dsh-code 1.0.6 → 1.2.0

package/src/index.ts

@@ -18,12 +18,13 @@ import { createElement } from 'react'
 import type { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { installModelSelection } from '@deepseek-ai/dsh-agent'
-import type { Agent, AgentHandle, ModelSelection, ModelSelectionRef } from '@deepseek-ai/dsh-agent'
+import type { Agent, AgentHandle, AgentStatus, Inbox, ModelSelection, ModelSelectionRef } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-agent-default-model'
 import type {} from '@deepseek-ai/dsh-attachment'
 import { createUserMessage, MessageId, type ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { JobSnapshot } from '@deepseek-ai/dsh-jobs'
 import { SessionId, SessionLogOffset, type Session, type SessionEvent, type SessionHeader, type UserMessage } from '@deepseek-ai/dsh-session'
+import { deriveTurnTokenUsage } from '@deepseek-ai/dsh-token-meter/client'
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 // Type-only: carries the ctx.sessionTitle service merge for /title.
 import type {} from '@deepseek-ai/dsh-session-title'
@@ -31,12 +32,12 @@ import type {} from '@deepseek-ai/dsh-session-title'
 // and the cmdline Context merge for the appExit host value.
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 import type {} from '@deepseek-ai/dsh-cmdline'
-import { App, type NoticeTone } from './app.ts'
+import { App, type NoticeTone, type QueueMutation } from './app.ts'
 import { mountApprovalAnswerer, type ApprovalStore } from './approval.ts'
 import { isSlashLine, submissionPayload, watchCommands, type CommandsView } from './commands.ts'
 import { internals, type TuiMount } from './internals.ts'
 import { syncModelCapabilities } from './model-capabilities.ts'
-import { buildModelSelection, applyModelSelectionToConfig, loadModelDirectory, modelSelectionLabel, resolveEffectiveSelection, type ModelRow } from './models.ts'
+import { buildModelSelection, applyModelSelectionToConfig, loadModelDirectory, modelSelectionLabel, pendingModelSelection, resolveEffectiveSelection, type ModelRow } from './models.ts'
 import {
   discoverProviderModels,
   loadProviderSettings,
@@ -70,21 +71,30 @@ import {
   subscribeProviderAuthorizations,
 } from './authorization.ts'
 import { selectForkSeed } from './fork.ts'
-import { buildReviewPrompt, loadGitDiff } from './git-workflow.ts'
+import {
+  buildReviewPrompt,
+  listReviewBranches,
+  listReviewCommits,
+  loadCommitDiff,
+  loadGitDiff,
+  mergeBaseWith,
+  type ReviewSelection,
+} from './git-workflow.ts'
 import type { TuiStartup } from './startup.ts'
 import { SessionSwitchQueue } from './session-switch.ts'
 import { agentPresetsFrom, normalizePresetId, resolvePreset, selectPreset } from './presets.ts'
 import {
   applyPendingPermission,
-  cyclePermission as cyclePermissionPreset,
   effectivePermission,
   listPermissionRows,
   permissionPresetsFrom,
   selectPermission,
 } from './permissions.ts'
 import { listPluginRows } from './plugin-inventory.ts'
+import { applyLauncherUpdate, probeLauncherUpdate } from './update.ts'
 import { parseAnimationsPref } from './render/animations.ts'
 import { parseThemeName, setTheme, type ThemeName } from './theme.ts'
+import { parseLanguageName, setLanguage, t, type LanguageName } from './i18n.ts'
 import {
   isSubagentSession,
   matchSessionId,
@@ -100,7 +110,13 @@ import {
   type SessionQueryService,
   type SessionRow,
 } from './session-directory.ts'
+import type { JobRow, SearchRow } from './kernel-panels.ts'
 import { createUserSettingsPersistence, writeFileAtomically } from './settings-file.ts'
+import { turnUsages, type UsageView } from './render/usage.ts'
+// Type-only import: merges the projection registry into the Context type so
+// `ctx.get('sessionProjections')` is typed (the service itself is mounted by
+// dsh-base at runtime).
+import type {} from '@deepseek-ai/dsh-session-projection'
 
 /** Stable Cordis plugin name. */
 export const name = 'tui-runner'
@@ -128,7 +144,7 @@ export const Config: z<Config> = z.object({
 /** Process-facing effects of the runner: the Ink mount plus the launcher's exit request. */
 interface TuiIo {
   mount: typeof internals.mount
-  exit(code: number): void
+  exit: (code: number) => void
 }
 
 /** Report an unexpected direct-driver failure and request a failing exit. */
@@ -147,7 +163,7 @@ function fail(io: TuiIo, error: unknown): void {
  * @param caller - the active agent (undefined sees only unowned jobs).
  * @returns job rows in registration order; never throws.
  */
-function listJobs(ctx: Context, caller: Agent | undefined): readonly import('./kernel-panels.ts').JobRow[] {
+function listJobs(ctx: Context, caller: Agent | undefined): readonly JobRow[] {
   const jobs = ctx.get('jobs')
   if (jobs === undefined) return []
   try {
@@ -165,6 +181,23 @@ function listJobs(ctx: Context, caller: Agent | undefined): readonly import('./k
   }
 }
 
+/**
+ * Read one user-level settings file as a plain object. The callers all treat a
+ * missing file as "unset" and a corrupt one as "warn and fall back", so this
+ * helper owns the one distinction they share: readable JSON that is not an
+ * object is corruption, not an absent preference, and must not surface as a
+ * cryptic property access on `null`.
+ * @param path - absolute path of the settings file.
+ * @returns the parsed object; the caller narrows each field itself.
+ */
+function readSettingsObject(path: string): Record<string, unknown> {
+  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'))
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${basename(path)} must contain a JSON object`)
+  }
+  return parsed as Record<string, unknown>
+}
+
 /**
  * Resolve the working directory's git branch for the status line.
  * @param cwd - the session's working directory.
@@ -189,6 +222,8 @@ interface Target {
   cwd?: string
   seed?: readonly SessionEvent[]
   parentSession?: SessionId
+  /** Marks the session as a subagent conversation in the durable header. */
+  origin?: 'subagent'
   seedLength?: number
 }
 
