dsh-oc-tui 0.2.0-pre.13 → 0.2.0

package/lib/index.js

@@ -9,6 +9,7 @@ import { contentHasImage, createUserMessage } from '@deepseek-ai/dsh-llm'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import { parseCommand } from '@deepseek-ai/dsh-commands'
 import { Terminal } from './term.js'
+import { captureDiagnostics } from './diagnostics.js'
 import { App, noteFromContext, cursorAtVisual } from './ui.js'
 import { probeCapabilities } from './caps.js'
 import { renderImage, sha16 } from './image.js'
@@ -16,9 +17,31 @@ import { createMermaidRenderer } from './mermaid.js'
 import { SessionMetrics, mergeSessionStats } from './metrics.js'
 import { InterruptState } from './interrupt.js'
 import { SETTINGS_MENU, applyLocalePreference, buildMcpFormItems, describeLocale, installWebSettingSchemas, loadMcpSettings, loadModelSettings, loadProviderModels, loadWebSettings, readTuiSetting, saveWebSetting } from './web-settings.js'
+import {
+  adoptDiscovered,
+  buildCreateFormItems,
+  buildModelFormItems,
+  createDraft,
+  declareNamespace,
+  deriveRoute,
+  discoverDraftModels,
+  draftModelItems,
+  mergeModelSelection,
+  modelDraftFrom,
+  modelEntryId,
+  modelFromDraft,
+  protocolChoices,
+  providerDirectory,
+  providerPickerItems,
+  removeModelEntry,
+  saveCreateDraft,
+  saveModelEntry,
+  validateCreateDraft,
+  validateModelDraft,
+} from './providers.js'
 import { McpManager, collectServers, createToolProbe, draftFromEntry, emptyDraft, pathConfigPath, removeServer, saveDraft, userConfigPath, validateDraft } from './mcp.js'
 import { registerMcpSkill } from './mcp-skill.js'
-import { contentImages, contentText, decodeDataUrl, detectImageMediaType, formatError, localImagePath, timeString, userContentBlocks } from './util.js'
+import { contentImages, contentText, decodeDataUrl, detectImageMediaType, fieldPasteText, formatError, localImagePath, shortenPath, timeString, userContentBlocks } from './util.js'
 import { DSH_PACKAGE, TUI_PACKAGE, buildVersionItems, cachedTarballVersions, clearStagedInstall, detectDshInstall, detectDshLocks, dshManifestPath, dshProcessArgs, dshShimPath, formatDownloadProgress, installMarkerPath, loadUpdateView, registryInfo, restartPlan, spawnApplyUpdater, stageInstall, tarballCachePath, tuiInstallIsLocal, tuiInstalledManifestPath, tuiInstalledVersion, updateStatus } from './updates.js'
 import {
   backupRootFor,
@@ -32,6 +55,7 @@ import {
   restoreGitPaths,
   rewindCut,
 } from './rewind.js'
+import { listGitBranches, pullGitUpdates, switchGitBranch } from './git-branch.js'
 import { registerLiveTui } from './bridge.js'
 import { notificationLevel, approvalOutcome, copyTextOptions, deadlineDelay, toTuiQuestions, fromTuiAnswers } from './std/adapt.js'
 // Peer-free on purpose: lib/std/commands.js statically imports the optional
@@ -181,6 +205,20 @@ export function apply(ctx, config) {
   }
   term.start()
   const app = new App(term)
+  // From here until the alt screen is released, anything the host or a plugin
+  // writes to the process streams would land on top of the frame. Divert it to
+  // a log instead, and say so once — silently swallowing an adapter's refusal
+  // would make a broken provider look like a broken TUI.
+  const diagnosticsLog = join(dshHome(), 'tui-diagnostics.log')
+  const diagnostics = captureDiagnostics({
+    logPath: diagnosticsLog,
+    onFirst: () => {
+      app.showToast(t('diagnostics.notice', { path: shortenPath(diagnosticsLog, 48) }), 'warn')
+      // Deferred, not direct: the capture can fire while this startup scope is
+      // still being evaluated, before `paint` below is initialized.
+      setTimeout(() => { if (term.started) paint() }, 0)
+    },
+  })
   // Session history is available from Settings -> Manage sessions.
   app.sidebarVisible = false
   // The status rail's footer names the running builds: this plugin's own
@@ -195,7 +233,14 @@ export function apply(ctx, config) {
   // remote URLs. A protocol render also registers its payload with the
   // terminal so paint() can transmit/place it.
   app.onImageRequest = (src) => { void resolveImage(src) }
+  // One render per key and geometry at a time. A resize during a decode asks
+  // again under a new signature; without this the old decode keeps running and
+  // the same image is encoded twice for one frame.
+  const imageRendersInFlight = new Map()
   async function resolveImage(src) {
+    const sig = app.imageRenderSignature()
+    if (imageRendersInFlight.get(src.key) === sig) return
+    imageRendersInFlight.set(src.key, sig)
     try {
       const bytes = await resolveImageBytes(src)
       // cropCells arrives on a source the view re-requested because the
@@ -216,8 +261,10 @@ export function apply(ctx, config) {
       }
     } catch (error) {
       app.setImageResult(src.key, { state: 'error', error: formatError(error) })
+    } finally {
+      if (imageRendersInFlight.get(src.key) === sig) imageRendersInFlight.delete(src.key)
+      paintSoon()
     }
-    paintSoon()
   }
   async function resolveImageBytes(src) {
     if (src.kind === 'bytes') {
@@ -437,7 +484,11 @@ export function apply(ctx, config) {
     }
     paint()
   }
-  term.on('resize', () => paintNow())
+  // Coalesced, not immediate: dragging a window edge fires one resize per
+  // pixel column, and each immediate paint rebuilds the whole screen — and,
+  // since the image renders key on the grid, can queue a re-render per column.
+  // 40ms is below what a resize is perceived at.
