32px of travel, so the final row reads clean at the end. A panel",
+      "     that does not overflow has an inactive scroll timeline, and the resting",
+      "     value holds. */",
+      "  -webkit-mask-image: linear-gradient(to bottom, #000 calc(100% - 32px), transparent);",
+      "  mask-image: linear-gradient(to bottom, #000 calc(100% - 32px), transparent);",
+      "  -webkit-mask-repeat: no-repeat;",
+      "  mask-repeat: no-repeat;",
+      "  -webkit-mask-size: 100% calc(100% + 32px);",
+      "  mask-size: 100% calc(100% + 32px);",
+      "  animation: dsh-claude-home-panel-fade linear both;",
+      "  animation-timeline: scroll(self);",
+      "  animation-range: calc(100% - 32px) 100%;",
+      "}",
+      "",
+      "@keyframes dsh-claude-home-panel-fade {",
+      "  from { -webkit-mask-size: 100% 100%; mask-size: 100% 100%; }",
+      "  to { -webkit-mask-size: 100% calc(100% + 32px); mask-size: 100% calc(100% + 32px); }",
       "}",
       "",
       "body[data-dsh-claude-style] .dsh-claude-home-panel-head {",
@@ -8209,46 +8322,120 @@ window.__ModuleLoader__.load({
       var permLabel = null
       var permPopover = null
       var permHoverIntent = null
+      /** The pick path the rows call back into; the rows are rebuilt, the path is not. */
+      var permPick = null
 
       /**
-       * Whether the host's permission catalog carries the live Auto review
-       * preset (`auto`, registered by the auto-review plugin): true or false
-       * once a catalog read settled, null until then. While unknown the rows
-       * stay hidden, the way the shipped picker renders nothing before its
-       * first catalog read.
+       * The host's permission catalog: every preset this deployment offers, in
+       * the host's order, or null before the first read settles. It is the
+       * authority on what is switchable — a third-party plugin's preset rides
+       * in it — while PERMISSION_PRESETS decides how a known one reads.
        */
-      var autoPresetLive = null
+      var catalogOptions = null
+      /**
+       * The preset a new session starts in (the catalog's `defaultPreset`: the
+       * configured default, or the one the host infers). The cold start screen
+       * has no session to read a preset from, so its segments show this one.
+       * null until a catalog read settled.
+       */
+      var defaultPreset = null
+      /** Whether the last pass drew the segments on the cold start screen. */
+      var coldStartShown = false
       /** The first catalog failure; thrown on the next sync to retire the feature. */
       var autoPresetError = null
       var catalogFiber = null
       var catalogChangedDisposer = null
-
-      /** The Auto review rows are only offered while the host's catalog carries the preset. */
-      function rowVisible(preset) {
-        return preset !== AUTO_REVIEW_PRESET || autoPresetLive === true
+      /** What the popover and the segment group currently render, so a change rebuilds them. */
+      var renderedRows = ''
+      var renderedRowsFor = null
+      var renderedSegments = ''
+
+      /** The catalog's entry for one preset, or null. */
+      function catalogOption(preset) {
+        if (catalogOptions === null) return null
+        for (var i = 0; i < catalogOptions.length; i++) {
+          var option = catalogOptions[i]
+          if (option !== null && typeof option === 'object' && option.value === preset) return option
+        }
+        return null
       }
 