@@ -253,10 +288,100 @@ export async function runQuitSequence(
 /** One composer submission waiting behind the startup delivery. */
 export interface QueuedSubmission {
   readonly text: string
+  /** `steer` inserts into the running turn; `followup` waits for the next one. */
   readonly mode: 'followup' | 'steer'
   readonly images: readonly ContentBlock[]
 }
 
+/** What one requested queue mutation did; the runner maps it to one notice. */
+export type QueueMutationOutcome =
+  | 'removed'
+  | 'edited'
+  | 'steered'
+  | 'unavailable'
+  | 'empty'
+  | 'steerUnavailable'
+
+/**
+ * Replace one queued message's text while keeping its attachments. A queue
+ * edit rewrites what the user typed, not what they attached: image and file
+ * blocks ride through in delivery order (text first, then attachments, the
+ * shape {@link deliverLine} submits). Dropping them here would silently strip
+ * an attachment the user already confirmed, so this is the edit's single
+ * definition and the panel's read-only marker only mirrors it.
+ */
+export function queueEditContent(content: readonly ContentBlock[], text: string): ContentBlock[] {
+  const attachments = content.filter(block => block.type !== 'text')
+  return [{ type: 'text', text }, ...attachments]
+}
+
+/**
+ * Apply one terminal queue mutation to the live inbox. The decision and the
+ * inbox change are pure over the supplied handles so every branch is testable
+ * without an agent; steering itself is injected because it wakes the driver
+ * rather than mutating the inbox. The durable inbox splices remain the UI's
+ * single source of truth — this helper never reports a state the inbox did not
+ * actually reach.
+ * @param inbox - the live agent inbox (pending lists plus its mutators).
+ * @param status - the agent's lifecycle status; steering needs `running`.
+ * @param messageId - identity of the queued message to mutate.
+ * @param action - the requested mutation.
+ * @param steer - submits the removed message as next-step steering.
+ * @returns the outcome the caller reports.
+ */
+export function applyQueueMutation(
+  inbox: Pick<Inbox, 'nextTurn' | 'append' | 'remove' | 'replace'>,
+  status: AgentStatus,
+  messageId: string,
+  action: QueueMutation,
+  steer: (message: UserMessage) => void,
+): QueueMutationOutcome {
+  const id = MessageId(messageId)
+  const message = inbox.nextTurn.find(candidate => candidate.id === id)
+  if (message === undefined) return 'unavailable'
+  switch (action.kind) {
+    case 'remove':
+      return inbox.remove(id) ? 'removed' : 'unavailable'
+    case 'edit':
+      if (action.text.trim() === '') return 'empty'
+      inbox.replace(id, createUserMessage({
+        content: queueEditContent(message.content, action.text),
+        source: message.source,
+      }))
+      return 'edited'
+    case 'steer':
+      if (status !== 'running') return 'steerUnavailable'
+      // Steer promotes the message out of next-turn, so a failing submit must
+      // put it back: the row the user was looking at never just disappears.
+      if (!inbox.remove(id)) return 'unavailable'
+      try {
+        steer(message)
+      } catch (error: unknown) {
+        inbox.append('next-turn', message)
+        throw error
+      }
+      return 'steered'
+  }
+}
+
+/**
+ * Cancel the active turn while keeping the next-turn queue, then wake the
+ * driver again so the preserved messages actually run. `cancel` clears
+ * pending work by default and never wakes the driver on its own, so the queue
+ * is captured first and re-submitted afterwards: a waking submission latches
+ * the wake while the aborted activity converges to idle, which is what turns
+ * "preserved" into "sent next" instead of "parked forever". Next-step
+ * steering is deliberately dropped — it belonged to the cancelled turn.
+ * @param agent - the live agent handle.
+ * @returns how many queued messages were preserved across the abort.
+ */
+export function cancelPreservingQueue(agent: Pick<Agent, 'inbox' | 'cancel' | 'followup'>): number {
+  const queued = [...agent.inbox.nextTurn]
+  agent.cancel({ kind: 'user' })
+  for (const message of queued) agent.followup(message)
+  return queued.length
+}
+
 /**
  * Whether a tagged submission still belongs to the active session. Attachment
  * prepares resolve on the microtask timeline, while a queued session switch
@@ -269,6 +394,85 @@ export function submissionBelongsToSession(origin: string | undefined, activeSes
   return origin === undefined || origin === '' || origin === activeSessionId
 }
 
