dsh-ssh-tui 0.7.1 → 0.7.3

package/lib/types/color-depth.d.ts

@@ -18,10 +18,10 @@ export type ColorDepth = 'truecolor' | '256' | '8' | 'none';
  * Decide the palette from the environment.
  *
  * `DSH_TUI_COLOR_DEPTH` wins outright so a user can correct a wrong guess.
- * Otherwise: no colour at all when `NO_COLOR` is set or `TERM` names a
- * monochrome terminal; truecolor when `COLORTERM` says so; 256 for a
+ * Otherwise: no colour at all when `NO_COLOR` is set or `TERM` is `dumb`
+ * (or empty on POSIX); truecolor when `COLORTERM` says so; 256 for a
  * `*256color` terminal and for tmux/screen (their default palette is 256 and
- * they translate truecolor poorly); 8 for everything else.
+ * they translate truecolor poorly); 8 for Linux/VT consoles and everything else.
  * @param env - the environment to read (tests pass their own).
  * @returns the palette to paint with.
  */

package/lib/types/diag.d.ts

@@ -21,6 +21,24 @@ export interface DiagSnapshot {
     hostVersion: string;
     nodeVersion: string;
     platform: string;
+    /**
+     * Which terminal we classified, and the capabilities we then claimed. A
+     * Windows report that says "the mouse does nothing" or "copy did nothing" is
+     * otherwise guesswork: conhost and Windows Terminal look identical from the
+     * transcript, and the claimed flags are what the TUI actually acted on.
+     */
+    terminal?: {
+        family: string;
+        label: string;
+        mouse: boolean;
+        bracketedPaste: boolean;
+        alternateScreen: boolean;
+        osc52: boolean;
+        osc8: boolean;
+        title: boolean;
+        /** `DSH_TUI_TERM_CAPS` tokens that were rejected (typos), for the row. */
+        ignoredOverrides: readonly string[];
+    };
     /**
      * What the palette resolved to and which hints decided it. A "no colour on
      * Windows" report is otherwise guesswork: `TERM` is unset there by default.
@@ -72,7 +90,6 @@ export declare function readErrTail(sessionId: string, dshHome?: string): Promis
  * The first entry is the actionable one; the rest is supporting context.
  */
 export declare function diagVerdicts(snapshot: DiagSnapshot): string[];
-/** The whole report as transcript lines. Pure. */
 export declare function formatDiag(snapshot: DiagSnapshot): string[];
 /** Gather everything the report needs. Every probe is best-effort. */
 export declare function collectDiag(options: {

package/lib/types/dialogs.d.ts

@@ -51,6 +51,10 @@ export interface InspectDialog {
     title: string;
     lines: DiffDisplayLine[];
     offset: number;
+    /** Child session whose live log should refresh this overlay in place. */
+    subagentSessionId?: string;
+    /** `/find` already scrolled to its hit here; later repaints keep the offset. */
+    searchRevealed?: boolean;
 }
 export type Dialog = ConfirmDialog | QuestionDialog | OnboardingDialog | InspectDialog;
 export interface DialogAnswer {