+  term.on('resize', () => paintSoon())
   // The language is a live setting. A host that writes it through its own
   // settings surface — or a profile patch edited by hand while the TUI runs —
   // pushes the new value into the volatile Config reference instead of
@@ -1119,6 +1170,157 @@ export function apply(ctx, config) {
     paint()
   }
 
+  // ---- git branch switching (empty page only) ------------------------------
+  // Checking out a branch rewrites the working tree that every session in
+  // this process is rooted in, so the window is offered on the title screen
+  // only. Inside a session both the shortcut and the command answer with a
+  // pointer instead of opening it.
+
+  function gitBranchWindowBlocked() {
+    if (!currentAgent) return false
+    app.showToast(t('git.onlyTitleScreen'), 'warn')
+    paint()
+    return true
+  }
+
+  async function openGitBranchOverlay() {
+    if (gitBranchWindowBlocked()) return
+    let info
+    try {
+      info = await listGitBranches(process.cwd())
+    } catch (error) {
+      app.showToast(t('git.listFailed', { error: formatError(error) }), 'warn')
+      paint()
+      return
+    }
+    app.openGitBranches({
+      cwd: process.cwd(),
+      root: info.root,
+      current: info.current,
+      local: info.local,
+      remote: info.remote,
+    })
+    paint()
+  }
+
+  // Re-read the refs after anything that can change them (a switch, a pull),
+  // so the current marker and the remote set never go stale in an open
+  // window. A failure here is only worth reporting when the refresh is the
+  // action the user asked for — after a successful switch the window keeps
+  // its outcome line instead of being overwritten by a listing error.
+  async function refreshGitBranchList({ reportError = true } = {}) {
+    const picker = app.gitBranches
+    if (!picker) return
+    try {
+      const info = await listGitBranches(picker.cwd)
+      app.setGitBranchList(info)
+    } catch (error) {
+      if (reportError) throw new Error(t('git.listFailed', { error: formatError(error) }))
+    }
+  }
+
+  // The title screen's `git: <branch>` line is resolved once at boot; a
+  // switch has to re-resolve it or the splash keeps naming the old branch.
+  async function refreshTitleGitBranch() {
+    const cwd = process.cwd()
+    let gitBranch = ''
+    try { gitBranch = await gitBranchAt(cwd) } catch { /* the splash omits the line */ }
+    app.setWelcome({ workingDirectory: cwd, gitBranch })
+    paint()
+  }
+
+  // Every window action runs through here so the busy flag, the report reset
+  // and the repaint happen exactly once, whatever the action does. The catch
+  // is a safety net: the actions below already localize their own failures.
+  async function withGitBranchBusy(action) {
+    const picker = app.gitBranches
+    if (!picker || picker.busy) return
+    picker.busy = true
+    picker.error = ''
+    picker.status = ''
+    paint()
+    try {
+      await action()
+    } catch (error) {
+      picker.error = formatError(error)
+    }
+    picker.busy = false
+    paint()
+  }
+
+  async function confirmGitBranch() {
+    const picker = app.gitBranches
+    const row = picker?.items[picker.selected]
+    if (!row || row.kind !== 'branch') return
+    try {
+      const result = await switchGitBranch(picker.cwd, row.ref, { remote: row.remote })
+      await refreshGitBranchList({ reportError: false })
+      picker.status = t('git.switched', { branch: result.branch })
+      void refreshTitleGitBranch()
+    } catch (error) {
+      throw new Error(t('git.switchFailed', { branch: row.ref, error: formatError(error) }))
+    }
+  }
+
+  async function pullGitBranches() {
+    const picker = app.gitBranches
+    try {
+      const result = await pullGitUpdates(picker.cwd)
+      await refreshGitBranchList()
+      picker.status = result.summary || t('git.pullDone')
+    } catch (error) {
+      throw new Error(t('git.pullFailed', { error: formatError(error) }))
+    }
+  }
+
+  function handleGitBranchKey(key) {
+    const picker = app.gitBranches
+    if (!picker) return
+    if (key.ctrl && (key.name === 'c' || key.name === 'd')) {
+      handleCtrlKey(key.name)
+      return
+    }
+    if (picker.busy) return
+    if (key.name === 'escape') {
+      app.closeGitBranches()
+      paint()
+      return
+    }
+    if (key.name === 'return' || key.name === 'enter') {
+      void withGitBranchBusy(confirmGitBranch)
+      return
+    }
+    const letter = String(key.name ?? key.text ?? '').toLowerCase()
+    if (key.name === 'up' || letter === 'k' || (key.ctrl && letter === 'p')) {
+      app.moveGitBranches(-1)
+      paint()
+      return
+    }
+    if (key.name === 'down' || letter === 'j' || (key.ctrl && letter === 'n')) {
+      app.moveGitBranches(1)
+      paint()
+      return
+    }
+    if (key.name === 'pageup') {
+      app.moveGitBranches(-7)
+      paint()
+      return
+    }
+    if (key.name === 'pagedown') {
+      app.moveGitBranches(7)
+      paint()
+      return
+    }
+    if (letter === 'p') {
+      void withGitBranchBusy(pullGitBranches)
+      return
+    }
+    if (letter === 'r') {
+      void withGitBranchBusy(() => refreshGitBranchList())
+      return
+    }
+  }
+
   async function applyRewindChoice(item, mode) {
     if (!currentAgent) throw new Error(t('session.startFirst'))
     if (item?.current || item?.seq == null) {
@@ -1917,8 +2119,67 @@ export function apply(ctx, config) {
     requestClipboardImage()
   }
 
-  async function attachFromText(text) {
-    const trimmed = text.trim()
+  // A paste or clipboard reply that arrived while a dialog is open. The composer
+  // is behind the dialog, so nothing here may reach it: the reply is either the
+  // field being edited or nothing at all.
+  function handleOverlayPaste(key) {
+    if (key.name === 'clipboard') {
+      // An OSC 52 reply answers a read the composer asked for before the dialog
+      // opened. Nothing can use it now, and leaving the flag set would let a
+      // later unsolicited reply be routed to the composer instead.
+      clipboardRequested = false
+      return
+    }
+    if (app.overlay === 'settings') pasteIntoSettingsField(key.data)
+  }
+
+  // The settings rows that hold one line of typed text, so a paste onto the
+  // selected row can open its editor. A choice row is excluded: there is nothing
+  // to paste into a list of options.