+/**
+ * Root-log catalog facts a resumed session must replay into the subagent
+ * feed: constructor seeds never fire on the live bus, so without this the
+ * children of a resumed session vanish behind a restart. The empty-child
+ * placeholder row (childId '') is a placeholder, not a child, and stays out.
+ */
+export function subagentCatalogSeed(events: readonly SessionEvent[]): readonly SessionEvent<'subagent/catalog'>[] {
+  return events.filter((event): event is SessionEvent<'subagent/catalog'> =>
+    event.type === 'subagent/catalog' && event.data.childId !== '')
+}
+
+/**
+ * Map one cross-session full-text hit onto the /search panel's row (pure).
+ * Labels fall back to the short id form — the engine's hit carries the
+ * strongest matching event, not the title observation.
+ */
+export function searchHitToRow(hit: {
+  header: SessionHeader
+  bestMatch: { snippet: string; time: number }
+}): SearchRow {
+  const subagent = hit.header.origin === 'subagent'
+  const cwd = hit.header.cwd ?? ''
+  // Session cwds may arrive in either separator style regardless of the
+  // observing host (a workspace synced from Windows), so split on both.
+  const workspace = cwd.split(/[\\/]/u).filter(part => part !== '').at(-1) ?? ''
+  const preset = hit.header.agentPreset ?? ''
+  const flat = hit.bestMatch.snippet.replace(/\s+/gu, ' ').trim()
+  return {
+    id: hit.header.id,
+    label: hit.header.id.slice(-12),
+    detail: [workspace, preset].filter(part => part !== '').join(' · '),
+    snippet: flat.length > 158 ? `${flat.slice(0, 157)}…` : flat,
+    updatedAt: hit.bestMatch.time,
+    subagent,
+    resumable: !subagent,
+  }
+}
+
+/** One Shift+Tab station decision for the mode cycle. */
+export type ModeCycleDecision =
+  | { readonly kind: 'permission'; readonly preset: string }
+  | { readonly kind: 'plan-on' }
+  | { readonly kind: 'plan-off'; readonly preset: string }
+
+/**
+ * Decide the next Shift+Tab station. The cycle keeps the preset table's
+ * own order (most restrictive first) and inserts ONE plan station between
+ * the most restrictive preset and the wrap target: with the shipped three
+ * presets the user sees workspace-write → danger-full-access → read-only
+ * → plan → workspace-write. Plan IS the most restrictive preset plus the
+ * plan prompt layer — entering it switches nothing (the cycle is already
+ * parked on read-only), and leaving it lands on the next preset after the
+ * most restrictive one. Without the /plan command the cycle is exactly the
+ * preset table.
+ *
+ * `planIntent` covers the committed fold's commit lag: upstream queues a
+ * plan switch during an open turn (and the command pipeline is async even
+ * idle), so the durable plan/mode event lands AFTER the press that chose
+ * it. While an intent from an earlier press is in flight it — not the
+ * stale committed fold — decides the station, so repeated presses advance
+ * the cycle instead of re-issuing the same plan transition (the stuck
+ * plan-on/plan-off toggle). Undefined falls back to the committed fold.
+ */
+export function planCycleDecision(input: {
+  readonly names: readonly string[]
+  readonly current: string
+  readonly inPlan: boolean
+  readonly planAvailable: boolean
+  readonly planIntent?: boolean
+}): ModeCycleDecision | undefined {
+  const names = input.names
+  if (names.length === 0) return undefined
+  const first = names[0]
+  if ((input.planIntent ?? input.inPlan) === true) return { kind: 'plan-off', preset: names[1] ?? first }
+  const at = names.indexOf(input.current)
+  if (at === 0 && input.planAvailable) return { kind: 'plan-on' }
+  return { kind: 'permission', preset: names[(at + 1) % names.length] ?? first }
+}
+
 /**
  * Order-preserving gate for composer input while the startup prompt/images
  * are still preparing. Anything submitted before the startup delivery settles
@@ -366,7 +570,7 @@ function approvalCommandPreview(events: readonly { kind: string }[], callId: str
 /** The runner's connection between the React app and the process side. */
 interface AppBridge {
   /** Post one local notice line (feedback the transcript does not carry). */
-  notify(text: string, tone?: NoticeTone): void
+  notify: (text: string, tone?: NoticeTone) => void
 }
 
 /**
@@ -412,6 +616,13 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     mode: string
     selection: { picked?: ModelSelection }
     resumed: boolean
+    /**
+     * Root-log `subagent/catalog` facts (resume path): constructor seeds
+     * never fire on the live bus, so activation replays them into the
+     * subagent feed after its reset — a resumed session's children stay
+     * visible instead of vanishing behind a restart.
+     */
+    catalogSeed: readonly SessionEvent<'subagent/catalog'>[]
   }
 
   /** Prepare a complete next session before disturbing the currently visible one. */
@@ -465,6 +676,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           cwd: nextCwd,
           agentPreset: mode,
           ...(next.parentSession === undefined ? {} : { parentSession: next.parentSession }),
+          ...(next.origin === undefined ? {} : { origin: next.origin }),
           // 0.1.5 fork lineage: the seed marker lives on the metadata and the
           // inherited prefix length on the top-level option (the v0 header's
           // numeric `seedLength` field is gone from the create contract).
@@ -480,15 +692,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     if (!next.resume && permissionPresets !== undefined) {
       applyPendingPermission(permissionPresets, session, pendingPermission)
     }
+    const seedEvents = session.snapshotEvents()
+    // Resume precedence, middle layer: the log's unconsumed `model/selection`
+    // (a pick the web host recorded that no request ever assembled) outranks
+    // the older request header; an in-process pick still outranks both.
+    if (next.resume && selectionState.picked === undefined) {
+      const pending = pendingModelSelection(seedEvents)
+      if (pending !== undefined) selectionState.picked = pending
+    }
     return {
       handle,
       agent: handle.agent,
       session,
-      store: createTranscriptStore(session.snapshotEvents()),
+      store: createTranscriptStore(seedEvents),
       mentions: createMentions(ctx, handle.agent, session.header.cwd ?? nextCwd),
       mode: mode ?? 'standard',
       selection: selectionState,
       resumed: next.resume,
+      catalogSeed: subagentCatalogSeed(seedEvents),
     }
   }
 
