dsh-code 0.7.0 → 0.9.0

package/lib/types/app.d.ts

@@ -17,13 +17,17 @@ import { type ReactElement } from 'react';
 import type { CommandDescriptor } from '@deepseek-ai/dsh-commands';
 import { type ThemeName } from './theme.ts';
 import type { TranscriptStore } from './store.ts';
+import { type TranscriptEntry } from './render/projection.ts';
 import type { ApprovalStore } from './approval.ts';
 import type { CommandsView } from './commands.ts';
 import type { ModelDirectory, ModelRow } from './models.ts';
+import type { ProviderSettingsDirectory, ProviderTargetView } from './provider-settings.ts';
 import type { QuestionStore } from './questions.ts';
 import type { SkillsView, SkillRow } from './skills.ts';
 import type { MentionCandidate } from './mentions.ts';
+import type { SubagentFeedView } from './subagents.ts';
 import type { PresetRow } from './presets.ts';
+import type { PermissionRow } from './permissions.ts';
 import type { PluginRow } from './plugin-inventory.ts';
 import type { SessionDirectoryOptions, SessionRow } from './session-directory.ts';
 /** Visual priority for one bounded local notice. */
@@ -36,6 +40,8 @@ export interface AppProps {
     approval: ApprovalStore;
     /** ask_user_question store fed by the single UI provider. */
     questions: QuestionStore;
+    /** Live subagent activity feed (child sessions of the current root). */
+    subagents: SubagentFeedView;
     /** Live slash-command descriptor list (completion candidates). */
     commands: CommandsView;
     /** Live user-invocable skill catalog (completion candidates). */
@@ -54,8 +60,10 @@ export interface AppProps {
     sessionId: string;
     /** Whether this session was resumed from persistence. */
     resumed: boolean;
-    /** Agent preset currently composing the session. */
+    /** Agent preset selected for the current or pending first session. */
     mode: string;
+    /** Permission preset selected for the current or pending first session. */
+    permission: string;
     /** Submit one line: slash commands to the registry, other text to the agent. */
     dispatch(text: string): void;
     /** Submit steering: consumed at the running turn's next step boundary. */
@@ -70,8 +78,28 @@ export interface AppProps {
     loadMentions(query: string, signal?: AbortSignal): Promise<readonly MentionCandidate[]>;
     /** Apply one /model selection (with an advertised reasoning effort, when picked); returns the display label. */
     selectModel(row: ModelRow, effortId?: string): string;
+    /** The /subagent override label, '' when delegated agents follow the current model. */
+    subagentModel: string;
+    /** Apply one /subagent model pick; returns the override label. */
+    setSubagentModel(row: ModelRow, effortId?: string): string;
+    /** Drop the /subagent override (delegated agents follow the current model). */
+    clearSubagentModel(): void;
+    /** Delete one session subtree; resolves with the outcome line. */
+    deleteSession(id: string): Promise<string>;
+    /** Load provider/settings/credential facts for the optional /model provider stage. */
+    loadModelProviders?(): Promise<ProviderSettingsDirectory>;
+    /** Subscribe to Harness credential/settings/adapter invalidations while /model is open. */
+    subscribeModelProviders?(listener: () => void): () => void;
+    /** Store or rotate one provider credential through the Harness credential service. */
+    saveModelProviderCredential?(target: ProviderTargetView, key: string): Promise<void>;
+    /** Remove one writable provider credential without removing its settings profile. */
+    unsetModelProviderCredential?(target: ProviderTargetView): Promise<void>;
+    /** Remove one user-owned provider profile and its page-managed credential. */
+    removeModelProvider?(target: ProviderTargetView): Promise<void>;
     /** Cycle to the next permission preset (Shift+Tab); returns the new label. */
     cyclePermission(): string;
+    /** Select or inspect a permission preset without requiring a pre-existing session. */
+    setPermission(id: string): string;
     /** Export the transcript to a markdown file (/export [path]); reports via notices. */
     exportTranscript(argument: string): Promise<void>;
     /** Rename the session (/title <text>); returns the outcome line for the notice. */