package/lib/types/display-sock.d.ts

@@ -33,12 +33,36 @@ export declare function resolveDshHome(env?: NodeJS.ProcessEnv, home?: string):
 export declare function sessionSockDir(dshHome?: string): string;
 /** Filesystem/pipe-safe form of a session id, as used for locks and channels. */
 export declare function safeSessionId(sessionId: string): string;
+/**
+ * Readable, collision-free short label for one session: a sanitized head plus a
+ * digest of the raw id. The digest is always appended because sanitizing alone
+ * collapses distinct ids (`foo/bar` and `foo_bar`, `abc` and `abc.`) into one
+ * name. On Windows the pipe namespace is machine-wide; on POSIX the same
+ * collapse would share a socket file and a lock, so a relay could attach to
+ * the wrong session.
+ */
+export declare function sessionLabel(sessionId: string, maxLength: number): string;
 /**
  * Address of the per-session display channel: a filesystem path on POSIX, a
  * named pipe on Windows. `platform` is injectable so the Windows shape stays
  * testable from a POSIX test run.
  */
 export declare function sessionSockPath(sessionId: string, dshHome?: string, platform?: NodeJS.Platform): string;
+/**
+ * Pre-digest POSIX socket path (`tui-socks/<safeId>.sock`).
+ *
+ * 0.7.1 Hosts still listen here. A newer build's attach must find that channel
+ * instead of spawning a second Host that dies on the session write handle.
+ * Distinct ids that collapsed under sanitizing (`foo/bar` vs `foo_bar`)
+ * share this name — that is why the digest form exists — so a leftover
+ * file is only an attach target, never the path a new Host binds.
+ */
+export declare function legacySessionSockPath(sessionId: string, dshHome?: string, platform?: NodeJS.Platform): string | undefined;
+/**
+ * Channel a leftover Host may still be listening on: the digested path first,
+ * then the 0.7.1 name when it is different.
+ */
+export declare function sessionSockLookupPaths(sessionId: string, dshHome?: string, platform?: NodeJS.Platform): string[];
 /**
  * Host stderr log for one session. POSIX keeps the historical `<sock>.err`
  * next to the socket; a Windows pipe name is not a file path, so the log lives
@@ -47,6 +71,16 @@ export declare function sessionSockPath(sessionId: string, dshHome?: string, pla
  * device names (`CON`, `NUL`, …) from becoming the file stem.
  */
 export declare function sessionErrPath(sessionId: string, dshHome?: string, platform?: NodeJS.Platform): string;
+/**
+ * Where the hidden-console bootstrap writes the Host's pid.
+ *
+ * On `\\.\pipe\` Windows there is no socket file to derive a name from, and the
+ * state directory already holds the per-session lock and stderr log, so the pid
+ * file lives beside them. It is removed as soon as it has been read.
+ */
+export declare function sessionBootstrapPidPath(sessionId: string, dshHome?: string): string;
+/** Pre-digest Host stderr log next to the 0.7.1 socket, when that name differs. */
+export declare function legacySessionErrPath(sessionId: string, dshHome?: string, platform?: NodeJS.Platform): string | undefined;
 export declare function encodeFrame(type: number, payload?: Buffer): Buffer;
 export declare function encodeResize(columns: number, rows: number): Buffer;
 export declare function decodeResize(payload: Buffer): {
@@ -115,6 +149,8 @@ export interface HostExitWatch {
     /** Stop watching; call once the channel is confirmed up. */
     dispose(): void;
 }
+/** Exported for the test that pins its loop-ref behaviour; not public API. */
+export declare function watchHostPid(pid: number): HostExitWatch;
 /**
  * How long a dead-pid report waits for the child's `exit` event before giving
  * up on its code. The event is normally delivered within a tick; the bound only
@@ -165,8 +201,64 @@ export declare function quietTerminalInput(stdin?: NodeJS.ReadStream): number;
  * written into a link that may already be dead.
  */
 export declare function restoreTerminalInput(stdin?: NodeJS.ReadStream): void;
-/** Spawn a detached Host copy of this `dsh` invocation and return its sock path. */
-export declare function spawnDetachedHost(sessionId: string): SpawnedHost;
+/** Test seam for {@link spawnDetachedHost}; production passes nothing. */
+export interface SpawnHostOptions {
+    /**
+     * Start the Host through this command instead of resolving the real one, or
+     * `null` to spawn it directly even where a bootstrap exists.
+     *
+     * `null` is for the tests that are about the *direct* path — the fixture Hosts
+     * in `tests/display-host-e2e.test.mjs` assert on the child's exit code, which
+     * only a real child handle can report (a pid watch resolves `null`). The
+     * bootstrap has its own coverage: the builders on every platform, and the real
+     * Windows probes end to end.
+     */
+    bootstrap?: {
+        command: string;
+        args: string[];
+    } | null | undefined;
+    /** How long the bootstrap may take to report a pid (Windows PowerShell start). */
+    bootstrapTimeoutMs?: number;
+}
+/**
+ * Start the Host through the hidden-console bootstrap and return its pid, or
+ * `undefined` when the bootstrap could not report one.
+ *
+ * `spawnSync` on purpose. The pid has to be in hand before this function
+ * returns (the caller watches it, and the fallback must never leave two Hosts
+ * for one session), and the cost is one bounded wait while the boot splash is
+ * already on screen. PowerShell exits as soon as `Start-Process` has created the
+ * Host, so the wait is its own start-up, not the Host's.
+ *
+ * Falling back is safe exactly when nothing was printed: `Start-Process -PassThru`
+ * either starts the Host and prints its id, or throws before starting anything
+ * (`$ErrorActionPreference = 'Stop'`). A *timeout* is the one case where a Host
+ * might exist and the pid was lost, so it does not fall back — it reports.
+ */
+export declare function spawnHostThroughBootstrap(bootstrap: {
+    command: string;
+    args: string[];
+}, options: {
+    env: NodeJS.ProcessEnv;
+    platform: NodeJS.Platform;
+    timeoutMs: number;
+    /** File the bootstrap writes the Host's pid to. */
+    pidFile: string;
+}): {
+    pid: number;
+} | undefined;
+/**
+ * Spawn a detached Host copy of this `dsh` invocation and return its sock path.
+ *
+ * On Windows the Host goes through {@link hostBootstrapCommand} when the OS
+ * PowerShell is available: a direct spawn there cannot both survive the
+ * launcher (libuv's `KILL_ON_JOB_CLOSE` job takes a non-detached child with it)
+ * and avoid flashing console windows (`detached` is DETACHED_PROCESS, which makes
+ * Windows ignore `CREATE_NO_WINDOW`). The bootstrap gives the Host a console of
+ * its own, hidden — see `docs/platform.md`. Without it, the direct spawn below
+ * is still what runs, with the old semantics.
+ */
+export declare function spawnDetachedHost(sessionId: string, platform?: NodeJS.Platform, options?: SpawnHostOptions): SpawnedHost;
 export declare function probeDisplaySock(path: string, timeoutMs?: number): Promise<boolean>;
 export interface RelayResult {
     /** Host sent goodbye — user exited from the attached session. */