@@ -511,6 +732,46 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let pendingModeWork: Promise<void> = Promise.resolve()
   /** Permission preset selected before the first session exists. */
   let pendingPermission: string | undefined
+  /**
+   * Plan-mode choice made before the first session exists: materialized as a
+   * /plan registry command delivered ahead of the first queued input when the
+   * session composes, so the first assembled step already plans.
+   */
+  let pendingPlan = false
+  /**
+   * In-flight mid-session plan choice from the Shift+Tab cycle. Upstream
+   * queues a plan switch during an open turn (and the command pipeline is
+   * async even idle), so the committed plan/mode fold lags the press that
+   * chose it; the cycle reads this intent until the durable event lands,
+   * then the session/event funnel clears it.
+   */
+  let planIntent: boolean | undefined
+  /**
+   * Whether the pre-session effective preset composes plan mode, answered by
+   * the presets service composition inventory (minimal does not). Cached and
+   * refreshed whenever the pending mode moves; unknown reads as unavailable
+   * so one keypress at most lands before the answer arrives.
+   */
+  let preSessionPlanAvailable = false
+  let preSessionPlanKnown = false
+  const refreshPreSessionPlan = (): void => {
+    if (presets === undefined) {
+      preSessionPlanAvailable = false
+      preSessionPlanKnown = true
+      return
+    }
+    preSessionPlanKnown = false
+    void presets.compositionInventory().then(inventory => {
+      const id = pendingMode ?? normalizePresetId(presets.defaultId)
+      preSessionPlanAvailable = inventory.some(composition => composition.id === id
+        && composition.rows.some(row => row.moduleName === '@deepseek-ai/dsh-plan-mode' && row.enabled !== false))
+      preSessionPlanKnown = true
+    }, () => {
+      preSessionPlanAvailable = false
+      preSessionPlanKnown = true
+    })
+  }
+  refreshPreSessionPlan()
   /**
    * Monotonic session epoch: bumped on every successful activation, on every
    * first-session creation, and on quit. Async callbacks (mention prepares,
@@ -552,6 +813,9 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     session = prepared.session
     store = prepared.store
     mentions = prepared.mentions
+    // Replayed catalog facts rebuild the resumed session's child rows before
+    // the first render (the live handler only folds events from now on).
+    for (const event of prepared.catalogSeed) subagents.apply(event.data.childId, event)
   }
 
   // Seed the transcript from the full session log: constructor seeds never
@@ -562,6 +826,10 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     if (session === undefined) return
     if (subject.id === session.id) {
       store.apply(event)
+      // The committed plan fold caught up (or diverged via a typed /plan or
+      // an approved plan review): the durable event is the live truth again,
+      // so the cycle's in-flight intent retires.
+      if (event.type === 'plan/mode') planIntent = undefined
       // The parent-owned subagent catalog rides the ROOT log (0.1.5); each
       // fact describes one child, so it feeds that child's live row.
       if (event.type === 'subagent/catalog' && event.data.childId !== '') subagents.apply(event.data.childId, event)
@@ -677,7 +945,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let statuslineWarning: string | undefined
   let statuslineItems: readonly string[] = []
   try {
-    statuslineItems = parseStatuslineItems(JSON.parse(readFileSync(statuslinePath, 'utf8')).items)
+    statuslineItems = parseStatuslineItems(readSettingsObject(statuslinePath).items)
   } catch (error) {
     statuslineItems = parseStatuslineItems(undefined)
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
@@ -693,7 +961,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     statuslineItems = [...items]
     void settingsPersistence.save(statuslinePath, JSON.stringify({ items }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('statusline save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.statuslineSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -716,7 +984,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let themeWarning: string | undefined
   if (startup.theme === undefined) {
     try {
-      setTheme(parseThemeName(JSON.parse(readFileSync(themePath, 'utf8')).theme))
+      setTheme(parseThemeName(readSettingsObject(themePath).theme))
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
         themeWarning = error instanceof Error ? error.message : String(error)
@@ -729,7 +997,27 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     setTheme(name)
     void settingsPersistence.save(themePath, JSON.stringify({ theme: name }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('theme save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.themeSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
+      })
+  }
+
+  // /language persistence: one user-level JSON file beside theme.json. A
+  // missing file means English; a corrupt file degrades to English with a
+  // surfaced warning.
+  const languagePath = join(homedir(), '.dsh', 'dsh-code', 'language.json')
+  let languageWarning: string | undefined
+  try {
+    setLanguage(parseLanguageName(readSettingsObject(languagePath).language))
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+      languageWarning = error instanceof Error ? error.message : String(error)
+    }
+  }
+  const saveLanguage = (name: LanguageName): void => {
+    setLanguage(name)
+    void settingsPersistence.save(languagePath, JSON.stringify({ language: name }, null, 2) + '\n')
+      .catch((writeError: unknown) => {
+        bridge.notify(t('notice.languageSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -742,8 +1030,9 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let animationsEnabled = true
   let animationsWarning: string | undefined
   try {
-    // `?? {}` keeps a literal `null` file from surfacing a cryptic TypeError.
-    animationsEnabled = parseAnimationsPref((JSON.parse(readFileSync(animationsPath, 'utf8')) ?? {}).animations)
+    // A literal `null` file reads as corruption and surfaces the warning the
+    // block above promises, instead of a property access on `null`.
+    animationsEnabled = parseAnimationsPref(readSettingsObject(animationsPath).animations)
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
       animationsWarning = error instanceof Error ? error.message : String(error)
@@ -752,7 +1041,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   const saveAnimations = (enabled: boolean): void => {
     void settingsPersistence.save(animationsPath, JSON.stringify({ animations: enabled }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('animations save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.animationsSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -796,19 +1085,32 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       .then(() => mkdir(dirname(historyPath), { recursive: true }))
       .then(() => appendFileAsync(historyPath, historyLine(text), 'utf8'))
       .catch((writeError: unknown) => {
-        bridge.notify('history save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.historySaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
-  /** Cancel one queued inbox message (Delete on the empty composer); the durable splice retires its pending row. */
-  const cancelQueued = (messageId: string): void => {
-    if (agent === undefined) return
+  /** Mutate one next-turn inbox item; durable inbox splices remain the UI truth. */
+  const updateQueued = (messageId: string, action: QueueMutation): void => {
+    const current = agent
+    if (current === undefined) return
     try {
-      if (agent.inbox.remove(MessageId(messageId))) {
-        bridge.notify('queued message cancelled')
+      const outcome = applyQueueMutation(
+        current.inbox,
+        current.status,
+        messageId,
+        action,
+        message => current.steer(message),
+      )
+      switch (outcome) {
+        case 'removed': bridge.notify(t('notice.queueCancelled')); return
+        case 'edited': bridge.notify(t('notice.queueEdited')); return
+        case 'steered': bridge.notify(t('notice.queueSteered')); return
+        case 'empty': bridge.notify(t('notice.queueEditEmpty'), 'warning'); return
+        case 'steerUnavailable': bridge.notify(t('notice.queueSteerUnavailable'), 'warning'); return
+        case 'unavailable': bridge.notify(t('notice.queueUnavailable'), 'warning'); return
       }
     } catch (error: unknown) {
-      bridge.notify('queue cancel failed: ' + (error instanceof Error ? error.message : String(error)), 'error')
+      bridge.notify(t('notice.queueActionFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     }
   }
 