@@ -79,9 +107,13 @@ export interface AppProps {
     /** Preset/session/plugin kernel operations. */
     loadPresets(): Promise<readonly PresetRow[]>;
     switchMode(id: string): Promise<string>;
+    /** Load the switchable permission presets for the /permission panel. */
+    loadPermissions(): Promise<readonly PermissionRow[]>;
     createSession(mode?: string): void;
     loadSessions(options: SessionDirectoryOptions, signal?: AbortSignal): Promise<readonly SessionRow[]>;
     loadSessionTranscript(id: string, signal?: AbortSignal): Promise<string>;
+    /** Load this session's subagent conversations (children by lineage). */
+    loadSubagents(): Promise<readonly SessionRow[]>;
     switchSession(row: SessionRow): void;
     cancelSessionSwitch(): boolean;
     loadPlugins(): readonly PluginRow[];
@@ -123,6 +155,63 @@ interface CompletionCandidate {
  * selection window bounds the visible rows, so no slice cap is needed.
  */
 export declare function completionCandidates(value: string, descriptors: readonly CommandDescriptor[], skills: readonly SkillRow[]): readonly CompletionCandidate[];
+/** One cached settled row: the row Box plus its roomy-prompt spacers. */
+interface SettledRowRecord {
+    /** The row Box element (keyed by the entry's settled index). */
+    box: ReactElement;
+    /** The roomy-prompt spacer BEFORE the row, or undefined. */
+    before: ReactElement | undefined;
+    /** The roomy-prompt spacer AFTER the row, or undefined. */
+    after: ReactElement | undefined;
+    /** Whether the row's text depends on the reasoning toggle (Ctrl+R). */
+    reasonSensitive: boolean;
+    /** The toggle state the row was built with. */
+    showReasoning: boolean;
+}
+/** The incremental settled-history cache (see `computeSettledRows`). */
+interface SettledRowsCache {
+    /** The exact settled entries the cache covers (`view.entries[0..entries.length)`). */
+    entries: TranscriptEntry[];
+    /** Records keyed by entry identity; mutated in place so the append path
+     * never copies the whole map. */
+    records: Map<TranscriptEntry, SettledRowRecord>;
+    /** The header element (depends only on `resumed`). */
+    header: ReactElement;
+    /** The `resumed` the header was built with. */
+    resumed: boolean;
+    /** The toggle state the rows were built with. */
+    showReasoning: boolean;
+    /** The refreshEpoch the rows were built for; a bump forces a full rebuild. */
+    epoch: number;
+    /** The flat row list (header + per-entry before/box/after). */
+    flat: ReactElement[];
+}
+/** One step of `computeSettledRows`. */
+interface SettledRowsResult {
+    cache: SettledRowsCache;
+    /** How many rows had to be BUILT by this step (0 = pure reuse). */
+    built: number;
+}
+/**
+ * The settled `<Static>` row set as a PURE incremental state machine (App
+ * drives it from the memo; tests drive it directly and read `built`).
+ *
+ * The settled prefix is permanently final: the projection only APPENDS below
+ * the flush boundary, removes pending rows at or beyond it, and replaces
+ * running tool/retry/command rows there too. So extending the cache never
+ * rescans the old prefix — a grown boundary builds ONLY the newly settled
+ * suffix and reuses every cached element, letting React bail out of unchanged
+ * rows and keeping long histories out of the per-durable-event path (no O(N)
+ * rebuild of rows, Map, or MarkdownBody parses). `records` is mutated in place
+ * on the append/toggle paths to stay O(delta).
+ *
+ * Full rebuilds run only on the rare, deliberate paths: no cache yet, a
+ * source-backed replay (`epoch` bump: resize / Ctrl+L / Ctrl+R remounts
+ * `<Static>` and must re-flush the CURRENT rows), a `resumed` change, or a shrink
+ * (`store.reset`). A reasoning toggle rebuilds only the rows whose text
+ * depends on it, preserving the other rows' element identity.
+ */
+export declare function computeSettledRows(previous: SettledRowsCache | undefined, entries: readonly TranscriptEntry[], settled: number, showReasoning: boolean, resumed: boolean, epoch: number): SettledRowsResult;
 /** The whole terminal app; state arrives via the store, output via Ink. */
 export declare function App(props: AppProps): ReactElement;
 export {};