       /**
-       * Mirror the availability onto a row as data-hidden; the stylesheet turns
-       * that into display:none (an inline style would lose to the popover
-       * item's own `display: flex !important`).
+       * Whether the host offers a preset. Until the first read settles the
+       * shipped built-ins stand in, which is what the control drew before the
+       * catalog existed; a preset the catalog does not carry is not drawn at
+       * all, so a deployment that configures fewer presets gets fewer rows
+       * rather than dead ones.
        */
-      function syncRowVisibility(row, preset) {
-        if (rowVisible(preset)) {
-          if (row.hasAttribute('data-hidden')) row.removeAttribute('data-hidden')
-        } else if (!row.hasAttribute('data-hidden')) {
-          row.setAttribute('data-hidden', '')
+      function presetOffered(preset) {
+        if (catalogOptions === null) return PERMISSION_SHIPPED_PRESETS.indexOf(preset) !== -1
+        return catalogOption(preset) !== null
+      }
+
+      /** The name a preset reads as: the skin's table first, then the host's own name. */
+      function presetLabel(preset) {
+        var known = PERMISSION_PRESETS[preset]
+        if (known !== undefined) return known.label
+        var option = catalogOption(preset)
+        if (option !== null && typeof option.name === 'string' && option.name !== '') return option.name
+        var current = PERMISSION_CURRENT_LABELS[preset]
+        return current === undefined ? preset : current
+      }
+
+      /** The one line under that name, from the same two sources. */
+      function presetDesc(preset) {
+        var known = PERMISSION_PRESETS[preset]
+        if (known !== undefined) return known.desc
+        var option = catalogOption(preset)
+        return option !== null && typeof option.description === 'string' ? option.description : ''
+      }
+
+      /** Every preset the control offers, in the order its rows list them. */
+      function offeredPresets() {
+        var i
+        if (catalogOptions === null) return PERMISSION_SHIPPED_PRESETS.slice()
+        var offered = []
+        for (i = 0; i < catalogOptions.length; i++) {
+          var option = catalogOptions[i]
+          if (option === null || typeof option !== 'object') continue
+          if (typeof option.value !== 'string' || option.value === '') continue
+          if (offered.indexOf(option.value) === -1) offered.push(option.value)
+        }
+        // The skin's order for the presets it knows; anything else the host
+        // offers follows in the host's own order.
+        var ordered = []
+        for (i = 0; i < PERMISSION_ORDER.length; i++) {
+          if (offered.indexOf(PERMISSION_ORDER[i]) !== -1) ordered.push(PERMISSION_ORDER[i])
+        }
+        for (i = 0; i < offered.length; i++) {
+          if (ordered.indexOf(offered[i]) === -1) ordered.push(offered[i])
+        }
+        return ordered
+      }
+
+      /** The segments to draw: each slot bound to the first of its presets the host offers. */
+      function resolvedSegments() {
+        var out = []
+        for (var i = 0; i < PERMISSION_SEGMENTS.length; i++) {
+          var slot = PERMISSION_SEGMENTS[i]
+          for (var j = 0; j < slot.presets.length; j++) {
+            if (!presetOffered(slot.presets[j])) continue
+            out.push({ label: slot.label, preset: slot.presets[j] })
+            break
+          }
         }
+        return out
       }
 
       /**
-       * Read the host's permission catalog and record whether it carries the
-       * live Auto review preset. The shipped picker builds its rows from the
-       * same catalog, so it is the authority on what is switchable. A rejected
-       * read retries like the account profile's reads (the client connection
-       * may still be coming up at install); once the retries are exhausted the
-       * failure is remembered and thrown on the next sync, which retires this
-       * feature and hands the shipped access button back (D12).
+       * Read the host's permission catalog into `catalogOptions`, and which
+       * preset a new session starts in into `defaultPreset`. The shipped
+       * picker builds its rows from the same catalog, so it is the authority on
+       * what is switchable — including presets a third-party plugin registered.
+       * A rejected read retries like the account profile's reads (the client
+       * connection may still be coming up at install); once the retries are
+       * exhausted the failure is remembered and thrown on the next sync, which
+       * retires this feature and hands the shipped access button back (D12).
        */
       var AUTO_PRESET_RETRY_MS = [1000, 5000]
       var autoPresetRetries = 0
@@ -8280,22 +8467,17 @@ window.__ModuleLoader__.load({
           if (read !== autoPresetRead) return
           if (result === null || typeof result !== 'object' || result.ok !== true ||
               result.value === null || typeof result.value !== 'object' ||
-              !Array.isArray(result.value.options)) {
+              !Array.isArray(result.value.options) || typeof result.value.defaultPreset !== 'string') {
             autoPresetError = new Error('permission: unexpected permissionPresets catalog shape')
             ui.schedule()
             return
           }
           autoPresetRetries = 0
           autoPresetError = null
-          var live = false
-          for (var i = 0; i < result.value.options.length; i++) {
-            var option = result.value.options[i]
-            if (option !== null && typeof option === 'object' && option.value === AUTO_REVIEW_PRESET) {
-              live = true
-              break
-            }
-          }
-          autoPresetLive = live
+          // The whole option list is kept, not just whether one preset is in
+          // it: the rows and the segments are built from what the host serves.
+          catalogOptions = result.value.options.slice()
+          defaultPreset = result.value.defaultPreset
           ui.schedule()
         }, function () {
           if (read !== autoPresetRead) return
@@ -8338,14 +8520,19 @@ window.__ModuleLoader__.load({
         }
       }
 