@@ -873,7 +1175,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     }
     const registry = ctx.get('commands')
     if (registry === undefined) {
-      bridge.notify('no command registry is mounted in this composition', 'error')
+      bridge.notify(t('notice.commandRegistryMissing'), 'error')
       return
     }
     const controller = new AbortController()
@@ -901,13 +1203,17 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
             source: { kind: 'user' },
           }))
         } catch (error: unknown) {
-          bridge.notify(`command fallback failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+          bridge.notify(t('notice.commandFallbackFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
         }
       }
     }, (error: unknown) => {
       finish()
       if (epoch !== atEpoch || agent !== currentAgent) return
-      bridge.notify(`command failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      // A failed plan switch never appends the plan/mode event the cycle's
+      // intent retirement waits for, so the in-flight choice dies here too —
+      // otherwise every later Shift+Tab reads a phantom plan state.
+      if (line === '/plan' || line === '/plan off') planIntent = undefined
+      bridge.notify(t('notice.commandFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
@@ -915,13 +1221,12 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let deliveryChain: { epoch: number; tail: Promise<void> } = { epoch: 0, tail: Promise.resolve() }
 
   /** Deliver one trimmed line to the live session, expanding mentions first. */
-  const deliverLine = (line: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const deliverLine = (line: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     const currentAgent = agent!
-    const currentMentions = mentions!
+    const currentMentions = mentions
     // The command registry is a closed namespace: slash lines run out of
-    // band and never reach the model through this path (steering keeps the
-    // registry out of the inbox, so slash lines steer as literal text).
-    if (images.length === 0 && isSlashLine(line) && mode === 'followup') {
+    // band and never reach the model through this path.
+    if (images.length === 0 && isSlashLine(line)) {
       runSlash(line)
       return
     }
@@ -959,13 +1264,10 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           content,
           source: { kind: 'user' },
         })
-        if (mode === 'steer') {
-          // The queued message is visible as a pending transcript row (the
-          // web queue-mirror contract); no notice noise on the happy path.
-          currentAgent.steer(message)
-        } else {
-          currentAgent.followup(message)
-        }
+        // Steering is consumed at the next step boundary of the turn already
+        // running; a followup becomes its own turn instead.
+        if (mode === 'steer') currentAgent.steer(message)
+        else currentAgent.followup(message)
       } catch (error: unknown) {
         bridge.notify(`${mode === 'steer' ? 'steering' : 'message'} failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
       }
@@ -976,14 +1278,18 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     }
     const controller = new AbortController()
     pendingControllers.add(controller)
-    enqueueDelivery(() => currentMentions.prepare(parsed, controller.signal).then((prepared) => {
-      pendingControllers.delete(controller)
-      deliver(prepared.text, prepared.additionalContext)
-    }, (error: unknown) => {
-      pendingControllers.delete(controller)
-      if (controller.signal.aborted || epoch !== atEpoch) return
-      bridge.notify(`session reference failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
-    }))
+    // `enqueueDelivery` returns nothing; the delivery chain only orders the
+    // work, so the promise is consumed here with an explicit void.
+    enqueueDelivery(() => {
+      void currentMentions.prepare(parsed, controller.signal).then((prepared) => {
+        pendingControllers.delete(controller)
+        deliver(prepared.text, prepared.additionalContext)
+      }, (error: unknown) => {
+        pendingControllers.delete(controller)
+        if (controller.signal.aborted || epoch !== atEpoch) return
+        bridge.notify(`session reference failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      })
+    })
   }
 
   // Deferred first-session creation for a bare launch: the session is composed
@@ -1009,7 +1315,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         // (which would orphan the live one without a dispose).
         if (session !== undefined) {
           const queued = pendingInputs.splice(0)
-          for (const item of queued) deliverLine(item.text, item.mode, item.images)
+          for (const item of queued) deliverLine(item.text, item.images, item.mode)
           return
         }
         const next = await prepare({
@@ -1029,6 +1335,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           store = next.store
           mentions = next.mentions
           subagents.reset()
+          for (const event of next.catalogSeed) subagents.apply(event.data.childId, event)
           pendingMode = undefined
           pendingPermission = undefined
           commands.setAgent(agent)
@@ -1063,7 +1370,14 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         abortPendingControllers()
         epoch += 1
         const queued = pendingInputs.splice(0)
-        for (const item of queued) deliverLine(item.text, item.mode, item.images)
+        if (pendingPlan) {
+          pendingPlan = false
+          // A pre-session plan choice materializes as the registry command
+          // delivered AHEAD of the queued lines, so the first assembled step
+          // of the user's opening message already runs in plan mode.
+          deliverLine('/plan')
+        }
+        for (const item of queued) deliverLine(item.text, item.images, item.mode)
       } finally {
         creating = false
       }
@@ -1074,7 +1388,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   }
 