package/lib/types/approval.d.ts

@@ -29,10 +29,12 @@ export interface PendingApproval {
 }
 /** The pending-question snapshot the renderer subscribes to. */
 export interface ApprovalSnapshot {
-    /** The pending question, or undefined when none is being asked. */
+    /** The question on screen (queue head), or undefined when none is asked. */
     pending: PendingApproval | undefined;
     /** Presentational: an answer was submitted, the ask has not settled yet. */
     answered: boolean;
+    /** Further asks waiting behind the on-screen one (FIFO, Codex-style). */
+    queued: number;
 }
 /** Store the pending question lands in; the renderer reads, the answerer writes. */
 export interface ApprovalStore {

package/lib/types/history.d.ts

@@ -7,8 +7,8 @@
  *
  * @module @deepseek-ai/dsh-tui/history
  */
-/** Maximum entries retained in the persistent history file. */
-export declare const HISTORY_MAX_ENTRIES = 500;
+/** Maximum entries retained in the persistent history file and the local recall pool. */
+export declare const HISTORY_MAX_ENTRIES = 100;
 /** Encode one entry for the history file (JSON keeps multi-line drafts intact). */
 export declare function serializeHistoryEntry(text: string): string;
 /**
@@ -31,12 +31,23 @@ export declare function parseHistoryFile(raw: string, max?: number): readonly st
 export declare function appendHistoryContent(current: string, text: string, max?: number): string;
 /**
  * Record one in-session submission: empty text is ignored and an adjacent
- * duplicate collapses (Codex `record_local_submission` semantics).
+ * duplicate collapses (Codex `record_local_submission` semantics). The local
+ * pool shares the persistent pool's cap so the recall space stays bounded.
  * @param local - current in-session entries, oldest first.
  * @param text - the submitted prompt.
+ * @param max - the local pool cap.
  * @returns the updated local list.
  */
-export declare function recordLocalEntry(local: readonly string[], text: string): readonly string[];
+export declare function recordLocalEntry(local: readonly string[], text: string, max?: number): readonly string[];
+/**
+ * Serialize a capped entry list to the history file format (one JSON line per
+ * entry, trailing newline). The runner writes the in-memory list as the whole
+ * file, so rapid same-process submissions cannot lose entries to a
+ * read-modify-write race (the file is never read back before writing).
+ * @param entries - the entries to persist, oldest first.
+ * @returns the file content, '' for an empty list.
+ */
+export declare function serializeHistoryList(entries: readonly string[]): string;
 /**
  * Build the recall space, newest first: local entries, then persistent
  * entries whose text is not duplicated locally (the local copy wins and the

package/lib/types/index.d.ts

@@ -10,6 +10,8 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence';
+import type { TuiStartup } from './startup.ts';
 /** Stable Cordis plugin name. */
 export declare const name = "tui-runner";
 /** Core services required before the interactive session can start. */
@@ -25,9 +27,55 @@ export interface Config {
     };
 }
 export declare const Config: z<Config>;
+/** The session identity this invocation will run, plus whether it is resumed. */
+interface Target {
+    sessionId: string;
+    resume: boolean;
+    mode?: string;
+    cwd?: string;
+}
+/**
+ * Reduce a session id to a filename-safe /export default-name suffix. Session
+ * ids are normally minted `session-<uuid>`, but `--session` accepts arbitrary
+ * user text: path separators must never leak into the default export filename
+ * (which would escape the session cwd).
+ * @param id - the session id.
+ * @returns at most the last 8 filename-safe characters.
+ */
+export declare function exportSessionIdSuffix(id: string): string;
+/** One ordered step of the terminal quit cleanup. */
+export interface QuitCleanupStep {
+    /** Step label used in diagnostics and tests. */
+    readonly name: string;
+    /** The step's async work; a rejection is contained by the sequence. */
+    readonly run: () => Promise<void>;
+}
+/**
+ * Run the ordered quit cleanup, then request exit. Every step rejection is
+ * contained (reported through `onError`) so a failed flush or dispose never
+ * skips the remaining cleanup; the exit request is always reached exactly
+ * once.
+ * @param steps - the cleanup steps in dependency order (settle the visible
+ * session, await the final in-flight composition, await durable recall).
+ * @param exit - the terminal exit request (code 0).
+ * @param onError - optional failure sink; called once per failing step and
+ * itself contained, so a throwing sink cannot abort the sequence.
+ * @returns the names of the steps that started, in order (for tests).
+ */
+export declare function runQuitSequence(steps: readonly QuitCleanupStep[], exit: (code: number) => void, onError?: (name: string, error: unknown) => void): Promise<readonly string[]>;
+/**
+ * Resolve the invocation's target session against the persisted headers.
+ * @param startup - the parsed startup flags.
+ * @param persistence - the persistence service; required for resume/latest.
+ * @param cwd - the working directory `--continue` filters by.
+ * @returns the target identity.
+ * @throws with a user-facing message when the flags name nothing resolvable.
+ */
+export declare function resolveTarget(startup: TuiStartup, persistence: SessionPersistence | undefined, cwd: string): Promise<Target>;
 /**
  * Mount the interactive terminal driver.
  * @param ctx - plugin context carrying core services and the launcher-provided exit request.
  * @param config - validated startup config resolved from the tuiStartup provider.
  */
 export declare function apply(ctx: Context, config: Config): void;
+export {};