package/lib/types/doctor.d.ts

@@ -14,7 +14,7 @@
  * `collectDoctor` and every probe is best-effort. Nothing leaves the machine.
  * @module dsh-ssh-tui/doctor
  */
-import { type PatchAnalysis, type PatchRowRef, type RosterRow } from './preset-rows.js';
+import { type HostGeneration, type PatchAnalysis, type PatchRowRef, type RosterRow } from './preset-rows.js';
 export type DoctorStatus = 'ok' | 'warn' | 'fail';
 export interface DoctorCheck {
     id: string;
@@ -64,6 +64,12 @@ export interface DoctorFacts {
         range?: string;
         releases: Record<string, string>;
     };
+    /**
+     * Which settings protocol the host speaks; decides which rows a terminal
+     * profile has to mount itself. Absent means the 0.1.5 line, so a snapshot
+     * built before this field existed keeps its verdicts.
+     */
+    generation?: HostGeneration;
     /** Distinct installs of `@deepseek-ai/dsh-scope` found from the anchors. */
     scopeCopies: readonly string[];
     /** Absent when routing could not be read (no settings service). */
@@ -101,6 +107,7 @@ export declare function collectDoctor(options: {
     services: DoctorFacts['services'];
     anchors: ReadonlyArray<string | undefined>;
     routing?: DoctorRouting;
+    generation?: HostGeneration;
 }): Promise<DoctorFacts>;
 /** Rows `/doctor --fix` would mount, given the services the composition registered. */
 export declare function rowsToRepair(facts: DoctorFacts): RosterRow[];