-      function buildSegments(onPick) {
+      /**
+       * Build the segment group from the resolved slots. `specs` is what
+       * resolvedSegments() returned, so a slot the host cannot serve is simply
+       * absent instead of drawn dead.
+       */
+      function buildSegments(onPick, specs) {
         var group = document.createElement('div')
         group.className = SEGMENTS_CLASS
         group.setAttribute('role', 'radiogroup')
         group.setAttribute('aria-label', 'Permission')
         group.setAttribute('data-composer-segments', '')
-        for (var i = 0; i < PERMISSION_SEGMENTS.length; i++) {
-          var spec = PERMISSION_SEGMENTS[i]
+        for (var i = 0; i < specs.length; i++) {
+          var spec = specs[i]
           var item = document.createElement('button')
           item.type = 'button'
           item.className = SEGMENT_CLASS
@@ -8376,9 +8563,77 @@ window.__ModuleLoader__.load({
         permPopover.removeAttribute('data-open')
       }
 
+      /**
+       * One popover row for one preset: the name and the line under it from the
+       * skin's table (the host's own copy for a preset the table does not know),
+       * and the active check. No glyph: the tiers read as one list, and a
+       * preset's own `icon` — which the host ignores natively — is left out so
+       * the rows stay consistent with each other.
+       */
+      function buildPermRow(preset) {
+        var item = document.createElement('button')
+        item.type = 'button'
+        item.className = 'dsh-claude-popover-item'
+        item.setAttribute('role', 'menuitem')
+        item.setAttribute('data-preset', preset)
+
+        var col = document.createElement('div')
+        col.style.cssText = 'display:flex; flex-direction:column; gap:2px; flex:1; text-align:left; min-width:0;'
+
+        var itemTitle = document.createElement('span')
+        itemTitle.style.cssText = 'font-weight:500; font-size:13px; line-height:16px;'
+        itemTitle.textContent = presetLabel(preset)
+
+        var itemDesc = document.createElement('span')
+        itemDesc.style.cssText = 'font-size:11px; line-height:14px; color:var(--dsw-alias-label-tertiary);'
+        itemDesc.textContent = presetDesc(preset)
+
+        col.appendChild(itemTitle)
+        col.appendChild(itemDesc)
+        item.appendChild(col)
+
+        var check = document.createElement('span')
+        check.className = 'dsh-claude-perm-check'
+        check.style.cssText = 'font-size:12px; color:var(--dsw-alias-brand-primary, #d97757); margin-left:8px; display:none;'
+        check.textContent = '✓'
+        item.appendChild(check)
+
+        item.addEventListener('click', function (e) {
+          e.stopPropagation()
+          closePermMenu()
+          if (permPick !== null) permPick(preset)
+        })
+
+        return item
+      }
+
+      /**
+       * Rebuild the popover's rows when the set of offered presets changes.
+       * Rows come from the host's catalog, so a preset a plugin registers while
+       * the page stays open appears without a reload, and one it withdraws
+       * disappears; an unchanged set leaves the DOM alone (the pass runs on
+       * every mutation).
+       *
+       * The rendered signature is kept WITH the element it was rendered into: a
+       * new popover starts empty (the hero view takes the old one out of the
+       * tree), so a signature that merely matches the previous one must not
+       * skip filling this one.
+       */
+      function syncPermRows() {
+        if (permPopover === null) return
+        var wanted = offeredPresets()
+        var signature = wanted.join('|')
+        if (signature === renderedRows && renderedRowsFor === permPopover) return
+        renderedRows = signature
+        renderedRowsFor = permPopover
+        while (permPopover.firstChild !== null) permPopover.removeChild(permPopover.firstChild)
+        for (var i = 0; i < wanted.length; i++) permPopover.appendChild(buildPermRow(wanted[i]))
+      }
+
       registerPopover('permission', closePermMenu)
 
       function buildPermTriggerAndPopover(onPick) {
+        permPick = onPick
         var container = document.createElement('div')
         container.className = 'dsh-claude-perm-container'
 
@@ -8403,46 +8658,6 @@ window.__ModuleLoader__.load({
         popover.className = 'dsh-claude-perm-popover'
         popover.setAttribute('role', 'menu')
 