package/lib/types/kernel-panels.d.ts

@@ -1,6 +1,8 @@
 /** Bounded, composer-safe panels for preset, session, and plugin kernel views. */
 import { type ReactElement } from 'react';
-import type { ModelRow } from './models.ts';
+import type { ModelDirectory, ModelRow } from './models.ts';
+import type { SubagentRow } from './subagents.ts';
+import type { PermissionRow } from './permissions.ts';
 import type { PresetRow } from './presets.ts';
 import type { PluginRow } from './plugin-inventory.ts';
 import type { SessionDirectoryOptions, SessionRow } from './session-directory.ts';
@@ -11,16 +13,30 @@ export declare function ModePanel({ current, load, select, close }: {
     select(id: string): void;
     close(): void;
 }): ReactElement;
+export declare function PermissionPanel({ current, load, select, close }: {
+    current: string;
+    load(): Promise<readonly PermissionRow[]>;
+    select(id: string): void;
+    close(): void;
+}): ReactElement;
 export declare function PluginPanel({ load, close, initialQuery }: {
     load(): readonly PluginRow[];
     close(): void;
     initialQuery?: string;
 }): ReactElement;
-export declare function ResumePanel({ currentCwd, load, readTranscript, select, close }: {
+export declare function ResumePanel({ currentCwd, load, readTranscript, select, requestDelete, deleteConfirmId, reloadToken, deleteMode, close }: {
     currentCwd: string;
     load(options: SessionDirectoryOptions, signal?: AbortSignal): Promise<readonly SessionRow[]>;
     readTranscript(id: string, signal?: AbortSignal): Promise<string>;
     select(row: SessionRow): void;
+    /** Arm the composer-based delete confirm for one row (App owns the keys). */
+    requestDelete?(row: SessionRow): void;
+    /** The row id awaiting y/n in the composer, when any (App-owned). */
+    deleteConfirmId?: string;
+    /** Bump to reload the listing (e.g. after a deletion). */
+    reloadToken?: number;
+    /** Opened via /delete: hint-first delete mode. */
+    deleteMode?: boolean;
     close(): void;
 }): ReactElement;
 /**
@@ -50,12 +66,15 @@ export declare function StatuslinePanel({ enabled, change, close }: {
 /**
  * The `/model` reasoning-effort stage (the Codex model → reasoning popup
  * contract): one bounded list over the selected model's adapter-advertised
- * effort levels, with the effective effort and the model default marked.
- * A model WITHOUT an adapter-declared default leads with a "Default"
- * (provider-default) row — the web effort pane's first entry — so the user
- * can clear a picked level back to provider behavior instead of being forced
- * to choose an advertised one. Enter applies one level; Esc returns to the
- * model list without applying.
+ * effort levels — in the adapter's own display order, ids verbatim (the
+ * kernel treats them as opaque and rejects anything else) — with the
+ * effective effort and the model default marked. A model WITHOUT an
+ * adapter-declared default leads with a "Default" (provider-default) row —
+ * the web effort pane's first entry — so the user can clear a picked level
+ * back to provider behavior. A model advertising no levels opens the same
+ * stage with an explicit empty state (the web pane's "no levels" copy)
+ * instead of a bare failure notice. Enter applies one level; Esc returns to
+ * the model list without applying.
  */
 export declare function EffortPanel({ row, current, select, back }: {
     /** The model row whose advertised levels this stage lists. */
@@ -67,3 +86,41 @@ export declare function EffortPanel({ row, current, select, back }: {
     /** Return to the model list without applying. */
     back(): void;
 }): ReactElement;
+/**
+ * The /agents panel (the Codex agent-picker contract, read-only): this
+ * conversation's subagent conversations — live rows from the activity feed
+ * first, persisted children the feed has not seen this process after — with
+ * Enter/t opening the child's full transcript in the shared read-only
+ * document view (the same projection the exporter uses).
+ */
+export declare function AgentsPanel({ live, load, readTranscript, close }: {
+    /** Live feed rows (child sessions observed this process). */
+    live: readonly SubagentRow[];
+    /** Load this session's persisted child sessions by lineage. */
+    load(): Promise<readonly SessionRow[]>;
+    /** Read one child session's full transcript as markdown. */
+    readTranscript(id: string, signal?: AbortSignal): Promise<string>;
+    close(): void;
+}): ReactElement;
+/**
+ * The /subagent model panel: which model configuration delegated subagents
+ * run on. The kernel seeds child agents from the parent's CREATE-TIME
+ * AgentOptions, so a mid-session /model switch would otherwise leave them on
+ * the launch-time route; the TUI mirrors the selection onto subagent-origin
+ * requests (or an explicit override picked here) via an agent/request
+ * listener. The leading "inherit" row restores follow-the-current-model
+ * behavior; picking a model with several advertised efforts opens the same
+ * effort stage /model uses. Effort overrides are not offered separately —
+ * the kernel's AgentOptions has no effort channel for children, so the level
+ * rides the selected model exactly as /model applies it.
+ */
+export declare function SubagentPanel({ current, load, pick, inherit, close }: {
+    /** Display label of the override in force, '' when following the current model. */
+    current: string;
+    load(): Promise<ModelDirectory>;
+    /** Apply one model (with an advertised effort, when picked) as the override. */
+    pick(row: ModelRow, effortId?: string): void;
+    /** Drop the override: subagents follow the current model again. */
+    inherit(): void;
+    close(): void;
+}): ReactElement;

