dsh-ssh-tui 0.7.2 → 0.7.3

package/lib/tui.js

@@ -22,11 +22,11 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
 import { StringDecoder } from 'node:string_decoder';
-import { METADATA_FILE, readPresetMetadata } from '@deepseek-ai/dsh-agent-presets';
+import { METADATA_FILE, readPresetMetadata } from './preset-compat.js';
 import { credentialRef } from '@deepseek-ai/dsh-credentials';
 import { createUserMessage, errorChain, ReasoningEffortId } from '@deepseek-ai/dsh-llm';
 import { SessionId } from '@deepseek-ai/dsh-session';
-import { commandAcceptsAttachments, forEachSessionEventAsync, isAssistantStreamEvent, isTokenDeltaChunk, listenHostEvent, REPLAY_YIELD_EVERY, sessionEventType, sessionEvents, settingsNamespace, streamChunkOf, streamFirstTokenTime, streamFrameAttemptId, streamFrameOwner, } from './dsh-compat.js';
+import { commandAcceptsAttachments, forEachSessionEventAsync, hostSettingsGeneration, isTokenDeltaChunk, listenHostEvent, readSettingsSection, REPLAY_YIELD_EVERY, sessionEvents, settingsNamespace, streamChunkOf, streamFirstTokenTime, streamFrameAttemptId, streamFrameOwner, toolResultFailed, } from './dsh-compat.js';
 import { classifyApprovalDetailed, commandForApprovalRequest, isApprovalStatusArg, parseAutoApprovalMode } from './auto-approval.js';
 import { buildReviewUserMessage, parseReviewOutput, reviewSystemPrompt } from './approval-reviewer.js';
 import { loadProviderCatalog, mergeProviderEntries } from './provider-catalog.js';
@@ -41,19 +41,20 @@ import { keymapReport, resolveKeymap } from './keymap.js';
 import { presetLabel, profileFromArgv } from './preset-label.js';
 import { flattenGroups, groupPresets, optionMatches } from './preset-picker.js';
 import { isRefusal, planCopy, planDelete, planMetadata, presetDirectory, } from './preset-authoring.js';
-import { ensureRosterRows, planDuplicateRepair, planRosterRepair, rosterPatchPath, writePatchWithBackup, ROSTER_ROWS, } from './preset-rows.js';
+import { ensureRosterRows, planDuplicateRepair, planRosterRepair, formsRowsDeclared, rosterPatchPath, rosterRows, writePatchWithBackup, ALL_ROSTER_ROWS, } from './preset-rows.js';
 import { SessionStatsTracker, statsRowOf } from './stats.js';
 import { QUESTION_OPTION_KEYS, applyQuestionFilter, backspaceQuestionFilter, clearQuestionFilter, typeQuestionFilter, visibleQuestionIndexes, confirmAnswer, inspectClosesOn, moveQuestionCursor, optionsLength, questionOptionIndex, questionSubmit, selectQuestionOptionByKey, } from './dialogs.js';
 import { commandSuggestions, localizedCommands } from './commands.js';
 import { archiveStalePlans, boundTranscriptRows, findLivePlanRow, findMergeableToolRow, findToolRowByCallId, mergeToolCard, planShouldDefaultExpand, windowTranscript, } from './rows.js';
 import { detachFromSshSession, DisplayHost, isTuiHostProcess, resolveDshHome, sessionSockPath } from './display-sock.js';
+import { displayHomePath, envFileName, hostHasOwnConsole, IS_WINDOWS, restrictPathToUser, usesSigwinch, } from './platform.js';
+import { bracketedPasteSequence, mouseDisableSequence, mouseEnableSequence, terminalCapabilities, } from './terminal-caps.js';
 import { sameSessionRoute, sessionRouteInput } from './session-route.js';
 import { GATEWAY_PROTOCOL_SUFFIX, GATEWAY_PROTOCOL_ENDPOINT, GATEWAY_PROTOCOL_PREFERENCE, advertisedProtocols, baseProviderIdOf, declaredProtocol, gatewayModelTable, gatewayServesModel, siblingProviderId, splitModelsByProtocol, } from './gateway-protocol.js';
 import { applySavedLocale, getLocale, localeDisplayName, localeFromTag, setLocale, t, UI_LOCALE_NAMESPACE, } from './i18n/index.js';
 import { defaultReasoningEffort } from './reasoning.js';
 import { checkForPluginUpdate, installPluginLatest } from './update-check.js';
 import { ROUTE_MEMORY_NAMESPACE, parseRouteMemory, rememberedRouteFor, upsertRememberedRoute, } from './route-memory.js';
-import { AGENT_DEFAULT_MODEL_SETTINGS_NAMESPACE } from '@deepseek-ai/dsh-agent-default-model';
 import { DEFAULT_SUBAGENT_MODEL, SUBAGENT_SETTINGS_NAMESPACE, defaultSubagentModelForProvider, subagentModelMatchesProvider, subagentProviderDiffers, subagentSettingsValue, } from './subagent-model.js';
 import { resolveFreshSuperGrokToken } from './supergrok-token.js';
 import { copyTextFromRow, copyTextFromTranscript } from './copy-text.js';
@@ -71,11 +72,11 @@ export { clipAnsiToWidth, cursorVisualPosition, displayWidth, foldInputView, hre