-        for (var i = 0; i < PERMISSION_OPTIONS.length; i++) {
-          var opt = PERMISSION_OPTIONS[i]
-          var item = document.createElement('button')
-          item.type = 'button'
-          item.className = 'dsh-claude-popover-item'
-          item.setAttribute('role', 'menuitem')
-          item.setAttribute('data-preset', opt.preset)
-
-          var col = document.createElement('div')
-          col.style.cssText = 'display:flex; flex-direction:column; gap:2px; flex:1; text-align:left; min-width:0;'
-
-          var itemTitle = document.createElement('span')
-          itemTitle.style.cssText = 'font-weight:500; font-size:13px; line-height:16px;'
-          itemTitle.textContent = opt.label
-
-          var itemDesc = document.createElement('span')
-          itemDesc.style.cssText = 'font-size:11px; line-height:14px; color:var(--dsw-alias-label-tertiary);'
-          itemDesc.textContent = opt.desc
-
-          col.appendChild(itemTitle)
-          col.appendChild(itemDesc)
-          item.appendChild(col)
-
-          var check = document.createElement('span')
-          check.className = 'dsh-claude-perm-check'
-          check.style.cssText = 'font-size:12px; color:var(--dsw-alias-brand-primary, #d97757); margin-left:8px; display:none;'
-          check.textContent = '✓'
-          item.appendChild(check)
-
-          item.addEventListener('click', (function (preset) {
-            return function (e) {
-              e.stopPropagation()
-              closePermMenu()
-              onPick(preset)
-            }
-          })(opt.preset))
-
-          popover.appendChild(item)
-        }
-
         function openPerm() {
           if (permHoverIntent) permHoverIntent.cancel()
           closeOtherPopovers('permission')
@@ -8513,15 +8728,13 @@ window.__ModuleLoader__.load({
 
       function updatePermState(preset) {
         if (!permLabel || !permPopover) return
-        // A preset our option list does not carry (the host's `custom`, or a
-        // row this host's catalog does not offer) shows its machine value.
-        var matchedLabel = preset === null ? 'Accept edits' : preset
-        for (var i = 0; i < PERMISSION_OPTIONS.length; i++) {
-          if (PERMISSION_OPTIONS[i].preset === preset) {
-            matchedLabel = PERMISSION_OPTIONS[i].label
-            break
-          }
-        }
+        // The rows follow the host's catalog: one it does not serve is not
+        // drawn at all, and one it starts serving appears.
+        syncPermRows()
+        // The running preset reads as its Claude-flavored name; a value no
+        // preset carries (the host's `custom`) reads as the host's own word for
+        // it rather than as the machine value.
+        var matchedLabel = preset === null ? 'Accept edits' : presetLabel(preset)
         // Same-value guard: this runs on every pass, and an identical
         // textContent write still replaces the text node — a mutation that
         // schedules the next pass, so the page never went idle.
@@ -8530,8 +8743,7 @@ window.__ModuleLoader__.load({
         var items = permPopover.querySelectorAll('[data-preset]')
         for (var j = 0; j < items.length; j++) {
           var it = items[j]
-          var rowPreset = it.getAttribute('data-preset')
-          var isCurrent = rowPreset === preset
+          var isCurrent = it.getAttribute('data-preset') === preset
           var check = it.querySelector('.dsh-claude-perm-check')
           if (check) {
             check.style.display = isCurrent ? 'inline' : 'none'
@@ -8541,7 +8753,6 @@ window.__ModuleLoader__.load({
           } else {
             it.removeAttribute('data-active')
           }
-          syncRowVisibility(it, rowPreset)
         }
       }
 
@@ -8618,16 +8829,29 @@ window.__ModuleLoader__.load({
             existingSegments[es0].remove()
           }
           segments = null
+          coldStartShown = false
           return
         }
 
+        var session = currentSession(ctx)
         var trigger = findAccessTrigger()
-        if (trigger === null) return
-        var host = trigger.parentElement
+        // The cold start screen (no session yet) renders no access button: the
+        // host leaves the card's mode strip empty and turns the whole card into
+        // the workspace pick target. The segments take that strip and show the
+        // preset the new session will start in; they are disabled there, so a
+        // press falls through to the card and opens the workspace picker like
+        // every other control on it.
+        var coldStart = trigger === null && isHero && session === null
+        var host = coldStart
+          ? document.querySelector('[data-composer-card][class*="_cardWorkspaceTrigger"] [class*="_modes"]')
+          : trigger === null ? null : trigger.parentElement
+        // The default can change in Settings without a catalog event, so each
+        // return to the cold start screen reads it again.
+        if (coldStart && !coldStartShown && catalogOptions !== null) probeAutoPreset()
+        coldStartShown = coldStart
         if (host === null) return
 