   /** Deliver one readable line to the agent, expanding session mentions first. */
-  const sendNow = (text: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const sendNow = (text: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     // Blank check on the trimmed form; the payload itself keeps the draft's
     // exact whitespace unless the line is a syntactic slash command.
     const line = submissionPayload(text)
@@ -1096,17 +1410,19 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       return
     }
     if (session === undefined) {
+      // The delivery mode rides the buffered line: a steer picked before the
+      // first session exists must still steer once that session composes.
       pendingInputs.push({ text: line, mode, images })
       ensureSession()
       return
     }
-    deliverLine(line, mode, images)
+    deliverLine(line, images, mode)
   }
 
   // Startup serialization: input submitted while the startup prompt/images
   // are still preparing queues behind the initial request.
-  const inputGate = new StartupInputGate(({ text, mode, images }) => sendNow(text, mode, images))
-  const send = (text: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const inputGate = new StartupInputGate(({ text, mode, images }) => sendNow(text, images, mode))
+  const send = (text: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     inputGate.submit({ text, mode, images })
   }
 
@@ -1116,25 +1432,30 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     // session (queued switch): the composing session is gone, so the stale
     // delivery is dropped instead of landing in the new session's inbox.
     if (!submissionBelongsToSession(origin, session?.id)) return
-    send(text, 'followup', images)
+    send(text, images)
   }
 
   /**
-   * Submit steering: a running driver consumes the text at its next step
-   * boundary (the inbox delivers between steps); an idle driver just starts
-   * a turn, so this doubles as the busy-state submit path.
+   * Deliver one line as steering: a running driver consumes it at its next
+   * step boundary, an idle one starts a turn with it. The composer's Tab
+   * toggle picks this over {@link dispatch} for the next submission.
    */
   const steer = (text: string, images: readonly ContentBlock[] = [], origin?: string): void => {
     if (!submissionBelongsToSession(origin, session?.id)) return
-    send(text, 'steer', images)
+    send(text, images, 'steer')
   }
 
-  /** Interrupt the running turn (Esc); true when a turn was actually cancelled. */
+  /**
+   * Interrupt the running turn (Esc); true when a turn was actually
+   * cancelled. {@link cancelPreservingQueue} keeps the next-turn queue alive
+   * AND re-wakes the driver, so the preserved messages run instead of
+   * parking; next-step steering dies with the turn.
+   */
   const interrupt = (): boolean => {
     if (agent === undefined || agent.status !== 'running') return false
     try {
-      agent.cancel({ kind: 'user' })
-      bridge.notify('turn cancelled — Ctrl+C or /quit to exit')
+      const preserved = cancelPreservingQueue(agent)
+      bridge.notify(t(preserved > 0 ? 'notice.turnCancelledKeepQueue' : 'notice.turnCancelled'))
       return true
     } catch (error: unknown) {
       bridge.notify(`cancel failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
@@ -1157,24 +1478,71 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   }
 
   /**
-   * Cycle to the next permission preset (Shift+Tab). Before the first session,
-   * the choice remains process-local and is materialized when Harness creates
-   * that session; afterwards the canonical service writes durable events.
+   * Shift+Tab mode cycle: permission presets in table order, then the plan
+   * station when the composition offers the /plan command (preset-mounted,
+   * so minimal sessions and the pre-session state cycle permissions only).
+   * Plan transitions submit the upstream registry command — it stays the
+   * single owner of plan state; the TUI renders the durable plan/mode event
+   * it appends. Because that event lags the press (upstream queues the
+   * switch during an open turn), each mid-session plan decision records the
+   * choice in `planIntent` and the next press reads it back, so the cycle
+   * advances stations instead of re-issuing one transition. Returns the
+   * notice label, or '' when nothing changed.
    */
-  const cyclePermission = (): string => {
+  const cycleMode = (): string => {
     if (permissionPresets === undefined || permissionPresets.names.length === 0) {
       bridge.notify('permission presets are not mounted in this composition', 'warning')
       return ''
     }
     try {
-      const next = cyclePermissionPreset(permissionPresets, session, pendingPermission)
-      if (session === undefined && next !== '') {
-        pendingPermission = next
+      // Pre-session the plan station rides the pending choice; once a
+      // session exists the scoped /plan command descriptor decides, and the
+      // durable plan/mode event is the live truth.
+      const preSession = session === undefined
+      if (preSession && !preSessionPlanKnown) refreshPreSessionPlan()
+      const decision = planCycleDecision({
+        names: permissionPresets.names,
+        current: effectivePermission(permissionPresets, session, pendingPermission),
+        inPlan: preSession ? pendingPlan : store.getView().plan === true,
+        ...(preSession ? {} : { planIntent }),
+        planAvailable: preSession ? preSessionPlanAvailable : commands.descriptors.some(descriptor => descriptor.name === 'plan'),
+      })
+      if (decision === undefined) return ''
+      if (decision.kind === 'permission') {
+        const next = selectPermission(permissionPresets, session, decision.preset)
+        if (preSession) {
+          pendingPermission = next
+          renderCurrent()
+        }
+        return `permission → ${next}`
+      }
+      if (decision.kind === 'plan-on') {
+        // Plan IS the most restrictive preset plus the plan prompt layer:
+        // the cycle arrives here from that preset, so permission needs no
+        // switch — only the plan mode itself toggles.
+        if (preSession) {
+          pendingPlan = true
+          renderCurrent()
+          return 'plan → on (applies to the first session)'
+        }
+        planIntent = true
+        send('/plan')
+        return 'plan → on'
+      }
+      // Leaving plan lands on the station after the most restrictive
+      // preset (workspace-write with the shipped table).
+      if (preSession) {
+        pendingPlan = false
+        pendingPermission = decision.preset
         renderCurrent()
+        return `plan → off · permission → ${decision.preset}`
       }
-      return next
+      planIntent = false
+      send('/plan off')
+      selectPermission(permissionPresets, session, decision.preset)
+      return `plan → off · permission → ${decision.preset}`
     } catch (error: unknown) {
-      bridge.notify(`permission change failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(`mode change failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
       return ''
     }
   }
@@ -1400,6 +1768,26 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     return buildExportMarkdown(createTranscriptStore(snapshot.events).getView(), snapshot.session.id)
   }
 