 export { captureHangupSignals, composePaintOutput, detectSshSession, formatLinkQualityChip, ignoreFurtherHangupSignals, isEscapePrefix, findCursorPositionReply, isHangupErrno, linkQualityOf, linkSignalPips, paintIntervalForRtt, paintLinkLabel, parseCursorPositionReply, pickerWindowStart, probeTerminalRttMs, releaseHangupSignals, resolvePaintIntervalMs, waitUntilIdleOrTimeout, writeBootSplash, } from './paint.js';
 export { CONTEXT_IDLE_COMPACT_RATIO, CONTEXT_PRESSURE_DANGER_RATIO, CONTEXT_PRESSURE_WARN_RATIO, CONTEXT_RING_EMPTY, CONTEXT_RING_SEGMENTS, contextPressureAlertText, contextPressureRingColor, contextPressureUsedTokens, contextPressureView, describeProviderRoute, dropFooterQuotaPlanName, fitFooterStatsLine, fitFooterStatusLine, footerActivity, footerIdentityParts, footerStatsGroups, footerSubagentForeign, paintFooterSubagentChip, formatContextPressureChip, formatContextPressureRing, formatContextPressureStatusLine, formatDuration, formatFooterQuota, formatQuotaBar, formatQuotaUnknown, formatStatusReport, providerHasQuotaSurface, quotaWindowTag, shortModelName, shortQuotaPlanName, formatTokens, formatTokensPerSecond, parseContextPressure, promptPressureTokens, providerShortCode, providerUsesLocalOAuth, shouldIdleAutoCompact, subagentRouteLabel, } from './footer.js';
 export { commandCodePeriodStart, commandCodeSourceFor, crossedQuotaThresholds, formatAccountBalance, formatFooterBalance, formatOpenCodeGoUsage, formatQuotaSnapshot, formatQuotaStatusLine, joinUrl, openCodeSourceFor, parseCommandCodeQuota, parseDeepSeekBalance, parseOpenAiCompatibleBalance, parseOpenCodeGoQuota, parseSuperGrokBilling, preferredQuotaWindow, quotaAlertText, quotaRefreshEverySteps, quotaRefreshEveryTurns, remainingPercentFromUsed, tightestQuotaWindow, } from './quota.js';
-export { commandAcceptsAttachments, forEachSessionEvent, isAssistantStreamEvent, isTokenDeltaChunk, listPersistenceHeaders, inspectPersistenceSession, sessionEventType, sessionEvents, settingsNamespace, streamChunkOf, streamFirstTokenTime, streamFrameAttemptId, streamFrameOwner, } from './dsh-compat.js';
+export { commandAcceptsAttachments, forEachSessionEvent, isTokenDeltaChunk, listPersistenceHeaders, inspectPersistenceSession, sessionEvents, settingsNamespace, streamChunkOf, streamFirstTokenTime, streamFrameAttemptId, streamFrameOwner, } from './dsh-compat.js';
 export { applyTurnEndToPlan, askSummary, cardCategoryOf, compactionHeaderText, formatCompactCommandError, isPromptInjectionMessage, matchTranscriptRows, parseFindQuery, parsePlanTodos, planCloseNudgeText, planDockNote, planIsLive, planTitleFromMarkdown, planTurnLeftOpen, promptInjectionSources, promptInjectionTitle, buildSubagentHeader, clipSubagentActivity, describeSubagentFailure, subagentChipSummary, subagentDisplayName, subagentInspectLines, subagentRowFromSpawnTool, foldSubagentUserLog, todoProgressLabel, todoSummary, } from './plan.js';
 export { buildToolHeader, canMergeToolCall, compactEditPath, compactToolBursts, compactToolGroups, countDiffAddDel, countDiffLines, countOutputLines, diffMetaDiffs, diffStatToken, friendlyJsonLines, parseExitStatus, presentToolCall, READ_TOOL_NAMES, renderToolDiff, toolBodyFitsWorkspace, toolBodyLines, toolStateColor, toolStateLabel, wrappedToolBodyLineCount, } from './tool-present.js';
 function discoverProviderModels(llm, request, signal) {
-    return llm.discoverModels(settingsNamespace('llm-pi-ai'), { ...request, signal }, signal);
+    return llm.discoverModels(settingsNamespace('llm-pi-ai'), request, signal);
 }
 /**
  * Ask a gateway which routes each of its models answers (`supported_endpoints`
@@ -111,11 +112,7 @@ async function fetchModelEndpoints(baseURL, apiKey, signal) {
         return undefined;
     }
 }
-function installUserQuestionAnswerer(ctx, questions, ask) {
-    const provider = questions;
-    if (typeof provider.registerProvider === 'function') {
-        return provider.registerProvider({ ask });
-    }
+function installUserQuestionAnswerer(ctx, ask) {
     return ctx.on('user-questions/request', async (request, next) => {
         try {
             return await ask(request);
@@ -128,6 +125,16 @@ function installUserQuestionAnswerer(ctx, questions, ask) {
     });
 }
 const ROUTE_MEMORY_NS = ROUTE_MEMORY_NAMESPACE;
+/**
+ * The `agent-default-model` settings entry `/model` falls back to writing.