package/lib/types/dsh-compat.d.ts

@@ -1,35 +1,136 @@
 /**
- * Dual-stack shims for dsh 0.1.2-rc.1 and 0.1.5-rc.1 (and the 0.1.5-alpha
- * handle API that landed with it).
+ * Dual-stack shims for the dsh 0.1.5-rc and 0.1.7-rc lines (including the
+ * 0.1.5-alpha handle API that landed with the former).
  *
- * 0.1.2 turned settings free functions into `SettingsProvider` methods and
- * replaced `Session.events` with on-demand readers. 0.1.5 replaced
- * `SessionPersistence.list`/`inspect`/`locate` with snapshot `list` plus
- * per-session `open` handles, and moved live tokens from durable
- * `assistant/chunk` events to process-local `agent/assistant-stream`.
- * Every shim here picks the API that is actually present so one build
- * runs on either host.
+ * 0.1.5 resolves settings through `SettingsProvider.get`/`installSection` and
+ * exposes session persistence as snapshot `list` plus per-session `open`
+ * handles; live tokens arrive on the process-local `agent/assistant-stream`.
+ * 0.1.7 replaced the settings service with schema-projected forms. Every shim
+ * here picks the API that is actually present so one build runs on either
+ * host line.
  */
 import type { Context } from '@deepseek-ai/cordis';
+import type { ContextFormed } from '@deepseek-ai/dsh-llm';
 import type { SessionEvent } from '@deepseek-ai/dsh-session';
-import type { SettingsNamespace, SettingsSectionHooks } from '@deepseek-ai/dsh-settings';
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
 import type z from '@deepseek-ai/schemastery';
+declare module '@deepseek-ai/dsh-llm' {
+    /**
+     * The TUI's own notice/steering messages, which it commits to the durable log
+     * with `source.kind === 'plugin'`.
+     *
+     * 0.1.5 shipped this member; 0.1.7 removed the catch-all and documents the
+     * intended pattern instead — "each producer declares its own `kind` in its
+     * own module". This is that declaration, and it keeps the committed log shape
+     * identical on both lines.
+     */
+    interface MessageSourceMap {
+        plugin: {
+            kind: 'plugin';
+            plugin: string;
+        } & ContextFormed;
+    }
+}
 /**
- * 0.1.1-rc.2 wraps namespaces via `settingsNamespace()`; 0.1.2+ brands them at
- * the type level and takes the plain string at runtime. A cast covers both.
+ * Settings namespaces are branded strings at the type level on both supported
+ * lines; this cast supplies the brand from a plain literal.
  */
 export declare function settingsNamespace(value: string): SettingsNamespace;
 /**
- * Register a settings section: 0.1.2-rc.1 moved the free function onto the
- * `settings` service as `installSection`, callable only once that service is
- * injected (plugins apply before it, so `ctx.inject` must defer — same
- * pattern the harness's own packages use); 0.1.1-rc.2 keeps the free
- * function, which defers internally and is safe at apply time.
+ * Hooks a settings consumer hands to {@link installSettingsSection}.
+ *
+ * Spelled out locally instead of imported: 0.1.7 deleted the
+ * `SettingsSectionHooks` export, and this shape is the whole contract the three
+ * call sites use.
+ */
+export interface SettingsSectionHooks<T> {
+    /**
+     * Receive the active configuration source: the resolved settings value while
+     * a section is attached. Called at attach and again after every change.
+     * @param current - thunk returning the currently authoritative value.
+     */
+    setSource(current: () => T): void;
+    /**
+     * Re-judge anything derived from the source — registration-level facts,
+     * memoized resolutions — after an attach or a committed change.
+     */
+    onChange(): void;
+    /** Reject a resolved section this consumer could not act on. */
+    validate?(value: T): void;
+}
+/** Which settings protocol the running host speaks. */
+export type SettingsGeneration = 'legacy' | 'forms';
+/**
+ * The host's settings generation, as feature detection rather than a version.
+ *
+ * `legacy` (0.1.5) resolves a namespace through `settings.get`; `forms` (0.1.7)
+ * has no `get` and projects a form per loader entry. Callers that differ by
+ * generation — which profile rows a terminal profile must mount, for one — read
+ * it here instead of sniffing package versions.
+ *
+ * Before the service exists (a plugin applies before it is mounted) the same
+ * split shows up as the roster package's absence, and the answer is memoized as
+ * soon as the service is seen so a later call cannot disagree with an earlier
+ * one.
+ */
+export declare function hostSettingsGeneration(ctx: Context): SettingsGeneration;
+/** Forget the memoized descriptors so the next read re-walks the forms. */
+export declare function invalidateSettingsCache(ctx: Context): void;
+/**
+ * Read one settings section.
+ *
+ * 0.1.5 resolves it through `get(ns)`. 0.1.7 has no `get`, so the value comes
+ * from the entry's descriptor, which projects the live config — volatile fields
+ * only, i.e. exactly the fields its form exposes — and returns `undefined` when
+ * no entry carries that id.
+ */
+export declare function readSettingsSection(ctx: Context, ns: SettingsNamespace): unknown;
+/**
+ * The user's own settings document, keyed by namespace, on either line.
+ *
+ * 0.1.5 publishes it as `settings.document`. 0.1.7 dropped the property — the
+ * document is the profile patch now — but each descriptor still carries the
+ * user layer it was built from, so the same view is reconstructible. Callers
+ * that ask "did the user configure this?" must use this, not
+ * {@link readSettingsSection}: a resolved read also carries the composition
+ * base and schema defaults, which is exactly what such a caller must not
+ * mistake for a user choice.
+ */
+export declare function settingsDocument(ctx: Context): Record<string, unknown> | undefined;
+/**
+ * Mark one schema field as form-writable on the 0.1.7 line.
+ *
+ * 0.1.7 projects only fields whose schema node carries the `volatile` meta, and
+ * refuses a settings write to any other path. The 0.1.5 schemastery (3.18.2)