+  const PASTEABLE_ROWS = new Set(['text', 'path', 'secret', 'provider-field', 'model-field', 'mcp-field', 'provider-model-add', 'provider-search'])
+
+  function pasteableRow(item) {
+    if (!item || item.disabled === true || item.selectable === false) return false
+    if (Array.isArray(item.options) && item.options.length > 0) return false
+    if (!PASTEABLE_ROWS.has(item.kind)) return false
+    // The Models row on the create form opens a window; it is not a text field.
+    return item.providerModels !== true
+  }
+
+  // Append a paste to the field the settings dialog is editing — or, when no
+  // field is open, open the selected row's editor around the pasted text. That
+  // is what pressing Ctrl+V on a highlighted "Provider API key" row means, and
+  // it beats pasting into a composer the dialog is hiding.
+  //
+  // Everything the dialog edits is one line wide, so `fieldPasteText` folds the
+  // newlines away; an image paste yields nothing, because a text field has no
+  // place to put it and the composer that would have is not on screen.
+  function pasteIntoSettingsField(data) {
+    if (app.settingsEditing !== null) {
+      const open = fieldPasteText(data, { secret: app.settingsSecret })
+      if (open === null) return
+      app.settingsDraft += open
+      // The picker's filter row narrows the list as it is typed; a paste into it
+      // has to land the same way a keystroke does.
+      if (settingsView.kind === 'provider-picker' && app.settingsEditing === 0) rebuildPicker(app.settingsDraft)
+      paint()
+      return
+    }
+    const item = app.settingsItems[app.settingsSelection]
+    if (!pasteableRow(item)) return
+    const secret = item.secret === true || item.kind === 'secret'
+    const text = fieldPasteText(data, { secret })
+    if (text === null) return
+    app.settingsEditing = app.settingsSelection
+    app.settingsSecret = secret
+    // A secret row masks what it shows, so the editor starts from the pasted
+    // value; the row's previous value was never on screen to append to anyway.
+    app.settingsDraft = text
+    if (settingsView.kind === 'provider-picker' && app.settingsEditing === 0) rebuildPicker(app.settingsDraft)
+    paint()
+  }
+
+  async function attachFromText(text) {    const trimmed = text.trim()
     const dataUrl = decodeDataUrl(trimmed)
     if (dataUrl) {
       const detected = detectImageMediaType(dataUrl.data)
@@ -2036,6 +2297,8 @@ export function apply(ctx, config) {
       }
       if (app.overlay === 'rewind') {
         app.moveRewind(direction)
+      } else if (app.overlay === 'git-branches') {
+        app.moveGitBranches(direction)
       } else if (app.overlay === 'settings') {
         // Scroll the settings content window instead of moving focus
         app.scrollSettingsWindow(direction * 3)
@@ -2087,6 +2350,26 @@ export function apply(ctx, config) {
       void confirmRewindPicker()
       return
     }
+    if (app.overlay === 'git-branches') {
+      const region = app.hitTest(mouse.x, mouse.y, ['git-branch-item'])
+      const picker = app.gitBranches
+      if (!region || !picker) {
+        app.closeGitBranches()
+        paint()
+        return
+      }
+      // A click on an unselected row only moves the selection; switching a
+      // branch is the second click on the row that already has it, so a
+      // stray click cannot rewrite the working tree.
+      if (picker.selected === region.branchIndex) {
+        if (!picker.busy) void withGitBranchBusy(confirmGitBranch)
+      } else {
+        picker.selected = region.branchIndex
+        app._clampGitBranchesScroll()
+      }
+      paint()
+      return
+    }
     if (app.pendingQuestions) {
       const option = app.hitTest(mouse.x, mouse.y, ['question-option'])
       if (option) {
@@ -2188,14 +2471,22 @@ export function apply(ctx, config) {
        clipboardRequested = false
        return
      }
-     if (key.name === 'mouse') {
-       handleMouse(key.mouse)
-       return
-     }
-     if (key.name === 'paste') {
-       void handlePaste(key.data)
-       return
-     }
+    if (key.name === 'mouse') {
+      handleMouse(key.mouse)
+      return
+    }
+    // A paste belongs to whatever holds focus. Behind a dialog the composer is
+    // not on screen, so routing there fills a row the user cannot see — one
+    // Enter away from being sent as a message, which is exactly what an API key
+    // must never become. Only the settings dialog has a field to give it to.
+    if (app.overlay !== null && (key.name === 'paste' || key.name === 'clipboard')) {
+      handleOverlayPaste(key)
+      return
+    }
+    if (key.name === 'paste') {
+      void handlePaste(key.data)
+      return
+    }
      if (key.name === 'clipboard') {
        handleClipboard(key.data)
        return
@@ -2287,6 +2578,14 @@ export function apply(ctx, config) {
       handleRewindKey(key)
       return
     }
+    if (app.overlay === 'git-branches') {
+      if (key.ctrl && (key.name === 'c' || key.name === 'd')) {
+        handleCtrlKey(key.name)
+        return
+      }
+      handleGitBranchKey(key)
+      return
+    }
     if (app.overlay === 'settings') {
       handleSettingsKey(key)
       return
@@ -2586,15 +2885,419 @@ export function apply(ctx, config) {
   }
 
   async function refreshSettings(selection = 0) {
-    if (settingsView.kind === 'provider-models') await openProviderModels(settingsView.provider, selection)
+    if (settingsView.kind === 'provider-models') {
+      if (settingsView.draft === true) renderDraftModelWindow(settingsView.selection ?? 0)
+      else await openProviderModels(settingsView.provider, selection)
+    }
     else if (settingsView.kind === 'sessions') await openSessionManager(selection)
     else if (settingsView.kind === 'update') await openSettingsTab('update', selection)
     else if (settingsView.kind === 'model') await openSettingsTab('model', selection)
     else if (settingsView.kind === 'mcp') await openSettingsTab('mcp', selection)
     else if (settingsView.kind === 'mcp-form') renderMcpForm(mcpFormDraft, mcpFormIsEdit, selection)
+    else if (settingsView.kind === 'provider-picker') openProviderPicker(selection, settingsView.query ?? '')
+    else if (settingsView.kind === 'provider-form') renderProviderForm(providerDraft, providerFormMeta, selection)
+    else if (settingsView.kind === 'model-form') renderModelForm(modelDraft, modelFormTarget, selection)
     else await openSettingsTab('main', selection)
   }
 
+  // ---- add-provider flow ---------------------------------------------------
+  // The WebUI's add card, split into the two views a terminal can render: a
+  // picker over the routes still addable (the ones whose profile does not
+  // resolve yet), then a form for the chosen one. The form is a draft — nothing
+  // is written until Save — because a hand-declared route needs several fields
+  // that are only valid together.