+ *
+ * 0.1.5 exports this id as `AGENT_DEFAULT_MODEL_SETTINGS_NAMESPACE`; 0.1.7
+ * removed the export and let the profile own entry ids, which keeps the name the
+ * legacy `settings.yaml` section is imported under. Inlined so one build runs
+ * against either host — the primary path, `agentDefaultModel.saveSelection`,
+ * is the same call on both.
+ */
+const AGENT_DEFAULT_MODEL_NS = settingsNamespace('agent-default-model');
 /**
  * The window llm-pi-ai falls back to when neither a model entry nor the
  * installed catalog sizes a model. The wizard pre-fills it only so a route
@@ -308,7 +315,6 @@ const SUBAGENT_DEFAULT_EFFORT_LABEL = () => t('footer.effortDefault');
  */
 const QUOTA_RETRY_MS = 15_000;
 const RESERVED_BOTTOM_LINES = 3; // input line + stats line + status line
-const IS_WINDOWS = process.platform === 'win32';
 function dshHomeDir() {
     return resolveDshHome();
 }
@@ -331,23 +337,9 @@ function hostDshVersion() {
     return 'unknown';
 }
 function displayDshPath(file) {
-    const home = dshHomeDir();
-    if (IS_WINDOWS) {
-        const profile = process.env.USERPROFILE;
-        if (profile !== undefined && home.toLowerCase().startsWith(profile.toLowerCase())) {
-            const rest = home.slice(profile.length);
-            return `%USERPROFILE%${rest}\\${file}`.replaceAll('/', '\\');
-        }
-        return `${home}\\${file}`.replaceAll('/', '\\');
-    }
-    const userHome = homedir();
-    if (home === userHome)
-        return `~/.dsh/${file}`;
-    if (home.startsWith(`${userHome}/`))
-        return `~/${home.slice(userHome.length + 1)}/${file}`;
-    return join(home, file);
+    return displayHomePath(dshHomeDir(), file);
 }
-const DSH_ENV_FILE = join(dshHomeDir(), IS_WINDOWS ? 'env.cmd' : 'env.sh');
+const DSH_ENV_FILE = join(dshHomeDir(), envFileName());
 const DEEPSEEK_LOGO_VARIANTS = [
     {
         width: 52,
@@ -654,6 +646,14 @@ export class SshTui {
     /** Last route reported to the launcher; a repaint must not report it again. */
     lastSessionRoute;
     useAlternateScreen;
+    /**
+     * What the terminal in front of us can do. Read from the environment at
+     * construction (see `terminal-caps.ts`): the mouse, bracketed paste and the
+     * alternate screen are only claimed where the terminal has them.
+     */
+    terminalCaps;
+    /** The OSC 52 caveat is worth saying once, not after every copy. */
+    osc52HintShown = false;
     agentGone = false;
     onboarding;
     commandSuggestions = [];
@@ -842,8 +842,8 @@ export class SshTui {
         this.disconnectPolicy = config.disconnectPolicy ?? this.readDisconnectPolicy();
         this.presetId = config.presetId ?? 'standard';
         this.presetName = presetLabel(this.presetId, config.presetName, config.presetTrust);
-        this.useAlternateScreen = !this.lineMode
-            && process.env.DSH_TUI_NO_ALT_SCREEN !== '1' && process.env.DSH_TUI_NO_ALT_SCREEN !== 'true';
+        this.terminalCaps = config.terminalCaps ?? terminalCapabilities();
+        this.useAlternateScreen = !this.lineMode && this.terminalCaps.alternateScreen;
         this.paintLink = detectSshSession() ? 'ssh' : 'local';
         this.paintIntervalMs = resolvePaintIntervalMs(config.paintIntervalMs, process.env, {
             ssh: this.paintLink === 'ssh',
@@ -861,7 +861,13 @@ export class SshTui {
         }
         this.refreshRosterHealth();
         if (this.rosterMissing) {
-            this.pushRow({ kind: 'system', text: t('mode.bootMissing') });
+            // The missing thing differs by host line: a roster the profile can mount,
+            // or the agent-plane rows a 0.1.7 terminal profile owns. The advice has to
+            // match what `/mode fix` will actually write.