-        var session = currentSession(ctx)
-        var preset = session === null ? null : currentPreset(session)
+        var preset = coldStart ? defaultPreset : session === null ? null : currentPreset(session)
 
         if (isHero) {
           for (var i = 0; i < existingPermContainers.length; i++) {
@@ -8641,19 +8865,26 @@ window.__ModuleLoader__.load({
           permLabel = null
           permPopover = null
 
+          // The slots follow the host's catalog: the deployment's own auto tier
+          // takes the Auto slot when it is offered, and a slot with no offered
+          // preset is not drawn. Rebuild when the binding changed; the shipped
+          // group is reused otherwise, so a pass leaves the DOM alone.
+          var segmentSpecs = resolvedSegments()
+          var segmentSignature = segmentSpecs.map(function (spec) { return spec.label + '=' + spec.preset }).join('|')
           if (existingSegments.length > 1) {
             for (var s = 1; s < existingSegments.length; s++) existingSegments[s].remove()
           }
-          if (existingSegments.length === 1 && host.contains(existingSegments[0])) {
+          if (segmentSignature === renderedSegments && existingSegments.length === 1 && host.contains(existingSegments[0])) {
             segments = existingSegments[0]
           } else {
+            renderedSegments = segmentSignature
             for (var s2 = 0; s2 < existingSegments.length; s2++) existingSegments[s2].remove()
-            segments = buildSegments(pick)
+            segments = buildSegments(pick, segmentSpecs)
             host.insertBefore(segments, host.firstChild)
           }
           for (var j = 0; j < segments.children.length; j++) {
             var item = segments.children[j]
-            syncRowVisibility(item, item.getAttribute('data-preset'))
+            if (item.disabled !== coldStart) item.disabled = coldStart
             if (item.getAttribute('data-preset') === preset) {
               item.setAttribute('data-active', '')
               item.setAttribute('aria-checked', 'true')
@@ -11821,8 +12052,8 @@ window.__ModuleLoader__.load({
       /**
        * The profile picture's address, or null when there is none usable. It
        * comes from the account service or from the plugin's own HDSL route, so
-       * only http(s) and that route are accepted, and it is handed to an `<img>`
-       * as a property — never written into markup.
+       * only http(s) and that route are accepted, and it is set as a property —
+       * never written into markup.
        */
       function accountPhotoUrl(raw) {
         if (raw === HDSL_SKIN_ROUTE) return raw
@@ -11835,11 +12066,110 @@ window.__ModuleLoader__.load({
         }
       }
 