+  let providerDraft = null
+  let providerFormMeta = null
+  // The endpoint's answer for the open draft, kept so toggling a model costs no
+  // round trip and the list cannot shift under the cursor.
+  let providerDiscovery = null
+  // The directory the open picker was built from. Kept so typing a filter costs
+  // no settings round trip per keystroke.
+  let pickerDirectory = null
+
+  function openProviderPicker(selection = 0, query = '') {
+    const directory = providerDirectory(ctx)
+    if (!directory) {
+      app.showToast(t('settings.error', { error: t('common.unavailable') }), 'error')
+      void openSettingsTab('model', 0)
+      return
+    }
+    pickerDirectory = directory
+    settingsView = { kind: 'provider-picker', query }
+    app.openSettings(providerPickerItems(directory, { query }), {
+      title: t('provider.add'),
+      subtitle: t('provider.pickSubtitle'),
+    })
+    app.setSettingsSelection(selection)
+    paint()
+  }
+
+  // Narrow the picker as the query is typed. The editor stays on the filter row
+  // (index 0) and the list beneath it is what changes, so the cursor never
+  // leaves the field being typed into. A commit passes `editing: false`: the
+  // commit path has already closed the editor and must not reopen it.
+  function rebuildPicker(query, { editing = true } = {}) {
+    if (!pickerDirectory) return
+    settingsView = { kind: 'provider-picker', query }
+    app.settingsItems = providerPickerItems(pickerDirectory, { query })
+    app.settingsSelection = 0
+    app.settingsScrollOffset = 0
+    if (editing) app.settingsEditing = 0
+  }
+
+  // The query the picker was filtering with, so backing out of a form returns to
+  // the narrowed list rather than to 40 unfiltered routes.
+  function pickerQuery() {
+    return settingsView.kind === 'provider-picker' ? String(settingsView.query ?? '') : ''
+  }
+
+  // The routes already in use, so declaring one cannot shadow an existing
+  // profile (the picker's own rows come from the addable half only).
+  function takenRoutes(directory) {
+    return directory.configured.map((row) => row.entry.provider)
+  }
+
+  function openProviderForm(draft, meta, selection) {
+    const items = buildCreateFormItems(draft, { protocols: meta.protocols, title: meta.title })
+    const start = items.findIndex((item) => item.kind === 'provider-field' && !item.disabled)
+    renderProviderForm(draft, meta, selection ?? Math.max(0, start))
+  }
+
+  // Re-render the form around the same cursor position: a field commit rebuilds
+  // the list (a picked protocol can change which rows exist), and the scroll
+  // offset the view was at has to survive that.
+  function renderProviderForm(draft, meta, selection = app.settingsSelection) {
+    const scroll = app.settingsScrollOffset
+    providerDraft = draft
+    providerFormMeta = meta
+    settingsView = { kind: 'provider-form' }
+    app.openSettings(buildCreateFormItems(draft, { protocols: meta.protocols, title: meta.title }), {
+      title: draft.mode === 'custom' ? t('provider.form.custom') : t('provider.add'),
+      subtitle: t('provider.formSubtitle'),
+    })
+    app.setSettingsSelection(Math.min(selection, Math.max(0, app.settingsItems.length - 1)))
+    app.settingsScrollOffset = scroll
+    paint()
+  }
+
+  // Adopt a route the installed catalog already describes. Its profile inherits
+  // the endpoint, protocol, and model catalog, so the form only offers the
+  // fields a user actually overrides.
+  function openCatalogProviderForm(providerId) {
+    const directory = providerDirectory(ctx)
+    const row = directory?.addable.find((candidate) => candidate.entry.provider === providerId)
+    if (!directory || !row) {
+      app.showToast(t('model.providerUnavailable'), 'error')
+      openProviderPicker(0)
+      return
+    }
+    // No protocol is preset: a catalog route keeps the one its own catalog
+    // entry names, and forcing the adapter's first choice here would override
+    // it (anthropic would be served over an OpenAI-shaped client).
+    const draft = createDraft('catalog', providerId)
+    openProviderForm(draft, {
+      settingsNs: row.entry.settingsNs,
+      revision: row.descriptor.revision,
+      protocols: protocolChoices(row.descriptor),
+      title: row.entry.displayName,
+      taken: takenRoutes(directory),
+      from: 'picker',
+      query: pickerQuery(),
+    })
+  }
+
+  // Declare a route the catalog does not ship: endpoint, protocol, and models
+  // are the three fields nothing else can supply.
+  function openCustomProviderForm() {
+    const directory = providerDirectory(ctx)
+    const target = directory ? declareNamespace(directory) : undefined
+    if (!directory || !target) {
+      app.showToast(t('model.namespaceUnavailable'), 'error')
+      openProviderPicker(0)
+      return
+    }
+    const draft = createDraft('custom')
+    draft.api = target.protocols[0] ?? ''
+    openProviderForm(draft, {
+      settingsNs: target.settingsNs,
+      revision: target.revision,
+      protocols: target.protocols,
+      from: 'picker',
+      query: pickerQuery(),
+      taken: takenRoutes(directory),
+    })
+  }
+
+  function commitProviderField(item, value, selection) {
+    const draft = { ...providerDraft }
+    if (item.field === 'addModel') {
+      const id = value.trim()
+      if (id !== '' && !draft.models.some((model) => modelEntryId(model) === id)) draft.models = [...draft.models, { id }]
+    } else if (item.field === 'key') {
+      draft.key = value.trim()
+    } else {
+      draft[item.field] = value.trim()
+      // The route id is a settings key the user has not thought about yet; the
+      // display name is the one they have. Filling it from the name is visible
+      // (the row repaints with it) and only ever happens while it is empty.