+            this.pushRow({
+                kind: 'system',
+                text: t(this.settingsGeneration === 'forms' ? 'mode.bootFormsMissing' : 'mode.bootMissing'),
+            });
         }
         if (config.cwdNotice !== undefined && config.cwdNotice !== '') {
             this.pushRow({ kind: /进入|Entered/u.test(config.cwdNotice) ? 'system' : 'error', text: config.cwdNotice });
@@ -869,6 +875,14 @@ export class SshTui {
         if (config.restoredRoute !== undefined) {
             this.pushRow({ kind: 'system', text: sessionRouteNotice(config.restoredRoute) });
         }
+        // Windows only, and only on the fallback path: with no PowerShell there is
+        // no hidden console, so the Host is a direct child and closing the window
+        // ends the session's compute. Say it at boot rather than let the user find
+        // out by closing the window mid-turn. A bootstrapped Windows Host and every
+        // POSIX Host keep running, so neither says anything.
+        if (isTuiHostProcess() && !hostHasOwnConsole()) {
+            this.pushRow({ kind: 'system', text: t('boot.directHost') });
+        }
         for (const notice of config.launchNotices ?? []) {
             this.pushRow({ kind: notice.kind, text: notice.text });
         }
@@ -898,7 +912,7 @@ export class SshTui {
         process.stdin.setRawMode(true);
         process.stdin.resume();
         process.stdout.on('resize', this.onDirectResize);
-        if (process.platform !== 'win32') {
+        if (usesSigwinch()) {
             process.on('SIGWINCH', this.onDirectResize);
         }
         process.stdin.prependListener('end', this.handleHangupStream);
@@ -912,7 +926,7 @@ export class SshTui {
             this.bootBackgroundTasks();
             return;
         }
-        this.write(`${this.useAlternateScreen ? '\x1b[?1049h' : ''}\x1b[?1000h\x1b[?1002h\x1b[?1006h\x1b[?2004h\x1b[?25l`);
+        this.write(this.enterScreenSequence());
         this.render();
         this.updateTerminalTitle();
         void this.calibratePaintInterval().finally(() => {
@@ -923,11 +937,22 @@ export class SshTui {
         });
         this.bootBackgroundTasks();
     }
+    /**
+     * Take over the screen: alternate screen where it is safe, then the input
+     * modes the terminal actually supports, then hide the cursor.
+     *
+     * Joining the parts here (rather than at each call site) is what keeps
+     * `start`, a reattach and a teardown from drifting apart — the reattach path
+     * used to duplicate this string verbatim.
+     */
+    enterScreenSequence() {
+        return `${this.useAlternateScreen ? '\x1b[?1049h' : ''}${mouseEnableSequence(this.terminalCaps)}${bracketedPasteSequence(this.terminalCaps, true)}\x1b[?25l`;
+    }
     bindAgentEvents() {
         this.disposers.push(this.ctx.on('session/event', this.handleSessionEvent), listenHostEvent(this.ctx, 'agent/assistant-stream', this.handleAssistantStream), this.ctx.on('agent/status', this.handleStatus), this.ctx.on('agent/error', this.handleError), this.ctx.on('agent/disposed', this.handleDisposed), this.ctx.on('agent/inbox/claimed', this.handleInboxClaimed), this.ctx.on('agent/inbox/discarded', this.handleInboxDiscarded), this.ctx.on('agent/request', this.handleAgentRequest), this.ctx.on('subagent/start', this.handleSubagentStart), this.ctx.on('subagent/end', this.handleSubagentEnd), this.ctx.on('approval/request', this.handleApproval));
         const questions = this.ctx.get('userQuestions');
         if (questions !== undefined) {
-            this.userQuestionDisposer = installUserQuestionAnswerer(this.ctx, questions, this.handleUserQuestions);
+            this.userQuestionDisposer = installUserQuestionAnswerer(this.ctx, this.handleUserQuestions);
         }
     }
     bootBackgroundTasks() {
@@ -1008,7 +1033,7 @@ export class SshTui {
         }
     }
     readSkippedUpdate() {
-        const raw = this.ctx.get('settings')?.get(UI_LOCALE_NAMESPACE);
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
             return undefined;
         const skip = raw.skipUpdate;
@@ -1021,14 +1046,14 @@ export class SshTui {
         const settings = this.ctx.get('settings');
         if (settings === undefined)
             return;
-        const raw = settings.get(UI_LOCALE_NAMESPACE);
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         const previous = raw !== null && typeof raw === 'object' && !Array.isArray(raw)
             ? raw
             : {};
         await settings.replace(UI_LOCALE_NAMESPACE, { ...previous, ...patch });
     }
     readWorkspaceView() {
-        const raw = this.ctx.get('settings')?.get(UI_LOCALE_NAMESPACE);