+  /**
+   * Read one session's usage blocks for the /usage panel: the mounted
+   * projection's session totals plus the meter's own per-turn fold over the
+   * durable log (which the panel merges by model). A deployment without the
+   * projection registry renders the totals as explicitly unavailable rather
+   * than as zeros. The read is synchronous — the registry materializes a cell
+   * on first touch — so it is handed to the panel behind a resolved promise,
+   * which keeps the fold out of the keystroke that opens the panel.
+   * @param current - the session to read, or undefined before the first one.
+   * @returns the resolved panel data.
+   */
+  const loadUsage = (current: Session | undefined): Promise<UsageView> => {
+    if (current === undefined) return Promise.resolve({ turns: [] })
+    const values = ctx.get('sessionProjections')?.snapshot(current, ['tokenUsage']).values
+    return Promise.resolve({
+      totals: values?.tokenUsage,
+      turns: turnUsages(current.snapshotEvents(), deriveTurnTokenUsage),
+    })
+  }
+
   const switchModeAction = async (id: string): Promise<string> => {
     if (id === '') throw new Error('usage: /mode <preset>')
     const currentAgent = agent
@@ -1468,16 +1856,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       commands.setAgent(agent)
       skills.setAgent(agent)
       try {
+        // Reseed the feed BEFORE the first frame of the new session so no
+        // stale row from the previous one flashes; a rolled-back handoff
+        // re-seeds the previous session's catalog the same way.
+        subagents.reset()
+        for (const event of next.catalogSeed) subagents.apply(event.data.childId, event)
         process.stdout.write('\x1b[r\x1b[0m\x1b[H\x1b[2J\x1b[3J\x1b[H')
         renderCurrent()
         // Only a successful handoff may clear the transient per-session
         // surfaces: a rolled-back switch keeps the previous session's
         // subagent feed plus the user's pre-session /mode and permission
         // picks (the bare-launch promise: explicit choices survive until
-        // composition takes them).
-        subagents.reset()
+        // composition takes them). The in-flight cycle intent belonged to
+        // the previous session's presses; the new session's committed fold
+        // decides from here.
         pendingMode = undefined
         pendingPermission = undefined
+        pendingPlan = false
+        planIntent = undefined
       } catch (error: unknown) {
         active = previous
         agent = previous?.agent
@@ -1486,6 +1882,14 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         mentions = previous === undefined ? createMentions(ctx, undefined, cwd) : previous.mentions
         if (agent !== undefined) commands.setAgent(agent)
         if (agent !== undefined) skills.setAgent(agent)
+        subagents.reset()
+        if (previous !== undefined) {
+          for (const event of previous.catalogSeed) subagents.apply(event.data.childId, event)
+        }
+        // The failed handoff disposed the incoming session; the restored
+        // store's committed plan fold is the truth, so any cycle intent
+        // collected against the switch churn retires too.
+        planIntent = undefined
         await next.handle.dispose()
         if (!quitting) renderCurrent()
         throw error
@@ -1557,7 +1961,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     const matches = exact.length > 0 ? exact : records.filter(record => record.header.id.startsWith(wanted))
     if (matches.length === 0) throw new Error(`no session matches "${wanted}"`)
     if (matches.length > 1) throw new Error(`session prefix "${wanted}" is ambiguous (${matches.length} matches)`)
-    const matched = matches[0]!
+    const matched = matches[0]
     // Same lineage gate as the CLI --resume path and the picker.
     if (isSubagentSession(matched.header)) {
       throw new Error('subagent conversations are read-only; resume a root session')
@@ -1585,7 +1989,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     requestSwitch({ target: { sessionId: id, resume: false, mode, cwd: nextCwd }, label: id.slice(-12) })
   }
 