+      if (item.field === 'displayName' && draft.mode === 'custom' && !draft.route) {
+        const derived = deriveRoute(value)
+        if (derived !== '') draft.route = derived
+      }
+    }
+    renderProviderForm(draft, providerFormMeta, selection)
+  }
+
+  async function saveProviderForm() {
+    const draft = providerDraft
+    const meta = providerFormMeta
+    if (!draft || !meta) return
+    const failure = validateCreateDraft(draft, { taken: meta.taken })
+    if (failure !== undefined) {
+      app.showToast(t('settings.error', { error: failure }), 'error')
+      paint()
+      return
+    }
+    try {
+      await saveCreateDraft(ctx, sharedSettings, draft, { settingsNs: meta.settingsNs, revision: meta.revision })
+      providerDraft = null
+      providerFormMeta = null
+      providerDiscovery = null
+      app.showToast(t('provider.added'), 'info')
+      await openSettingsTab('model')
+    } catch (error) {
+      const conflict = error?.code === 'SETTINGS_CONFLICT'
+      if (conflict) {
+        // The revision this form opened at no longer matches, so a retry would
+        // be refused forever. Take the revision the namespace stands at now:
+        // the profile write is a single path op, which is safe to repeat.
+        const fresh = providerDirectory(ctx)?.descriptors.get(meta.settingsNs)
+        if (fresh) providerFormMeta = { ...meta, revision: fresh.revision }
+      }
+      app.showToast(t('settings.error', { error: conflict ? t('settings.conflict') : formatError(error) }), 'error')
+      paint()
+    }
+  }
+
+  // The model window for an unsaved draft: the same rows the saved-provider
+  // window shows, but a toggle edits the draft instead of storing anything.
+  async function openDraftModelWindow(selection = 0) {
+    const draft = providerDraft
+    const meta = providerFormMeta
+    if (!draft || !meta) return
+    const version = ++settingsLoadVersion
+    settingsView = { kind: 'provider-models', draft: true, parentSelection: app.settingsSelection, selection }
+    app.openSettings([{ label: t('model.fetching'), value: '', disabled: true }], {
+      title: (meta.title ?? draft.route) + ' · ' + t('model.models').toLowerCase(),
+      subtitle: t('model.autoFetching'),
+    })
+    paint()
+    let answer
+    try {
+      answer = await discoverDraftModels(ctx, draft, { settingsNs: meta.settingsNs, providerId: draft.route })
+    } catch (error) {
+      answer = { models: [], failed: true, error: formatError(error) }
+    }
+    if (version !== settingsLoadVersion || settingsView.kind !== 'provider-models' || settingsView.draft !== true) return
+    providerDiscovery = { models: answer.models, failed: answer.failed, error: answer.error }
+    // A fetch that lands is a selection — for a hand-declared route, whose
+    // profile has no catalog to inherit. A catalog route is deliberately left
+    // unselected: an empty `models` means "serve the catalog", which keeps
+    // working after the adapter updates it, while a copied list freezes today's.
+    // Nothing is written until Save provider; the select-all row adds them all.
+    if (providerDraft.mode === 'custom' && answer.models.length > 0 && providerDraft.models.length === 0) {
+      providerDraft = { ...providerDraft, models: mergeModelSelection([], answer.models) }
+    }
+    renderDraftModelWindow(selection)
+  }
+
+  function renderDraftModelWindow(selection = app.settingsSelection) {
+    const draft = providerDraft
+    const meta = providerFormMeta
+    if (!draft || !meta) return
+    const discovered = providerDiscovery ?? { models: [], failed: true }
+    settingsView = { kind: 'provider-models', draft: true, parentSelection: settingsView.parentSelection ?? 0, selection }
+    app.openSettings(draftModelItems(draft, discovered.models, {
+      failed: discovered.failed,
+      error: discovered.error,
+      providerId: draft.route,
+    }), {
+      title: (meta.title ?? draft.route) + ' · ' + t('model.models').toLowerCase(),
+      subtitle: (discovered.failed ? t('model.fetchUnavailable') : t('model.fetchOk')) + ' · ' + t('model.editHint'),
+    })
+    app.setSettingsSelection(Math.min(selection, Math.max(0, app.settingsItems.length - 1)))
+    paint()
+  }
+
+  function toggleDraftModel(item) {
+    const draft = { ...providerDraft }
+    if (item.checked) {
+      draft.models = draft.models.filter((model) => modelEntryId(model) !== item.modelId)
+    } else {
+      const discovered = providerDiscovery?.models?.find((model) => modelEntryId(model) === item.modelId)
+      const row = discovered ? adoptDiscovered(discovered) : undefined
+      draft.models = [...draft.models, row ?? { id: item.modelId }]
+    }
+    providerDraft = draft
+    const rows = draftModelItems(draft, providerDiscovery?.models ?? [], {
+      failed: providerDiscovery?.failed === true,
+      error: providerDiscovery?.error,
+      providerId: draft.route,
+    })
+    // Keep the cursor on the row that was just toggled.
+    const at = rows.findIndex((candidate) => candidate.modelId === item.modelId)
+    renderDraftModelWindow(at >= 0 ? at : 0)
+  }
+
+  // ---- one model's entry ---------------------------------------------------
+  // The WebUI's ModelListEditor edits a row's id, capacities and input
+  // modalities in place; a terminal has one row of each, so the same fields live
+  // in a form of their own. `target.kind` decides where a save lands: the
+  // provider's saved list, or the create form's unsaved draft.