+ * has no such builder, so the call is feature-detected rather than typed: on
+ * that line the marker means nothing and the schema is returned untouched.
+ */
+export declare function liveField<T>(schema: z<T>): z<T>;
+/**
+ * Register a settings section.
+ *
+ * 0.1.5 publishes the `settings` service with `installSection`, callable only
+ * once that service is injected (plugins apply before it, so `ctx.inject` must
+ * defer — same pattern the harness's own packages use).
+ *
+ * 0.1.7 removed it. The section is now the loader entry's own `Config`
+ * schema — this plugin's is `ssh-tui`, and the two auxiliary namespaces are
+ * carried by the `dsh-ssh-tui/settings-*` rows in `cordis.patch.yml` — so the
+ * only thing left for a consumer to wire is the live read (`setSource`) and the
+ * change notification (`onChange`).
  */
 export declare function installSettingsSection<T>(ctx: Context, ns: SettingsNamespace, schema: z<T>, entry: T, hooks: SettingsSectionHooks<T>): void;
 /**
- * Read the full durable event log: 0.1.2-rc.1 replaced the `Session.events`
- * property with on-demand readers; 0.1.1-rc.2 still exposes the property.
+ * Whether a tool result reports failure.
+ *
+ * 0.1.5 carries `isError` on the `tool-result` content block; 0.1.7 removed
+ * that block from `ContentBlockMap` and moved the flag onto the message
+ * itself. Both are read, so one build understands either host.
+ */
+export declare function toolResultFailed(message: unknown): boolean;
+/**
+ * Read the full durable event log. Both supported lines read it on demand
+ * through `snapshotEvents()`.
  */
 export declare function sessionEvents(session: object): readonly SessionEvent[];
 /**
@@ -60,7 +161,6 @@ export interface SessionHeaderLike {
 /** Logical log plus the header it belongs to. */
 export interface SessionInspectionLike {
     events: readonly unknown[];
-    meta?: SessionHeaderLike;
     header?: SessionHeaderLike;
     /**
      * Backend state for the slice. `detached` means the backend never
@@ -71,27 +171,28 @@ export interface SessionInspectionLike {
     eventState?: string;
 }
 /**
- * 0.1.2 `list()` returns headers; 0.1.5 returns `{ header, revision, … }`
- * snapshots. Normalize to headers so the picker does not care which host
+ * Both supported lines return `{ header, revision, … }` snapshots from
+ * `list()`; normalize to the header so the picker does not care which host
  * it is talking to.
  */
 export declare function listPersistenceHeaders(persistence: object): Promise<SessionHeaderLike[]>;
 /**
- * 0.1.2 `inspect(id)` returns `{ meta, events }`. 0.1.5 dropped inspect in
- * favour of `open(id, 'read')` + `handle.read()`. Close the handle so a
- * listing pass does not pin write ownership.
+ * Read one session through `open(id, 'read')` + `handle.read()`, the access
+ * both supported lines expose. Close the handle so a listing pass does not pin
+ * write ownership.
  */
 export declare function inspectPersistenceSession(persistence: object, id: unknown): Promise<SessionInspectionLike>;
-/** 0.1.2 owns `locate(header)`; 0.1.5 hid it on the JSONL backend. */
+/**
+ * A session's artifact path from its header. Both supported lines still
+ * implement `locate()` on the JSONL backend, but their typings keep it
+ * private, so the call stays feature-detected.
+ */
 export declare function persistenceLocate(persistence: object, meta: object): {
     path?: string;
 } | undefined;
-/**
- * 0.1.2 command input advertised `images`; 0.1.5 renamed the flag to
- * `attachments`. Either true means the slash command accepts composer files.
- */
+/** Whether a command's input admits the composer's attachments. */
 export declare function commandAcceptsAttachments(input: unknown): boolean;
-/** One model stream chunk, from either `assistant/chunk` or `agent/assistant-stream`. */
+/** One chunk from a live `agent/assistant-stream` frame. */
 export interface StreamChunkLike {
     type: string;
     text?: string;
@@ -133,12 +234,12 @@ export declare function streamFrameAttemptId(frame: unknown): unknown;
  */
 export declare function streamFirstTokenTime(stream: unknown): number | undefined;
 /**
- * Durable `assistant/chunk` payload, or a live stream frame's inner chunk.
+ * A live `agent/assistant-stream` chunk frame's inner chunk plus its framing.
  *
- * `fallback` supplies the turn/step for live chunk frames, which do not carry
- * them (see {@link streamFrameOwner}).
+ * `fallback` supplies the turn/step, which chunk frames do not carry (see
+ * {@link streamFrameOwner}).
  */
-export declare function streamChunkOf(eventOrFrame: unknown, fallback?: {
+export declare function streamChunkOf(frame: unknown, fallback?: {
     turn: number;
     step: number;
 }): {
@@ -147,20 +248,16 @@ export declare function streamChunkOf(eventOrFrame: unknown, fallback?: {
     step: number;
     time: number;
     /**
-     * False when neither the source nor a fallback carried a real turn/step.
+     * False when neither the frame nor a fallback carried a real turn/step.
      * Usage folded under such a chunk would be filed under a bogus key (0:0)
      * that `step/end` never clears, inflating the session totals forever.
      */
     stepKnown: boolean;
 } | undefined;
-/** Durable event type as a plain string so 0.1.5 hosts can omit `assistant/chunk`. */
-export declare function sessionEventType(event: unknown): string;
-/** True when this event is a live-or-durable assistant token that replay should skip. */
-export declare function isAssistantStreamEvent(event: unknown): boolean;
-/**
- * Subscribe to a host event that may not exist on the compile-time Events
- * map. 0.1.5 emits `agent/assistant-stream`; 0.1.2 never does. Cordis
- * still accepts the string; the listener is simply never called on 0.1.2.
+/**
+ * Subscribe to a host event whose scoped payload type does not match this
+ * build's `Events` map. Both supported lines emit `agent/assistant-stream`,
+ * and Cordis accepts the plain event name at runtime.
  */
 export declare function listenHostEvent(ctx: {
     on: (event: never, handler: never) => unknown;