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
             return 'detailed';
         return parseWorkspaceView(String(raw.view ?? '')) ?? 'detailed';
@@ -1037,7 +1062,7 @@ export class SshTui {
         const env = parseDisconnectPolicy(process.env.DSH_TUI_DISCONNECT ?? '');
         if (env !== undefined)
             return env;
-        const raw = this.ctx.get('settings')?.get(UI_LOCALE_NAMESPACE);
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
             return 'pause';
         return parseDisconnectPolicy(String(raw.disconnect ?? '')) ?? 'pause';
@@ -1046,7 +1071,7 @@ export class SshTui {
         const env = parseAutoApprovalMode(process.env.DSH_TUI_AUTO_APPROVAL ?? '');
         if (env !== undefined)
             return env;
-        const raw = this.ctx.get('settings')?.get(UI_LOCALE_NAMESPACE);
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
             return 'off';
         return parseAutoApprovalMode(String(raw.autoApproval ?? '')) ?? 'off';
@@ -1086,7 +1111,7 @@ export class SshTui {
         const raw = Number.parseInt(process.env.DSH_TUI_IDLE_EXIT_MS ?? '', 10);
         if (Number.isFinite(raw) && raw >= 0)
             return raw;
-        const saved = this.ctx.get('settings')?.get(UI_LOCALE_NAMESPACE);
+        const saved = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
         if (saved !== null && typeof saved === 'object' && !Array.isArray(saved)) {
             const value = saved.idleExit;
             if (typeof value === 'number' && Number.isFinite(value) && value >= 0)
@@ -1510,7 +1535,11 @@ export class SshTui {
             try {
                 process.stdout.write('\x1b]0;\x07');
                 process.stdout.write('\x1b[0m\x1b[2J\x1b[3J\x1b[H');
-                process.stdout.write(`\x1b[?1000l\x1b[?1002l\x1b[?1006l\x1b[?2004l\x1b[?25h${this.useAlternateScreen ? '\x1b[?1049l' : ''}`);
+                // Leave the alternate screen unconditionally, the way every mouse mode is
+                // disabled: `?1049l` on a terminal that never entered is ignored, while
+                // *skipping* it after a reattach whose relay classified the terminal
+                // differently leaves the user stuck in a screen they cannot scroll.
+                process.stdout.write(`${mouseDisableSequence()}${bracketedPasteSequence(this.terminalCaps, false)}\x1b[?25h\x1b[?1049l`);
             }
             catch (error) {
                 if (!isHangupErrno(error)) {
@@ -1611,10 +1640,7 @@ export class SshTui {
     }
     /** Routing facts for the doctor's self-consistency check. */
     doctorRouting() {
-        const settings = this.ctx.get('settings');
-        if (settings === undefined)
-            return undefined;
-        const section = settings.get(settingsNamespace('llm-pi-ai'));
+        const section = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
         const providers = section?.providers ?? {};
         const provider = this.currentProvider();
         const models = Array.isArray(providers[provider]?.models) ? providers[provider]?.models ?? [] : [];
@@ -1640,6 +1666,7 @@ export class SshTui {
                 roster: this.ctx.get('agentPresets') !== undefined,
                 codeRuntime: this.hasHostService('codeRuntime'),
             },
+            generation: hostSettingsGeneration(this.ctx),
             anchors: [process.argv[1], this.ctx.baseUrl],
             ...(routing === undefined ? {} : { routing }),
         });
@@ -1660,11 +1687,11 @@ export class SshTui {
     /** `/fix <row>`: repair one named roster row of the profile patch. */
     async runFixCommand(arg) {
         const name = arg.trim().toLowerCase();
-        const row = ROSTER_ROWS.find(candidate => candidate.id === name || candidate.name.toLowerCase() === name);
+        const row = ALL_ROSTER_ROWS.find(candidate => candidate.id === name || candidate.name.toLowerCase() === name);
         if (row === undefined) {
             this.pushRow({
                 kind: 'error',
-                text: t('doctor.fix.unknownRow', { row: arg.trim(), rows: ROSTER_ROWS.map(candidate => candidate.id).join(', ') }),
+                text: t('doctor.fix.unknownRow', { row: arg.trim(), rows: ALL_ROSTER_ROWS.map(candidate => candidate.id).join(', ') }),
             });
             this.markDirty();
             return;
@@ -1683,7 +1710,7 @@ export class SshTui {
         const duplicates = facts.patch.readable ? planDuplicateRepair(text) : undefined;
         if (duplicates !== undefined)
             text = duplicates.text;
-        const roster = planRosterRepair(text, rows);