package/lib/types/models.d.ts

@@ -9,7 +9,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import type { ModelSelection } from '@deepseek-ai/dsh-agent';
-import { type LlmModelReasoningInfo } from '@deepseek-ai/dsh-llm';
+import { type LlmCallConfig, type LlmModelReasoningInfo } from '@deepseek-ai/dsh-llm';
 /** Display metadata for one adapter-owned reasoning effort (mirrors `LlmReasoningEffortInfo`). */
 export interface ModelReasoningEffort {
     /** Opaque value accepted by the model's `GenerateOptions.reasoningEffort`. */
@@ -87,6 +87,20 @@ export declare function resolveEffectiveSelection(picked: ModelSelection | undef
 export declare function buildModelSelection(row: ModelRow, effortId?: string): ModelSelection;
 /** Display label for one applied selection: `provider/model` or `provider/model@effort`. */
 export declare function modelSelectionLabel(selection: ModelSelection): string;
+/**
+ * Apply one model selection onto a resolved request config — the exact
+ * semantics of the kernel's `installModelSelection` request listener,
+ * extracted so the TUI can mirror it for subagent-origin requests: children
+ * spawned by the subagent tool inherit the parent's CREATE-TIME AgentOptions,
+ * which a mid-session /model switch never touches, so delegated work would
+ * otherwise keep running on the launch-time route. An absent effort strips
+ * any inherited effort (restoring the selected model's provider default),
+ * matching the kernel listener field-for-field.
+ * @param resolved - the config the inner chain produced.
+ * @param selection - the selection to enforce.
+ * @returns the overridden config.
+ */
+export declare function applyModelSelectionToConfig(resolved: LlmCallConfig, selection: ModelSelection): LlmCallConfig;
 /**
  * Load the selectable model directory from the live `ctx.llm` registry.
  * Providers are listed synchronously; each provider's models are discovered