package/lib/types/footer.d.ts

@@ -1,6 +1,7 @@
 /**
  * Footer stats, status identity, context-pressure chips, and `/status` report.
  */
+import { type ColorDepth } from './color-depth.js';
 import { type QuotaPeriod, type QuotaSnapshot, type QuotaSource } from './quota.js';
 import type { DisconnectPolicyName } from './transcript-types.js';
 export declare const WAIT_INDICATOR_MS = 8000;
@@ -104,7 +105,9 @@ export declare function fitFooterChips(chips: readonly FooterChip[], width: numb
  * the preset-owned tools are missing. It leads the strip and keeps its glyph
  * longest, because it is the one group that reports a broken install.
  */
-export declare function footerHealthChip(missing: boolean, color?: boolean): FooterChip | undefined;
+export declare function footerHealthChip(missing: boolean, color?: boolean, 
+/** Which rows are missing: the 0.1.5 roster, or the 0.1.7 agent plane. */
+kind?: 'roster' | 'agent-plane'): FooterChip | undefined;
 export declare function fitFooterStatsLine(chip: string, groups: readonly string[], width: number): string;
 export type FooterActivityKind = 'plan-review' | 'waiting' | 'compacting' | 'retry' | 'subagents' | 'tools' | 'plan-open' | 'plan-pending' | 'goal' | 'waiting-llm' | 'idle';
 export interface FooterStatusInput {
@@ -161,12 +164,25 @@ export declare function formatQuotaBar(remainingPercent: number, width?: number)
  * `sub:<model>` chip for the identity row: `sub:grok-4.5`, or
  * `sub:grok-4.5(xhigh)` when an explicit `/subeffort` is set.
  *
- * It shows the model name only, like the parent's own chip: a `provider/model`
- * prefix on both chips doubled the same route and pushed the quota badge towards
- * the drop edge. The provider is not lost — `/submodel` and `/status` report it,
- * and the child's model name is the part that differs from the parent's.
+ * It shows the model name only, like the parent's own chip, unless `/submodel`
+ * pinned a different provider — then `sub:xai/grok-4.5` so the foreign route
+ * is visible on the identity row as well as the recolored chip.
  */
 export declare function subagentRouteLabel(model: string, provider?: string, effort?: string): string;
+/**
+ * Paint the `sub:` chip on an otherwise muted status line.
+ *
+ * Only a *foreign* route is accented: cyan when `/submodel` pinned a supplier
+ * the parent is not on. A child that follows the parent (or that was pinned
+ * back onto the parent's own provider) keeps the identity row's mute — the
+ * accent means "this route is not your parent's", and spending it on every
+ * child made the following case look pinned.
+ *
+ * The mute (`90`) is reopened after the chip so the rest of the identity row
+ * stays dim.
+ */
+export declare function paintFooterSubagentChip(line: string, chip: string, foreign: boolean, muteSgr?: string, depth?: ColorDepth): string;
+export declare function footerSubagentForeign(input: Pick<FooterStatusInput, 'provider' | 'subProvider'>): boolean;
 /**
  * The model as the footer shows it: the model's own name, without a
  * `provider/model` route prefix.