+  let modelDraft = null
+  let modelFormTarget = null
+
+  function openModelForm(target, draft, selection = 0) {
+    modelDraft = draft
+    modelFormTarget = target
+    renderModelForm(draft, target, selection)
+  }
+
+  function renderModelForm(draft, target, selection = app.settingsSelection) {
+    const scroll = app.settingsScrollOffset
+    modelDraft = draft
+    modelFormTarget = target
+    settingsView = { kind: 'model-form' }
+    app.openSettings(buildModelFormItems(draft, { isNew: target.index < 0 }), {
+      title: target.index < 0 ? t('model.form.add') : t('model.edit'),
+      subtitle: t('provider.formSubtitle'),
+    })
+    app.setSettingsSelection(Math.min(selection, Math.max(0, app.settingsItems.length - 1)))
+    app.settingsScrollOffset = scroll
+    paint()
+  }
+
+  function commitModelField(item, value, selection) {
+    const draft = { ...modelDraft }
+    if (item.field === 'input') {
+      draft.input = String(value).trim() === 'text + image' ? ['text', 'image'] : ['text']
+    } else {
+      draft[item.field] = value
+    }
+    renderModelForm(draft, modelFormTarget, selection)
+  }
+
+  // Open the editor for one row of the model window. A row that is not saved
+  // yet opens in create mode, prefilled with what the endpoint advertised — so
+  // "add this model, but with the capacities I know it has" is one pass.
+  function editModelRow(item) {
+    if (settingsView.kind === 'provider-models' && settingsView.draft === true) {
+      const index = providerDraft.models.findIndex((model) => modelEntryId(model) === item.modelId)
+      const discovered = providerDiscovery?.models?.find((model) => modelEntryId(model) === item.modelId)
+      const seed = index >= 0 ? providerDraft.models[index] : adoptDiscovered(discovered) ?? { id: item.modelId }
+      openModelForm({ kind: 'draft', index, providerId: providerDraft.route }, modelDraftFrom(seed), 0)
+      return
+    }
+    const target = {
+      kind: 'stored',
+      settingsNs: item.settingsNs,
+      providerPath: item.providerPath,
+      storedModels: item.storedModels ?? [],
+      revision: item.revision,
+      index: typeof item.storedIndex === 'number' ? item.storedIndex : -1,
+      providerId: item.providerId,
+    }
+    const seed = target.index >= 0 ? target.storedModels[target.index] : adoptDiscovered(item.candidate) ?? { id: item.modelId }
+    openModelForm(target, modelDraftFrom(seed), 0)
+  }
+
+  // Back to the window the editor was opened from, re-reading the provider so
+  // the rows reflect what was just written.
+  async function returnToModelWindow(target) {
+    if (!target) return
+    if (target.kind === 'draft') {
+      renderDraftModelWindow(0)
+      return
+    }
+    await openProviderModels(target.providerId, 0)
+  }
+
+  async function saveModelForm() {
+    const draft = modelDraft
+    const target = modelFormTarget
+    if (!draft || !target) return
+    const existing = target.kind === 'draft'
+      ? providerDraft.models.filter((_model, at) => at !== target.index)
+      : target.storedModels.filter((_model, at) => at !== target.index)
+    const failure = validateModelDraft(draft, { existing })
+    if (failure !== undefined) {
+      app.showToast(t('settings.error', { error: failure }), 'error')
+      paint()
+      return
+    }
+    try {
+      if (target.kind === 'draft') {
+        const entry = modelFromDraft(draft)
+        const next = [...providerDraft.models]
+        if (target.index >= 0) next[target.index] = entry
+        else next.push(entry)
+        providerDraft = { ...providerDraft, models: next }
+        app.showToast(t('settings.saved'))
+        await returnToModelWindow(target)
+        return
+      }
+      await saveModelEntry(sharedSettings, target, draft)
+      app.showToast(t('settings.saved'))
+      await returnToModelWindow(target)
+    } catch (error) {
+      const conflict = error?.code === 'SETTINGS_CONFLICT'
+      app.showToast(t('settings.error', { error: conflict ? t('settings.conflict') : formatError(error) }), 'error')
+      paint()
+    }
+  }
+
+  async function removeModelForm() {
+    const target = modelFormTarget
+    if (!target || target.index < 0) return
+    try {
+      if (target.kind === 'draft') {
+        providerDraft = { ...providerDraft, models: providerDraft.models.filter((_model, at) => at !== target.index) }
+      } else {
+        await removeModelEntry(sharedSettings, target)
+      }
+      app.showToast(t('model.removed'), 'info')
+      await returnToModelWindow(target)
+    } catch (error) {
+      app.showToast(t('settings.error', { error: formatError(error) }), 'error')
+      paint()
+    }
+  }
+
+  // Delete inside the model window: same writes as the editor's remove action,
+  // without opening it first.
+  async function removeModelInWindow({ item, draft }) {
+    if (draft === true) {
+      providerDraft = { ...providerDraft, models: providerDraft.models.filter((model) => modelEntryId(model) !== item.modelId) }
+      app.showToast(t('model.removed'), 'info')
+      renderDraftModelWindow(Math.max(0, app.settingsSelection - 1))
+      return
+    }
+    try {
+      await removeModelEntry(sharedSettings, {
+        settingsNs: item.settingsNs,
+        providerPath: item.providerPath,
+        storedModels: item.storedModels ?? [],
+        revision: item.revision,
+        index: item.storedIndex,
+      })
+      app.showToast(t('model.removed'), 'info')
+      await openProviderModels(item.providerId, Math.max(0, app.settingsSelection - 1))
+    } catch (error) {
+      app.showToast(t('settings.error', { error: formatError(error) }), 'error')
+      paint()
+    }
+  }
+
   // ---- MCP settings tab ----------------------------------------------------
   // The config files are re-read for every render, so a server added, edited or
   // removed by another process — or by the model through the bundled skill
@@ -3071,9 +3774,31 @@ export function apply(ctx, config) {
       paint()
       return
     }
-    // Delete on a server row uninstalls it without opening the form first.