+      /** The head's canvas, and what a pass needs to decide whether to keep it. */
+      var headCanvas = null
+      /** A load has been started; the route is read once per page, so is a failure. */
+      var headRequested = false
+      var headFailed = false
+
+      /**
+       * Draw the head out of a launcher skin, the way the launcher's own
+       * account list draws it: the front face of the head texel block, inset by
+       * 1/18 of the box, then the hat layer over the whole box. The atlas may
+       * be stored at any integer multiple of 64 (the launcher normalizes to
+       * 64×64 and keeps an already-larger import at its size), so every texel
+       * block is measured by that multiple.
+       *
+       * @returns whether a head was drawn.
+       */
+      function drawLauncherHead(canvas, image) {
+        var box = canvas.width
+        var scale = image.naturalWidth / 64
+        var context = canvas.getContext('2d')
+        if (context === null || scale < 1 || scale !== Math.floor(scale)) return false
+        var offset = Math.round(box / 18)
+        context.clearRect(0, 0, box, box)
+        // The face is a 8×8 texel block drawn inside the inset; the pixels are
+        // already at the right size, so smoothing would only blur them.
+        context.imageSmoothingEnabled = false
+        context.drawImage(image, 8 * scale, 8 * scale, 8 * scale, 8 * scale, offset, offset, box - 2 * offset, box - 2 * offset)
+        context.drawImage(image, 40 * scale, 8 * scale, 8 * scale, 8 * scale, 0, 0, box, box)
+        return true
+      }
+
+      /**
+       * Load the launcher's atlas once. The canvas is built off-screen: the
+       * avatar element a pass hands in may be a different one by the time the
+       * picture lands, and a failure only means the mark keeps the circle.
+       */
+      function loadLauncherHead() {
+        headRequested = true
+        var image = new Image()
+        image.decoding = 'async'
+        image.addEventListener('load', function () {
+          if (image.naturalWidth !== image.naturalHeight || image.naturalWidth < 64) {
+            headFailed = true
+            wake()
+            return
+          }
+          if (headCanvas === null) {
+            headCanvas = document.createElement('canvas')
+            headCanvas.className = 'dsh-claude-account-skin'
+            headCanvas.width = 64
+            headCanvas.height = 64
+            headCanvas.setAttribute('aria-hidden', 'true')
+          }
+          if (!drawLauncherHead(headCanvas, image)) headFailed = true
+          wake()
+        })
+        image.addEventListener('error', function () {
+          headFailed = true
+          wake()
+        })
+        image.src = HDSL_SKIN_ROUTE
+      }
+
+      /** Ask for the pass that mounts the head (the picture changes no DOM). */
+      function wake() {
+        if (typeof options.onChange === 'function') options.onChange()
+      }
+
+      /** Drop the account profile's photo, if one is mounted. */
+      function clearAccountPhoto(avatarEl) {
+        var photo = avatarEl.querySelector('.dsh-claude-account-photo')
+        if (photo === null) return
+        avatarEl.removeChild(photo)
+        if (avatarEl.hasAttribute('data-dsh-claude-photo')) avatarEl.removeAttribute('data-dsh-claude-photo')
+      }
+
+      /** Take the head's canvas back out of a circle the photo path owns again. */
+      function detachLauncherHead(avatarEl) {
+        if (headCanvas !== null && headCanvas.parentElement === avatarEl) avatarEl.removeChild(headCanvas)
+        if (avatarEl.hasAttribute('data-dsh-claude-skin')) avatarEl.removeAttribute('data-dsh-claude-skin')
+      }
+
+      /**
+       * Paint the player's own head. What the launcher serves is the normalized
+       * skin atlas — a sheet of body parts, not a face — so it is cropped into
+       * a canvas and never handed to the `<img>` the photo path uses. Until the
+       * head is drawn, and when it cannot be, the mark keeps the circle.
+       */
+      function syncLauncherHead(avatarEl) {
+        if (!headRequested) loadLauncherHead()
+        if (headCanvas === null || headFailed) return
+        if (headCanvas.parentElement !== avatarEl) {
+          if (headCanvas.parentElement !== null) headCanvas.parentElement.removeChild(headCanvas)
+          avatarEl.appendChild(headCanvas)
+        }
+        if (!avatarEl.hasAttribute('data-dsh-claude-skin')) avatarEl.setAttribute('data-dsh-claude-skin', '')
+      }
+
       /**
        * Paint (or clear) the picture inside the avatar circle. The address comes
        * from the identity chain (src/context/host.js): the account's own avatar,
-       * then the HDSL launcher's, then nothing — and the brand mark the
-       * stylesheet draws shows through. It is a real `<img>` layered over that
+       * then the HDSL launcher's (drawn as a cropped head), then nothing — and
+       * the brand mark the stylesheet draws shows through. The account's avatar
+       * is a real `<img>` layered over that
        * mark rather than a CSS background: the host's own avatar `<img>` carries
        * `referrerPolicy="no-referrer"`, which is what the picture host expects,
        * and a background cannot drop the referrer. A picture that fails to load
@@ -11848,10 +12178,16 @@ window.__ModuleLoader__.load({
       function syncAccountAvatar(avatarEl) {
         if (avatarEl === null) return
         var src = accountPhotoUrl(resolveAvatarUrl())
+        if (src === HDSL_SKIN_ROUTE) {
+          // The launcher's picture only ever shows as the cropped head.
+          clearAccountPhoto(avatarEl)
+          syncLauncherHead(avatarEl)
+          return
+        }
+        detachLauncherHead(avatarEl)
         var photo = avatarEl.querySelector('.dsh-claude-account-photo')
         if (src === null) {
-          if (photo !== null) avatarEl.removeChild(photo)
-          if (avatarEl.hasAttribute('data-dsh-claude-photo')) avatarEl.removeAttribute('data-dsh-claude-photo')
+          clearAccountPhoto(avatarEl)
           return
         }
         if (photo === null) {
@@ -12698,6 +13034,11 @@ window.__ModuleLoader__.load({
       var hostMenu = createHostAccountMenu({ close: closePopover })
       var rows = createAccountRows({
         hostMenu: hostMenu,
+        // Drawing the launcher's head is asynchronous and changes no DOM the
+        // observer can see, so the picture asks for the pass that paints it.
+        onChange: function () {
+          if (typeof ui.schedule === 'function') ui.schedule()
+        },
         openBan: function () {
           // Leave the surface up: the overlay is a full-window surface, so what
           // is behind it does not matter, and the footer is left as the user
@@ -15043,7 +15384,10 @@ window.__ModuleLoader__.load({
      * the hero region that accepts a new entry (the brand mark, workspace and
      * preset seats are `single` and occupied), and it is scoped to a session, so
      * on the cold start screen — no session object yet — the host does not render
-     * it at all and the studio layout simply shows the greeting and the composer.
+     * it at all. There the skin mounts the same panel itself: a React root on a
+     * `display: contents` element of its own at the end of the hero stack, which
+     * the stylesheet sorts into the dock's place. It goes away as soon as the
+     * host renders the dock.
      *
      * This fragment is the shell: the seat registration, the head (the
      * Overview/Models tabs and the All/30d/7d range pills), the tab switch and
@@ -15069,6 +15413,9 @@ window.__ModuleLoader__.load({
        */
       var bookPick = Math.random()
       var slotsFiber = null
+      var ReactDOM = require('react-dom/client')
+      /** The cold start screen's panel: `{ stack, element, root }`, or null. */
+      var coldSeat = null
 