package/lib/types/gateway-protocol.d.ts

@@ -0,0 +1,88 @@
+/**
+ * One gateway, several wire protocols.
+ *
+ * `llm-pi-ai` puts `api` on the *provider* entry, not on a model entry, so a
+ * gateway whose catalogue spans protocols (Command Code: 55 of 71 models answer
+ * `/responses`, 8 only `/chat/completions`, the Claude family only `/messages`)
+ * cannot be one entry. The wizard therefore keeps one row per gateway and
+ * expands it into sibling entries — `command-code`, `command-code-responses`,
+ * `command-code-messages` — with each model filed under the protocol it
+ * actually speaks. Everything here is pure so the split can be tested without
+ * a settings file or a network.
+ */
+export type GatewayProtocol = 'openai-responses' | 'openai-completions' | 'anthropic-messages';
+/** Preference order for a model a gateway lists on more than one route. */
+export declare const GATEWAY_PROTOCOL_PREFERENCE: readonly GatewayProtocol[];
+/** Id suffix per protocol; the base entry keeps the plain gateway id. */
+export declare const GATEWAY_PROTOCOL_SUFFIX: Record<GatewayProtocol, string>;
+/** The endpoint path each protocol speaks, for messages and hints. */
+export declare const GATEWAY_PROTOCOL_ENDPOINT: Record<GatewayProtocol, string>;
+/** The endpoint strings gateways publish; `null` for anything unrecognised. */
+export declare function endpointProtocol(endpoint: string): GatewayProtocol | null;
+/** `command-code` + `openai-responses` → `command-code-responses`. */
+export declare function siblingProviderId(baseId: string, protocol: GatewayProtocol): string;
+/** The protocol a sibling id carries, or null when it is not one of ours. */
+export declare function siblingProtocolOf(id: string): GatewayProtocol | null;
+/** True when `id` is a sibling of `baseId` (and not the base itself). */
+export declare function isSiblingOf(baseId: string, id: string): boolean;
+/** The gateway id a sibling row belongs to; a base id comes back unchanged. */
+export declare function baseProviderIdOf(id: string): string;
+/** The protocol a provider entry's `api` names, when it is one of the three we model. */
+export declare function declaredProtocol(value: unknown): GatewayProtocol | undefined;
+/**
+ * Whether an entry that speaks `protocol` may serve `model`, according to the
+ * gateway's own `supported_endpoints`. A gateway that publishes nothing about
+ * the model — or no protocol to check against — never blocks it: silence is not
+ * a refusal, only an explicit list that omits the protocol is.
+ */
+export declare function gatewayServesModel(endpoints: ReadonlyMap<string, readonly string[]> | undefined, model: string, protocol: GatewayProtocol | undefined): boolean;
+/**
+ * The protocols a gateway lists for `model`, in preference order. Empty when the
+ * gateway says nothing, which callers read as "no opinion".
+ */
+export declare function advertisedProtocols(endpoints: ReadonlyMap<string, readonly string[]> | undefined, model: string): GatewayProtocol[];
+/**
+ * The protocol one model should be filed under. The gateway's own
+ * `supported_endpoints` decide when it publishes them; a model already
+ * configured on a route the gateway still lists keeps that route, and a model
+ * the gateway does not describe keeps the route it is already on rather than
+ * being relocated by a hand-maintained table. Otherwise the earliest entry in
+ * `preference` wins, then the table, then the gateway's own primary protocol.
+ */
+export declare function resolveModelProtocol(input: {
+    advertised?: readonly string[];
+    /** The provider protocol this model is already configured on, if any. */
+    existing?: GatewayProtocol;
+    table?: GatewayProtocol;
+    fallback: GatewayProtocol;
+    preference?: readonly GatewayProtocol[];
+}): GatewayProtocol;
+/**
+ * Every model of one gateway, filed by protocol. `existing` carries the
+ * protocol each model is already configured on, so re-running setup keeps a
+ * working placement instead of re-homing it. Models the gateway does not
+ * describe, that are not configured yet, and that the table does not know land
+ * on `fallback`, which is the gateway's own pinned protocol — the one its
+ * default models were verified on.
+ */
+export declare function splitModelsByProtocol(input: {
+    models: readonly string[];
+    advertised?: ReadonlyMap<string, readonly string[]>;
+    existing?: ReadonlyMap<string, GatewayProtocol>;
+    table?: Readonly<Record<string, GatewayProtocol>>;
+    fallback: GatewayProtocol;
+    preference?: readonly GatewayProtocol[];
+}): Map<GatewayProtocol, string[]>;
+/**
+ * OpenCode Go's published endpoint table (https://opencode.ai/docs/go/), because
+ * `GET /zen/go/v1/models` carries no `supported_endpoints` field at all.
+ *
+ * The whole DeepSeek family answers `/responses` (verified against the live
+ * gateway, and what this plugin's pinned template has shipped since 0.7.0) even
+ * though the page still lists those models under chat. A route that works is not
+ * downgraded because a document lags. Zen's own (non-Go) route publishes no
+ * table here — unknown models there take the gateway's primary protocol.
+ */
+export declare const ZEN_GO_MODEL_PROTOCOLS: Readonly<Record<string, GatewayProtocol>>;
+/** The built-in table for a gateway base URL, when we have one. */
+export declare function gatewayModelTable(baseURL: string): Readonly<Record<string, GatewayProtocol>> | undefined;