package/lib/types/permissions.d.ts

@@ -0,0 +1,37 @@
+/** Permission-preset policy for pending and active TUI sessions. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session';
+/** One selectable permission preset row for the /permission panel. */
+export interface PermissionRow {
+    readonly id: string;
+    readonly description?: string;
+}
+/** Structural boundary over Harness permission presets; values stay service-owned. */
+export interface PermissionPresetsService {
+    readonly names: readonly string[];
+    readonly defaultPreset: string;
+    resolve(name: string): unknown;
+    current(events: readonly SessionEvent[]): string;
+    set(session: Session, preset: string): void;
+    /** Client presentation metadata for one preset; may reject unknown names. */
+    optionOf?(name: string): {
+        name: string;
+        description?: string;
+    } | undefined;
+}
+/** Read the optional Harness service without importing its runtime package. */
+export declare function permissionPresetsFrom(ctx: Context): PermissionPresetsService | undefined;
+/** Effective label for either an active session or the not-yet-created first one. */
+export declare function effectivePermission(service: PermissionPresetsService, session: Session | undefined, pending: string | undefined): string;
+/** Validate a preset and write it only when a durable session already exists. */
+export declare function selectPermission(service: PermissionPresetsService, session: Session | undefined, preset: string): string;
+/** Cycle table order from the active, pending, or configured-default value. */
+export declare function cyclePermission(service: PermissionPresetsService, session: Session | undefined, pending: string | undefined): string;
+/** Materialize a pre-session choice after Harness creates the first session. */
+export declare function applyPendingPermission(service: PermissionPresetsService, session: Session, pending: string | undefined): void;
+/**
+ * List every switchable preset for the /permission panel, table order kept.
+ * Description lookup failures degrade to an undocumented row, never a failed
+ * panel load — `optionOf` rejects names its table no longer knows.
+ */
+export declare function listPermissionRows(service: PermissionPresetsService): readonly PermissionRow[];

package/lib/types/presets.d.ts

@@ -26,6 +26,8 @@ export declare function agentPresetsFrom(ctx: Context): AgentPresetsService | un
 export declare function isBlankSession(events: readonly SessionEvent[]): boolean;
 /** Latest logged selection wins; legacy sessions deliberately fall back to standard. */
 export declare function resolvePreset(session: Pick<Session, 'header' | 'events'>): string;
+/** Resolve a pre-session choice, or recompose an active blank Agent. */
+export declare function selectPreset(service: AgentPresetsService, agent: Agent | undefined, presetId: string): Promise<PresetRow>;
 /** Recompose atomically from the caller's perspective, logging only success. */
 export declare function switchPreset(service: AgentPresetsService, agent: Agent, presetId: string): Promise<PresetRow>;
 /** Minimal handle shape used by lifecycle tests without exposing Agent internals. */