-  const reviewChanges = (argument: string): void => {
+  const reviewChanges = (selection: ReviewSelection): void => {
     // Works from a bare launch too: with no session yet the read-only
     // choice goes to pendingPermission (materialized when the first
     // session composes) and the review prompt queues behind that
@@ -1605,21 +2009,31 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     const finish = (): void => {
       pendingControllers.delete(controller)
     }
-    void loadGitDiff(reviewCwd, argument, controller.signal).then(({ title, files }) => {
+    // Branch reviews diff from the precomputed merge base (what would
+    // actually land), commit reviews the commit's own patch, everything
+    // else reviews the uncommitted working tree.
+    const load = selection.kind === 'commit'
+      ? loadCommitDiff(reviewCwd, selection.sha, controller.signal)
+      : selection.kind === 'base-branch'
+        ? mergeBaseWith(reviewCwd, selection.branch, controller.signal)
+          .then(base => loadGitDiff(reviewCwd, base ?? selection.branch, controller.signal))
+        : loadGitDiff(reviewCwd, '', controller.signal)
+    const note = selection.kind === 'custom' ? selection.instructions : undefined
+    void load.then(({ title, files }) => {
       finish()
       if (controller.signal.aborted || epoch !== atEpoch || agent !== currentAgent) return
       try {
         setPermissionAction('read-only')
       } catch (error: unknown) {
-        bridge.notify(`review unavailable: ${error instanceof Error ? error.message : String(error)}`, 'error')
+        bridge.notify(t('notice.reviewUnavailable', { message: error instanceof Error ? error.message : String(error) }), 'error')
         return
       }
-      send(buildReviewPrompt(files.flatMap(file => file.lines).join('\n'), title), 'followup')
-      bridge.notify('review started under read-only permissions')
+      send(buildReviewPrompt(files.flatMap(file => file.lines).join('\n'), title, note))
+      bridge.notify(t('notice.reviewStarted'))
     }, (error: unknown) => {
       finish()
       if (controller.signal.aborted || epoch !== atEpoch) return
-      bridge.notify(`review failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.reviewFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
@@ -1661,6 +2075,30 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     requestSwitch({ target: { sessionId: row.id, resume: true }, label: row.title ?? row.id.slice(-12) })
   }
 
+  // /search reads the SAME in-process engine the model's session_search
+  // tools use (the bundle's skip-tolerant subclass). The row may be disabled
+  // by a deployment; /search then degrades to a notice instead of a panel.
+  const searchSessions = sessionQuery === undefined
+    ? undefined
+    : async (query: string, signal?: AbortSignal): Promise<readonly SearchRow[]> => {
+      const page = await sessionQuery.searchSessions({ query, limit: 30 }, signal === undefined ? undefined : { signal })
+      const rows = page.items.map(hit => searchHitToRow(hit))
+      // Best-effort title enrichment (the same snapshots /resume merges):
+      // a failure keeps the short-id labels instead of failing the search.
+      try {
+        const observations = await sessionQuery.readTitleSnapshots(rows.map(row => row.id), signal)
+        const titles = new Map<string, string>()
+        for (const observation of observations) {
+          if (observation.status !== 'fulfilled') continue
+          const title = observation.value?.title?.title
+          if (title !== undefined && title.trim() !== '') titles.set(observation.sessionId, title)
+        }
+        return rows.map(row => titles.has(row.id) ? { ...row, label: titles.get(row.id)! } : row)
+      } catch {
+        return rows
+      }
+    }
+
   const cancelSessionSwitch = (): boolean => {
     return switchQueue.cancel()
   }
@@ -1703,6 +2141,8 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       resumed: active?.resumed ?? false,
       mode: active?.mode ?? pendingMode ?? normalizePresetId(presets.defaultId),
       permission,
+      /** Pre-session plan choice for the status badge until a session composes. */
+      pendingPlan: session === undefined && pendingPlan,
       dispatch,
       steer,
       interrupt,
@@ -1729,7 +2169,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       prepareImages: (paths, signal) => saveImagePaths(paths, ctx.get('attachments'), signal),
       inspectFiles: paths => inspectFilePaths(paths, ctx.get('attachments'), session?.header.cwd ?? cwd),
       prepareFiles: (paths, signal) => saveFilePaths(paths, ctx.get('attachments'), signal),
-      cyclePermission,
+      cycleMode,
       setPermission: setPermissionAction,
       selectModel,
       subagentModel: subagentModelLabel(),
@@ -1740,6 +2180,8 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       renameTitle,
       copyLastResponse,
       loadGitDiff: (argument: string) => loadGitDiff(session?.header.cwd ?? cwd, argument),
+      listReviewBranches: (signal?: AbortSignal) => listReviewBranches(session?.header.cwd ?? cwd, signal),
+      listReviewCommits: (signal?: AbortSignal) => listReviewCommits(session?.header.cwd ?? cwd, signal),
       reviewChanges,
       loadPresets: () => presets.list(),
       switchMode: switchModeAction,
@@ -1750,6 +2192,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       forkSession,
       loadSessions,
       loadSessionTranscript,
+      loadUsage: () => loadUsage(session),
       loadSubagents: () => {
         const current = session
         if (current === undefined || sessionQuery === undefined) return Promise.resolve([])
@@ -1757,18 +2200,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           .then(rows => rows.filter(row => row.parent === current.id && row.subagent))
       },
       switchSession,
+      searchSessions,
       cancelSessionSwitch,
       loadPlugins: () => listPluginRows(ctx),
+      // The launcher owns every update decision; the TUI only drives its
+      // read-only probe and streamed apply as child processes.
+      probeUpdate: () => probeLauncherUpdate(),
+      applyUpdate: (onLine, plan) => applyLauncherUpdate(onLine, undefined, plan),
       loadJobs: () => listJobs(ctx, active?.agent),
       statusline: statuslineItems,
       saveStatusline,
       applyEditorKeys,
       saveTheme,
+      saveLanguage,
       animations: animationsEnabled,
       saveAnimations,
       history: inputHistory,
       recordHistory,
-      cancelQueued,
+      updateQueued,
       onBridgeReady: (instance: AppBridge) => { bridge.notify = instance.notify },
     })
   }
@@ -1811,6 +2260,11 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     }, 50)
   }
   // Same one-shot surface for a corrupt theme file (dark fallback stays live).
+  if (languageWarning !== undefined) {
+    setTimeout(() => {
+      bridge.notify(t('notice.languageConfigUnreadable', { message: languageWarning }), 'warning')
+    }, 0)
+  }
   if (themeWarning !== undefined) {
     setTimeout(() => {
       bridge.notify('theme config unreadable, using dark: ' + themeWarning, 'warning')