package/lib/types/i18n/index.d.ts

@@ -10,22 +10,28 @@ import type { Context } from '@deepseek-ai/cordis';
 export type Locale = 'zh' | 'en';
 export type MessageVars = Record<string, string | number>;
 export declare const UI_LOCALE_NAMESPACE: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+/**
+ * Fields `/language`, `/view`, `/disconnect` and `/autoapproval` persist.
+ *
+ * Every field is live: on 0.1.7 the section *is* this form, and only volatile
+ * paths may be written (see {@link liveField}).
+ */
 export declare const UI_LOCALE_SCHEMA: z<Schemastery.ObjectS<{
-    language: z<string, string>;
-    skipUpdate: z<string, string>;
-    view: z<string, string>;
-    disconnect: z<string, string>;
-    autoApproval: z<string, string>;
+    language: z<string>;
+    skipUpdate: z<string>;
+    view: z<string>;
+    disconnect: z<string>;
+    autoApproval: z<string>;
     /** Milliseconds a leftover, finished Host waits before exiting; 0 = never. */
-    idleExit: z<number, number>;
+    idleExit: z<number>;
 }>, Schemastery.ObjectT<{
-    language: z<string, string>;
-    skipUpdate: z<string, string>;
-    view: z<string, string>;
-    disconnect: z<string, string>;
-    autoApproval: z<string, string>;
+    language: z<string>;
+    skipUpdate: z<string>;
+    view: z<string>;
+    disconnect: z<string>;
+    autoApproval: z<string>;
     /** Milliseconds a leftover, finished Host waits before exiting; 0 = never. */
-    idleExit: z<number, number>;
+    idleExit: z<number>;
 }>>;
 export declare function localeFromTag(tag: string): Locale | undefined;
 /** Pick zh/en from env, optionally after a saved settings value. */