+        const roster = planRosterRepair(text, rows, facts.generation ?? 'legacy');
         if (roster !== undefined)
             text = roster.text;
         const added = roster?.added ?? [];
@@ -2066,7 +2093,7 @@ export class SshTui {
             void this.onReattach?.();
             return;
         }
-        this.write(`${this.useAlternateScreen ? '\x1b[?1049h' : ''}\x1b[?1000h\x1b[?1002h\x1b[?1006h\x1b[?2004h\x1b[?25l`);
+        this.write(this.enterScreenSequence());
         this.forceFullPaint = true;
         this.dirty = true;
         // The user is back: say so, with how many times this Host has been
@@ -2375,7 +2402,7 @@ export class SshTui {
         const note = planDockNote(plan);
         lines.push(this.styleLine('plan-dock', padToWidth(`   ${note}`, width)));
         if (plan.planMarkdown !== undefined && plan.planMarkdown !== '') {
-            const markdown = renderMarkdownLines(plan.planMarkdown, inner, this.color);
+            const markdown = renderMarkdownLines(plan.planMarkdown, inner, this.color, this.terminalCaps.osc8);
             const budget = Math.max(4, Math.min(12, markdown.length));
             for (const line of markdown.slice(0, budget)) {
                 lines.push(`${clipAnsiToWidth(`  ${line}`, width)}\x1b[0m`);
@@ -2944,7 +2971,7 @@ export class SshTui {
         };
         const pushRow = (kind, text, ref) => {
             if (kind === 'assistant') {
-                for (const line of renderMarkdownLines(text, width, this.color)) {
+                for (const line of renderMarkdownLines(text, width, this.color, this.terminalCaps.osc8)) {
                     addDisplay(line, ref);
                 }
                 return;
@@ -3087,7 +3114,7 @@ export class SshTui {
                 if (row.expanded) {
                     addDisplay(this.styleLine('plan-dock', `   ${planDockNote({ ...row, active: false, pending: false })}`), row);
                     if (row.planMarkdown !== undefined && row.planMarkdown !== '') {
-                        for (const line of renderMarkdownLines(row.planMarkdown, Math.max(1, width - 2), this.color).slice(0, 8)) {
+                        for (const line of renderMarkdownLines(row.planMarkdown, Math.max(1, width - 2), this.color, this.terminalCaps.osc8).slice(0, 8)) {
                             addDisplay(`  ${line}`, row);
                         }
                     }
@@ -3125,7 +3152,7 @@ export class SshTui {
                     }
                     if (row.detail !== undefined && row.detail !== '') {
                         if (row.intent === 'plan-review') {
-                            for (const line of renderMarkdownLines(row.detail, Math.max(1, width - 2), this.color)) {
+                            for (const line of renderMarkdownLines(row.detail, Math.max(1, width - 2), this.color, this.terminalCaps.osc8)) {
                                 addDisplay(`  ${line}`, row);
                             }
                         }
@@ -3408,7 +3435,7 @@ export class SshTui {
                     addDialog(t('dialog.planReview', { index: d.index + 1, total: d.total }) + (d.question.header === undefined ? '' : ` · ${d.question.header}`));
                     addDialog(d.question.question);
                     if (d.question.detail !== undefined && d.question.detail !== '') {
-                        for (const line of renderMarkdownLines(d.question.detail, Math.max(1, width - 2), this.color).slice(0, 16)) {
+                        for (const line of renderMarkdownLines(d.question.detail, Math.max(1, width - 2), this.color, this.terminalCaps.osc8).slice(0, 16)) {
                             dialogLines.push(this.styleLine('assistant', line));
                         }
                     }
@@ -3670,7 +3697,7 @@ export class SshTui {
         // the session counters go before the operational signals. Quota and context
         // pressure are deliberately not here — they are on the identity line.
         const strip = [];
-        const health = footerHealthChip(this.rosterMissing, this.color);
+        const health = footerHealthChip(this.rosterMissing, this.color, this.settingsGeneration === 'forms' ? 'agent-plane' : 'roster');
         // Muted like the identity line, accent excepted: the pre-strip footer
         // painted the counters dim and only the ⚠'s own glyph yellow.
         if (health !== undefined)
@@ -3828,6 +3855,10 @@ export class SshTui {
     updateTerminalTitle() {
         if (this.exiting || this.lineMode)
             return;
+        // A console that has no title to set (the Linux virtual console) would take
+        // the escape as noise; the matrix says so, so honour it.