-    if (settingsView.kind === 'mcp' && (key.name === 'delete' || key.name === 'backspace')) {
+    // The model window is a list of entries, not of settings fields: `e` opens
+    // the highlighted one's editor and Delete drops it from the provider. Both
+    // act on the entry, which is why they are keys of their own rather than
+    // extra rows in a list that is already rows of models.
+    if (settingsView.kind === 'provider-models') {
       const item = app.settingsItems[app.settingsSelection]
+      if (item?.kind === 'model-toggle' && (key.name === 'e' || key.text === 'e')) {
+        editModelRow(item)
+        return
+      }
+      if (item?.kind === 'model-toggle' && (key.name === 'delete' || key.name === 'backspace')) {
+        if (settingsView.draft === true) {
+          app.settingsConfirm = { item, value: '', text: t('model.form.removeConfirm'), removeModel: { item, draft: true } }
+        } else if (typeof item.storedIndex === 'number' && item.storedIndex >= 0) {
+          app.settingsConfirm = { item, value: '', text: t('model.form.removeConfirm'), removeModel: { item, draft: false } }
+        } else {
+          // Nothing stored to remove: the row is an offer, not a saved entry.
+          app.showToast(t('model.notSaved'), 'warn')
+        }
+        paint()
+        return
+      }
+    }
+    // Delete on a server row uninstalls it without opening the form first.
+    if (settingsView.kind === 'mcp' && (key.name === 'delete' || key.name === 'backspace')) {      const item = app.settingsItems[app.settingsSelection]
       if (item?.kind === 'mcp-server' && item.record?.name) {
         if (app.settingsConfirm?.item === item) {
           app.settingsConfirm = null
@@ -3113,7 +3838,9 @@ export function apply(ctx, config) {
         }
       } else if (key.name === 'y' || key.text?.toLowerCase() === 'y' || key.name === 'return' || key.name === 'enter') {
         app.settingsConfirm = null
-        if (pending.updateInstall) void startUpdateInstall(pending.updateInstall.pkg, pending.updateInstall.version)
+        if (pending.removeModel?.form === true) void removeModelForm()
+        else if (pending.removeModel) void removeModelInWindow(pending.removeModel)
+        else if (pending.updateInstall) void startUpdateInstall(pending.updateInstall.pkg, pending.updateInstall.version)
         else if (pending.updateRestart) void restartToApply(pending.updateRestart)
         else void commitSetting(pending.value, pending.commitItem ?? pending.item)
       } else if (key.name === 'n' || key.text?.toLowerCase() === 'n' || key.name === 'escape') {
@@ -3136,6 +3863,9 @@ export function apply(ctx, config) {
       } else if (key.text !== undefined && !key.ctrl && !key.alt) {
         app.settingsDraft += key.text
       }
+      // Typing into the picker's filter narrows the list under it immediately —
+      // a 40-route catalog is only scannable if the filter bites per keystroke.
+      if (settingsView.kind === 'provider-picker' && app.settingsEditing === 0) rebuildPicker(app.settingsDraft)
       paint()
       return
     }
@@ -3144,9 +3874,35 @@ export function apply(ctx, config) {
       if (settingsView.kind === 'choice' && settingsView.parent === 'mcp-form') {
         // Backing out of the transport/enabled list keeps the half-filled form.
         renderMcpForm(mcpFormDraft, mcpFormIsEdit, settingsView.parentSelection)
+      } else       if (settingsView.kind === 'choice' && settingsView.parent === 'provider-form') {
+        // Same for a protocol pick inside the add-provider form.
+        renderProviderForm(providerDraft, providerFormMeta, settingsView.parentSelection)
+      } else if (settingsView.kind === 'choice' && settingsView.parent === 'model-form') {
+        // ...and for the input-modalities pick inside the model editor.
+        renderModelForm(modelDraft, modelFormTarget, settingsView.parentSelection)
       } else if (settingsView.kind === 'choice') void openSettingsTab(settingsView.parent, settingsView.parentSelection)
       else if (settingsView.kind === 'mcp-form') void openSettingsTab('mcp', menuSelections.mcp ?? 0)
-      else if (settingsView.kind === 'provider-models') void openSettingsTab('model', settingsView.parentSelection ?? 0)
+      else if (settingsView.kind === 'model-form') {
+        // Esc drops the edit and returns to the row list, which is where the
+        // user came from.
+        modelDraft = null
+        void returnToModelWindow(modelFormTarget)
+      } else if (settingsView.kind === 'provider-models' && settingsView.draft === true) {
+        // The unsaved draft's model window belongs to the form, not the tab.
+        renderProviderForm(providerDraft, providerFormMeta, settingsView.parentSelection ?? 0)
+      } else if (settingsView.kind === 'provider-models') void openSettingsTab('model', settingsView.parentSelection ?? 0)
+      else if (settingsView.kind === 'provider-form') {
+        // Esc drops the draft. A draft that came from the picker goes back
+        // there (another route is one Enter away, and its filter is kept); one
+        // opened from the Model tab goes back to the tab.
+        const fromPicker = providerFormMeta?.from === 'picker'
+        const query = providerFormMeta?.query ?? ''
+        providerDraft = null
+        providerFormMeta = null
+        providerDiscovery = null
+        if (fromPicker) openProviderPicker(0, query)
+        else void openSettingsTab('model')
+      } else if (settingsView.kind === 'provider-picker') void openSettingsTab('model')
       else if (settingsView.kind === 'sessions') void openSettingsTab('main')
       else if (settingsView.kind === 'update-versions') void openSettingsTab('update', settingsView.parentSelection ?? 0)
       else if (settingsView.kind === 'update-download') {
@@ -3240,6 +3996,78 @@ export function apply(ctx, config) {
         void commitSetting(item.optionValue, item.settingItem)
         return
       }
+      if (item.kind === 'provider-add') {
+        openProviderPicker(0)
+        return
+      }
+      if (item.kind === 'provider-pick') {
+        openCatalogProviderForm(item.providerId)
+        return
+      }
+      if (item.kind === 'provider-pick-custom') {
+        openCustomProviderForm()
+        return
+      }
+      if (item.kind === 'provider-save') {
+        void saveProviderForm()
+        return
+      }
+      if (item.kind === 'provider-search') {
+        // The filter row is a normal text edit; `rebuildPicker` narrows the list
+        // under it as each character lands.