package/lib/types/provider-settings.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Provider settings adapter for the TUI `/model` provider-management panel:
+ * the same-process equivalent of the web host's Models page join
+ * (`packages/client/ui-settings-models`), reading the advisory `ctx.llm`
+ * registry, the redacted `ctx.settings` descriptors, and the value-free
+ * `ctx.credentials` facts directly. Secrets never cross this module: settings
+ * are read with `redactSecrets: true`, credentials are only ever described
+ * (never resolved), and every message is single-line without embedding key
+ * data.
+ *
+ * @module @deepseek-ai/dsh-tui/provider-settings
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/**
+ * The conventional credential reference for a provider route: `<ROUTE>_API_KEY`
+ * with the route uppercased and every non-alphanumeric run collapsed to one
+ * underscore — the exact derivation the official Models page uses
+ * (`deriveKeyRef` in `ui-settings-models`), so a key saved here is found there.
+ * @param provider - provider route id (e.g. `pi-ai`, `minimax-cn`).
+ * @returns the derived reference name (e.g. `PI_AI_API_KEY`).
+ */
+export declare function deriveCredentialRef(provider: string): string;
+/** Value-free facts about one credential reference — never the value. */
+export interface ProviderCredentialFacts {
+    /** Whether the reference currently resolves to a stored value. */
+    readonly configured: boolean;
+    /** Source layer supplying the value; absent while unconfigured. */
+    readonly source?: string;
+    /** Whether a write through this panel would currently succeed. */
+    readonly writable: boolean;
+}
+/**
+ * One row's credential state: value-free facts once the reference was
+ * described, a bounded error when that describe failed (the row itself is
+ * never dropped), or `undefined` when the row names no reference to describe —
+ * an unmanaged active provider, a dormant route, or a profile authenticating
+ * through the provider's own path.
+ */
+export type ProviderCredentialView = ({
+    readonly kind: 'facts';
+} & ProviderCredentialFacts) | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/**
+ * One provider row in the TUI provider-management panel: the configurable
+ * directory entry joined with its settings profile and credential facts.
+ * Every mutation below addresses this row, and the caller passes the row back
+ * after re-loading so the revision/ref facts are current.
+ */
+export interface ProviderTargetView {
+    /** Provider route id (`GenerateOptions.provider`). */
+    readonly provider: string;
+    /** Human-readable provider name. */
+    readonly displayName: string;
+    /** Whether an adapter currently serves this route. */
+    readonly active: boolean;
+    /** User-settings namespace whose section configures this provider; '' when unmanaged. */
+    readonly settingsNs: string;
+    /** Path from that section's root to this provider's profile; [] when the whole section is the profile. */
+    readonly settingsPath: readonly string[];
+    /** Revision of the owning settings section at load (0 when no namespace resolved). */
+    readonly settingsRevision: number;
+    /** Whether the resolved profile exists (the whole section, or at `settingsPath`). */
+    readonly configured: boolean;
+    /** Whether only the user settings layer carries the profile, so removal restores the base. */
+    readonly removable: boolean;
+    /** The credential reference the resolved profile names, when one does. */
+    readonly credentialRef?: string;
+    /** The conventional reference a save uses for a dormant or ref-less profile. */
+    readonly suggestedRef: string;
+    /** Credential facts, a bounded describe error, or undefined when there is no ref to describe. */
+    readonly credential: ProviderCredentialView | undefined;
+    /** The owning adapter reports this route as hand-declared (absent when it draws no distinction). */
+    readonly declared?: boolean;
+}
+/** The resolved provider/settings/credential join. */
+export interface ProviderSettingsDirectory {
+    /** Provider rows: configurable-directory order first, active-unmanaged rows after. */
+    readonly rows: readonly ProviderTargetView[];
+    /** Whether the settings provider accepts writes (mirrors the web page's flag). */
+    readonly writable: boolean;
+    /** Non-fatal join failures (settings/directory reads), for a degradation notice. */
+    readonly failures: readonly string[];
+}
+/** Subscribe to the same provider-directory invalidations as the official Web Models page. */
+export declare function subscribeProviderSettings(ctx: Context, listener: () => void): () => void;
+/** A single-line, bounded error from the provider-management adapter. */
+export declare class ProviderSettingsError extends Error {
+    constructor(message: string);
+}
+/**
+ * Join the configurable-provider directory, the redacted settings
+ * namespaces, and the referenced credentials into panel rows, web-parity:
+ * - directory entries merge with `listProviders()` to mark each live or
+ *   dormant, and routes registered without a directory declaration appear as
+ *   read-only/unmanaged rows (no settings address);
+ * - a whole-section entry is configured whenever its namespace resolves;
+ *   a path-addressed one only when the profile resolves there;
+ * - a row is removable when the user layer alone carries its profile;
+ * - only refs named by resolved profiles are described, and a per-ref failure
+ *   degrades to that row's bounded error instead of losing it.
+ * Absent `settings`/`credentials` services are tolerated the same way.
+ * @param ctx - context carrying the `llm` service (settings/credentials optional).
+ * @returns the resolved directory; empty rows when `llm` is unavailable.
+ */
+export declare function loadProviderSettings(ctx: Context): Promise<ProviderSettingsDirectory>;
+/**
+ * Store a provider API key, web-parity: validate with `normalizeApiKey`
+ * (single-line, actionable errors that never echo the key), materialize the
+ * profile/`apiKeyEnv` through `settings.mutate` first when the resolved
+ * profile names no reference (dormant route or ref-less profile), then store
+ * under the trusted named ref or the derived conventional ref. An existing
+ * whole-section DeepSeek whose resolved profile already names
+ * `DEEPSEEK_API_KEY` needs no settings mutation. Env-supplied read-only keys
+ * are refused before any service call.
+ * @param ctx - context carrying `settings` (when materializing) and `credentials`.
+ * @param target - the joined row to write through.
+ * @param rawKey - the key exactly as typed; surrounding whitespace is trimmed.
+ * @throws {@link ProviderSettingsError} with a single-line, key-free message.
+ */
+export declare function saveProviderCredential(ctx: Context, target: ProviderTargetView, rawKey: string): Promise<void>;
+/**
+ * Remove the currently named credential without touching the provider
+ * profile. Only the resolved profile's own reference is unset; a dormant or
+ * ref-less row (nothing to remove), an already-absent key, and an
+ * env-supplied read-only key are rejected safely before any service call.
+ * @param ctx - context carrying the `credentials` service.
+ * @param target - the joined row whose named credential to unset.
+ * @throws {@link ProviderSettingsError} with a single-line, key-free message.
+ */
+export declare function unsetProviderCredential(ctx: Context, target: ProviderTargetView): Promise<void>;
+/**
+ * Remove a user-added provider profile, web-parity: only `removable` rows may
+ * be removed; a page-managed credential — the derived ref, configured and
+ * writable — is unset first (so a second-step failure leaves the row visible
+ * and the operation retryable), then `settings.mutate` unsets
+ * `target.settingsPath`. Both steps are idempotent. A hand-named credential
+ * ref may be shared elsewhere and is left alone.
+ * @param ctx - context carrying `credentials` and `settings`.
+ * @param target - the joined row to remove.
+ * @throws {@link ProviderSettingsError} with a single-line, key-free message.
+ */
+export declare function removeProviderSettings(ctx: Context, target: ProviderTargetView): Promise<void>;