       var usage = createHomeUsage(ctx)
       var overview = createHomeOverview()
@@ -15219,11 +15566,44 @@ window.__ModuleLoader__.load({
         })
       }
 
+      function unmountColdSeat() {
+        if (coldSeat === null) return
+        coldSeat.root.unmount()
+        if (coldSeat.element.parentElement !== null) coldSeat.element.parentElement.removeChild(coldSeat.element)
+        coldSeat = null
+      }
+
+      /**
+       * Mount the panel on the cold start screen, and drop it once the host's
+       * dock is there to carry it (or the page leaves the studio hero). The
+       * element is appended to the host's stack and never moves a host node;
+       * a re-render that replaces the stack leaves the old copy behind, so it
+       * is re-mounted on the new stack.
+       */
+      function syncColdSeat() {
+        var stack = document.body.hasAttribute(HOME_HERO_ATTR)
+          ? document.querySelector('[class*="_composerStack"][class*="_composerHero"]')
+          : null
+        if (stack === null || stack.querySelector(':scope > [data-slot="' + DOCK_SLOT + '"]') !== null) {
+          unmountColdSeat()
+          return
+        }
+        if (coldSeat !== null && coldSeat.stack === stack && coldSeat.element.parentElement === stack) return
+        unmountColdSeat()
+        var element = document.createElement('div')
+        element.className = 'dsh-claude-home-seat'
+        stack.appendChild(element)
+        var root = ReactDOM.createRoot(element)
+        root.render(React.createElement(HomeUsagePanel))
+        coldSeat = { stack: stack, element: element, root: root }
+      }
+
       /** Each pass reads the preference and the phase; only a change re-renders. */
       function sync() {
         var next = readPrefs().homeLayout
         if (next !== layout) {
           setLayout(next)
+          syncColdSeat()
           return
         }
         // The hero/active phase flips without any preference change (opening a
@@ -15237,6 +15617,7 @@ window.__ModuleLoader__.load({
           if (hero) bookPick = Math.random()
           usage.notify()
         }
+        syncColdSeat()
         if (next === HOME_LAYOUT_STUDIO) {
           usage.load(false)
           usage.loadList()
@@ -15249,6 +15630,7 @@ window.__ModuleLoader__.load({
       setLayout(readPrefs().homeLayout)
 
       return function () {
+        unmountColdSeat()
         usage.stop()
         document.body.removeAttribute(HOME_LAYOUT_ATTR)
         document.body.removeAttribute(HOME_HERO_ATTR)