+        app.settingsEditing = app.settingsSelection
+        app.settingsSecret = false
+        app.settingsDraft = String(settingsView.query ?? '')
+        paint()
+        return
+      }
+      if (item.kind === 'model-select-all') {
+        if (settingsView.kind === 'provider-models' && settingsView.draft === true) {
+          // The draft holds no selection yet, so "all" is exactly the endpoint's
+          // answer; "none" clears what the fetch pre-picked.
+          const draft = { ...providerDraft }
+          draft.models = item.allPicked ? [] : mergeModelSelection([], providerDiscovery?.models ?? [])
+          providerDraft = draft
+          renderDraftModelWindow(0)
+        } else {
+          // The saved window writes through: one mutate for the whole list.
+          void commitSetting(item.allPicked ? 'off' : 'on', item)
+        }
+        return
+      }
+      if (item.kind === 'model-add') {
+        openModelForm({
+          kind: settingsView.draft === true ? 'draft' : 'stored',
+          providerId: item.providerId,
+          settingsNs: item.settingsNs,
+          providerPath: item.providerPath,
+          storedModels: settingsView.draft === true ? providerDraft.models : (item.storedModels ?? []),
+          revision: item.revision,
+          index: -1,
+        }, modelDraftFrom({ id: '' }), 0)
+        return
+      }
+      if (item.kind === 'model-refresh') {
+        // Ask the endpoint again — the reason a catalog can be empty the first
+        // time is usually that it was not reachable yet.
+        if (settingsView.kind === 'provider-models' && settingsView.draft === true) void openDraftModelWindow(0)
+        else void openProviderModels(item.providerId, 0)
+        return
+      }
+      if (item.kind === 'model-save') {
+        void saveModelForm()
+        return
+      }
+      if (item.kind === 'model-remove') {
+        if (app.settingsConfirm?.item === item) {
+          app.settingsConfirm = null
+          void removeModelForm()
+        } else {
+          app.settingsConfirm = { item, value: '', text: item.confirmText ?? t('model.form.removeConfirm'), removeModel: { form: true } }
+        }
+        paint()
+        return
+      }
       if (item.kind === 'provider-models') {
         // Auto-fetch the provider's model catalog and open the selection
         // window.
@@ -3252,7 +4080,37 @@ export function apply(ctx, config) {
         return
       }
       if (item.kind === 'model-toggle') {
-        void commitSetting(item.checked ? 'off' : 'on', item)
+        // A toggle in the unsaved draft's window edits the draft; one in the
+        // saved provider's window writes straight through.
+        if (settingsView.kind === 'provider-models' && settingsView.draft === true) toggleDraftModel(item)
+        else void commitSetting(item.checked ? 'off' : 'on', item)
+        return
+      }
+      // The add-provider form is a draft like the MCP form: a field commit lands
+      // in the draft and re-renders, and only Save writes.
+      if (settingsView.kind === 'provider-form' && item.kind === 'provider-field') {
+        if (item.providerModels === true) {
+          void openDraftModelWindow(0)
+          return
+        }
+        if (!item.disabled && item.options?.length > 0) openSettingChoices(item, app.settingsSelection)
+        else if (!item.disabled) {
+          app.settingsEditing = app.settingsSelection
+          app.settingsSecret = item.secret === true
+          app.settingsDraft = item.secret === true ? '' : String(item.value ?? '')
+        }
+        paint()
+        return
+      }
+      // The model editor is the same shape of draft.
+      if (settingsView.kind === 'model-form' && item.kind === 'model-field') {
+        if (!item.disabled && item.options?.length > 0) openSettingChoices(item, app.settingsSelection)
+        else if (!item.disabled) {
+          app.settingsEditing = app.settingsSelection
+          app.settingsSecret = false
+          app.settingsDraft = String(item.value ?? '')
+        }
+        paint()
         return
       }
       // Every choice item opens its option list - there is no inline
@@ -3300,6 +4158,23 @@ export function apply(ctx, config) {
       paint()
       return
     }
+    // The add-provider form holds a draft, so its fields commit there and only
+    // "Save provider" reaches the settings service.
+    if (settingsView.kind === 'provider-form' && item?.kind === 'provider-field') {
+      commitProviderField(item, value, selection)
+      return
+    }
+    // The picker's filter row writes nothing either: it narrows the list it sits
+    // above, and the query is kept on the view.
+    if (settingsView.kind === 'provider-picker' && item?.kind === 'provider-search') {
+      rebuildPicker(value, { editing: false })
+      paint()
+      return
+    }
+    if (settingsView.kind === 'model-form' && item?.kind === 'model-field') {
+      commitModelField(item, value, selection)
+      return
+    }
     if (!sharedSettings || !item || (value.trim() === '' && !['path', 'enable-provider', 'remove-provider'].includes(item.kind))) {
       paint()
       return
@@ -3377,6 +4252,7 @@ export function apply(ctx, config) {
         break
       }
       case 'p': openSettings(); break
+      case 'g': void openGitBranchOverlay(); break
       case 'd': quit(); break
       case 'n': {
         void showTitleScreen()
@@ -3690,6 +4566,12 @@ export function apply(ctx, config) {
         })()
         break
       }
+      case 'branch': {
+        // The window is the title screen's; inside a session the call answers
+        // with the same toast the Ctrl+G shortcut does, and opens nothing.
+        void openGitBranchOverlay()
+        break
+      }
       default:
         feedback(t('session.unknownCommand', { name: parsed.name }), 'warn')
     }
@@ -3908,6 +4790,9 @@ export function apply(ctx, config) {
   ctx.effect(() => {
     const restore = () => {
       term.stop()
+      // After the alt screen is released: the process streams go back to the
+      // host, and whatever was diverted is replayed where it can be read.
+      diagnostics.restore()
     }
     const onExit = () => restore()
     const onSigint = () => handleCtrlKey('c')