package/lib/types/questions.d.ts

@@ -22,6 +22,8 @@ export interface PendingQuestion {
     resolve(answers: AskUserQuestionAnswer): void;
     /** Reject the provider promise as aborted (also used for Esc cancel). */
     reject(error: Error): void;
+    /** Detach the request's abort listener once the question settles (internal). */
+    detachAbort?(): void;
 }
 /** The pending-question snapshot the renderer subscribes to. */
 export interface QuestionSnapshot {

package/lib/types/render/animations.d.ts

@@ -73,9 +73,11 @@ export declare const SPARK_GLYPHS: readonly ["·", "✦", "✧"];
  */
 export type DeepseekWaveBand = readonly [number, number, number];
 export declare const DEEPSEEK_WAVE_BANDS: Readonly<Record<DeepseekWaveStyle, Readonly<Record<DeepseekWaveTier, readonly DeepseekWaveBand[]>>>>;
+/** Extra display time applied to every Codex ignition style. */
+export declare const DEEPSEEK_WAVE_DURATION_EXTENSION_MS = 200;
 /**
- * Total animation duration — Codex `IgnitionStyle::total_duration`: three
- * styles × two tiers.
+ * Total visible duration: the Codex ignition duration plus 200ms so its motion
+ * remains readable in a busy terminal.
  * @param tier - the active wave tier.
  * @param style - the active ignition style.
  * @returns the duration in milliseconds.
@@ -150,11 +152,11 @@ export declare function envelope(elapsed: number, total: number, fadeIn: number,
  */
 export declare function deepseekWaveColumnBg(tick: number, column: number, width: number, tier: DeepseekWaveTier, style: DeepseekWaveStyle, hues: readonly [RgbTriple, RgbTriple, RgbTriple], base: RgbTriple): RgbTriple | null;
 /**
- * The sparkle glyph for a tick — Codex `spark_frame`: from 900ms on, one
- * glyph every 100ms through `· ✦ ✧`, then silent. The deepseek (Ultra) tier
- * only; the Ink layer still must skip occupied cells.
+ * The sparkle glyph for a tick — Codex `spark_frame`, sampled on the same
+ * proportionally slowed DeepSeek Wave timeline as the composer background.
+ * The Ink layer still must skip occupied cells.
  * @param tick - wave frame at DEEPSEEK_WAVE_TICK_MS.
- * @returns the sparkle glyph, or null outside the 900..1200ms window.
+ * @returns the sparkle glyph, or null outside the stretched tail window.
  */
 export declare function deepseekWaveSpark(tick: number): string | null;
 /**

package/lib/types/render/lines.d.ts

@@ -24,6 +24,12 @@ export declare function styledLines(segments: readonly StyledSegment[], columns:
 export declare function textLines(text: string, columns: number, style?: LineStyle): readonly StyledLine[];
 /** Markdown rows re-hardened so a single long word cannot escape the budget. */
 export declare function markdownLines(text: string, columns: number): readonly StyledLine[];
+/**
+ * Codex-style reasoning rows: the marker occupies the reply gutter and every
+ * wrapped or explicit continuation starts with the same two-column indent, so
+ * reasoning content and assistant Markdown share one left edge.
+ */
+export declare function reasoningLines(text: string, columns: number): readonly StyledLine[];
 /**
  * Convert one durable transcript entry to its complete scrollable row model.
  * The source entry stays intact; only the caller's visible slice is rendered.