+        if (!this.terminalCaps.title)
+            return;
         const now = Date.now();
         // Completion wins over a still-running agent status: the turn/end event
         // lands before agent/status flips to idle, and the title must not stay
@@ -3936,13 +3967,7 @@ export class SshTui {
         if (service === undefined) {
             this.pushRow({
                 kind: 'error',
-                text: [
-                    t('preset.missingService'),
-                    t('mode.missingServiceHint', {
-                        profile: profileFromArgv(),
-                        patch: rosterPatchPath(resolveDshHome(), profileFromArgv()),
-                    }),
-                ].join('\n'),
+                text: this.missingPresetService(t('preset.missingService')),
             });
             this.markDirty();
             return;
@@ -4122,9 +4147,11 @@ export class SshTui {
         }
         const lines = [t('preset.showTitle', { id: preset.id, name: preset.name ?? preset.id })];
         lines.push(t('preset.showMeta', {
-            trust: preset.trust === 'user' ? t('preset.trustUser') : t('preset.trustSystem'),
+            trust: preset.trust === 'user'
+                ? t('preset.trustUser')
+                : preset.trust === undefined ? t('preset.trustManaged') : t('preset.trustSystem'),
             order: preset.order === undefined ? '—' : String(preset.order),
-            directory: presetDirectory(preset),
+            directory: presetDirectory(preset) ?? t('preset.directoryManaged'),
         }));
         if (preset.description !== undefined)
             lines.push(t('preset.showDescription', { description: preset.description }));
@@ -4189,7 +4216,7 @@ export class SshTui {
                 from: plan.from,
                 id: plan.id,
                 name: plan.name === undefined ? '' : ` · ${plan.name}`,
-                directory: presetDirectory(presets.find(candidate => candidate.id === plan.id) ?? presets[0]),
+                directory: presetDirectory(presets.find(candidate => candidate.id === plan.id) ?? presets[0]) ?? '',
             });
         });
     }
@@ -4212,7 +4239,8 @@ export class SshTui {
         }
         // Merge with what the preset publishes now, so editing one field never
         // drops the other and `order` survives.
-        const current = await readPresetMetadata(presetDirectory(preset));
+        const directory = presetDirectory(preset);
+        const current = directory === undefined ? {} : await readPresetMetadata(directory);
         const plan = planMetadata({ preset, current, patch });
         if (isRefusal(plan)) {
             this.pushPresetRefusal(plan);
@@ -4255,7 +4283,7 @@ export class SshTui {
             return;
         }
         const answer = await new Promise(resolve => {
-            this.openConfirm(t('preset.deleteConfirm', { id: plan.id }), t('preset.deleteHint', { directory: presetDirectory(preset) }), resolve);
+            this.openConfirm(t('preset.deleteConfirm', { id: plan.id }), t('preset.deleteHint', { directory: presetDirectory(preset) ?? t('preset.directoryManaged') }), resolve);
         });
         if (answer !== 'y') {
             this.pushRow({ kind: 'system', text: t('preset.deleteCancelled') });
@@ -4384,11 +4412,11 @@ export class SshTui {
         return `\x1b[7m${styled.replaceAll('\x1b[0m', '\x1b[0m\x1b[7m')}\x1b[27m`;
     }
     /**
-     * Fold one live or durable stream chunk into the in-progress assistant
-     * row. 0.1.2 hosts append `assistant/chunk`; 0.1.5 emits the same chunk
-     * on `agent/assistant-stream` and never writes it to the log.
+     * Fold one live stream chunk into the in-progress assistant row. Hosts from
+     * 0.1.5 on emit the chunk on `agent/assistant-stream` and never write it to
+     * the log.