package/lib/index.js

@@ -31,7 +31,7 @@
 import { readFileSync, readdirSync, rmSync, statSync } from 'node:fs'
 import { homedir, userInfo } from 'node:os'
 import { dirname, join, resolve, sep } from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
+import { fileURLToPath } from 'node:url'
 import { createUsage } from './usage.js'
 
 export const name = 'dsh-claude-style'
@@ -71,6 +71,12 @@ const HDSL_PATH = `${ROUTE_PREFIX}/hdsl`
 const HDSL_SKIN_PATH = `${ROUTE_PREFIX}/hdsl-skin.png`
 /** The contract version this half understands; any other value voids the whole group. */
 const HDSL_CONTRACT = '1'
+/**
+ * The context slot the harness's boot fills with this launch's environment
+ * snapshot (`@deepseek-ai/dsh-launch-environment` defines the same key, and its
+ * `launchEnvironmentOf(ctx)` reads exactly this slot before falling back).
+ */
+const DSH_LAUNCH_ENVIRONMENT_KEY = 'launchEnvironment'
 /**
  * The layers allowed to declare who the player is, in the launcher's own trust
  * order. A project directory's `.env` travels with a cloned repository, so it
@@ -265,33 +271,6 @@ function buildPrefsSchema(Schema) {
   })
 }
 
-/**
- * The `launchEnvironmentOf` function of the harness's own launch-environment
- * library, or null when it cannot be resolved.
- *
- * Same reason as {@link resolveSchemaFactory}: a plugin installed by link
- * resolves its realpath outside the profile tree, so a plain import of a
- * harness-provided library fails outright. The library is ESM, so the anchor
- * resolves the real file and this half imports that path.
- *
- * @returns the accessor, or null.
- */
-async function resolveLaunchEnvironmentOf() {
-  try {
-    const { createRequire } = await import('node:module')
-    const anchor = typeof process.argv[1] === 'string' && process.argv[1] !== '' ? process.argv[1] : process.execPath
-    const resolved = createRequire(anchor).resolve('@deepseek-ai/dsh-launch-environment')
-    const module = await import(pathToFileURL(resolved).href)
-    if (typeof module?.launchEnvironmentOf === 'function') return module.launchEnvironmentOf
-  } catch { /* the anchor carries no launch environment: try normal resolution */ }
-  try {
-    const module = await import('@deepseek-ai/dsh-launch-environment')
-    return typeof module?.launchEnvironmentOf === 'function' ? module.launchEnvironmentOf : null
-  } catch {
-    return null
-  }
-}
-
 /**
  * The HDSL account contract of this launch, read once.
  *
@@ -299,6 +278,13 @@ async function resolveLaunchEnvironmentOf() {
  * every request re-serves it. `skinFile` is the player's avatar path: it stays
  * inside this half and is never serialized to the browser.
  *
+ * The snapshot is read through the slot the harness itself fills
+ * (`ctx.launchEnvironment` — the first thing `launchEnvironmentOf()` reads),
+ * rather than by importing `@deepseek-ai/dsh-launch-environment`: importing a
+ * harness-provided package fails outright for a `link:`-installed plugin (the
+ * same resolution problem `resolveSchemaFactory` documents), and a host that
+ * fills no slot simply has no contract to read.
+ *
  * @param ctx - host plugin context.
  * @returns `{ read() }`, whose promise resolves to the contract or to
  *          `{ contract: false }` when HDSL did not launch this instance.
@@ -307,14 +293,14 @@ function createHdslAccount(ctx) {
   let reading = null
   const read = () => {
     if (reading !== null) return reading
-    reading = resolveLaunchEnvironmentOf().then((launchEnvironmentOf) => {
-      if (launchEnvironmentOf === null) return { contract: false }
-      let env
+    reading = Promise.resolve().then(() => {
+      let env = null
       try {
-        env = launchEnvironmentOf(ctx)
+        env = ctx.get(DSH_LAUNCH_ENVIRONMENT_KEY)
       } catch {
-        return { contract: false }
+        env = null
       }
+      if (env === null || env === undefined || typeof env.getFrom !== 'function') return { contract: false }
       const value = (name) => {
         try {
           return env.getFrom(name, HDSL_LAYERS)?.value

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-claude-style",
   "description": "Claude Code Desktop theme for DeepSeek Harness (dsh) web GUI — visual & interaction overhaul",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "lib/index.js",
   "icon": "lib/claude-mark.svg",