      */
-    applyStreamChunk(streamed, statsOnly = false) {
+    applyStreamChunk(streamed) {
         const { chunk } = streamed;
         if (isTokenDeltaChunk(chunk)) {
             this.statsTracker.noteFirstToken(streamed.turn, streamed.step, streamed.time);
@@ -4396,8 +4424,6 @@ export class SshTui {
         if (chunk.type === 'usage' && chunk.usage !== undefined && streamed.stepKnown) {
             this.statsTracker.recordUsage(streamed.turn, streamed.step, chunk.usage);
         }
-        if (statsOnly)
-            return;
         if (chunk.type === 'text-delta') {
             this.streaming ??= { text: '', reasoning: '' };
             this.streaming.text += chunk.text ?? '';
@@ -4414,9 +4440,9 @@ export class SshTui {
         }
     }
     /**
-     * 0.1.5 live tokens arrive as process-local `agent/assistant-stream`
-     * frames (start / chunk / end). Chunk frames carry the same
-     * `StreamChunk` the 0.1.2 log used to store as `assistant/chunk`.
+     * 0.1.5 and 0.1.7 live tokens arrive as process-local
+     * `agent/assistant-stream` frames (start / chunk / end). Chunk frames carry
+     * the same `StreamChunk` the settled `assistant/message` embeds in `stream`.
      */
     handleAssistantStream = (...args) => {
         const payload = args[0];
@@ -4505,23 +4531,8 @@ export class SshTui {
             return;
         }
         this.lastActivity = Date.now();
-        if (this.replaying && isAssistantStreamEvent(event)) {
-            // Replay skips the in-progress row, but durable chunks still carry the
-            // timing the footer needs: a resumed session must keep TTFT and tok/s.
-            const streamed = streamChunkOf(event);
-            if (streamed !== undefined)
-                this.applyStreamChunk(streamed, true);
-            return;
-        }
         if (!this.replaying)
             this.refreshContextPressure();
-        const eventType = sessionEventType(event);
-        if (eventType === 'assistant/chunk') {
-            const streamed = streamChunkOf(event);
-            if (streamed !== undefined)
-                this.applyStreamChunk(streamed);
-            return;
-        }
         switch (event.type) {
             case 'user/message': {
                 const text = event.data.content
@@ -4579,8 +4590,7 @@ export class SshTui {
                     .join('');
                 // The settlement's own packed stream is authoritative: a retried step
                 // keeps the failed attempt's first token in the live latch, and spanning
-                // both attempts reported a rate ~20x off. 0.1.2 has no `stream` and still
-                // relies on the replayed `assistant/chunk` events (or the live latch).
+                // both attempts reported a rate ~20x off.
                 this.statsTracker.settleMessage({
                     turn: event.data.turn,
                     step: event.data.step,
@@ -4694,7 +4704,7 @@ export class SshTui {
                         this.markDirty();
                         break;
                     }
-                    const failed = event.data.error !== undefined || event.data.message.content[0]?.isError === true;
+                    const failed = event.data.error !== undefined || toolResultFailed(event.data.message);
                     spawnCard.status = failed ? 'error' : 'ok';
                     spawnCard.endedAt = typeof event.time === 'number' ? event.time : Date.now();
                     if (output !== '') {
@@ -4725,7 +4735,7 @@ export class SshTui {
                         row.output = output;
                     }
                     const failed = event.data.error !== undefined
-                        || event.data.message.content[0]?.isError === true
+                        || toolResultFailed(event.data.message)
                         || (isShell && ((row.exitCode !== undefined && row.exitCode !== 0) || row.signal !== undefined));
                     row.status = failed ? 'error' : 'ok';
                     if (READ_TOOL_NAMES.has(row.name)) {
@@ -5418,8 +5428,6 @@ export class SshTui {
         const row = this.findSubagentRow(String(sessionId));
         if (row === undefined)
             return;
-        if (sessionEventType(event) === 'assistant/chunk')
-            return;
         switch (event.type) {
             case 'user/message': {
                 const text = collectText(event.data.content);
@@ -5450,7 +5458,7 @@ export class SshTui {
                 break;
             }
             case 'tool/result': {
-                const ok = event.data.error === undefined && event.data.message.content[0]?.isError !== true;
+                const ok = event.data.error === undefined && !toolResultFailed(event.data.message);
                 const callId = String(event.data.message.source.callId);
                 const sourceName = event.data.message.source.name;
                 const recorded = this.toolCallNames.get(callId)
@@ -6209,7 +6217,7 @@ export class SshTui {
     piAiProviderProfile(provider) {
         if (provider === 'deepseek-official')
             return undefined;
-        const section = this.ctx.get('settings')?.get(settingsNamespace('llm-pi-ai'));
+        const section = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
         return section?.providers?.[provider];
     }
     /**
@@ -6428,7 +6436,7 @@ export class SshTui {
      * picker costs one listing instead of one per sibling.
      */
     async discoverGatewayListing(provider, signal) {
-        const llmPiAi = this.ctx.get('settings')?.get(settingsNamespace('llm-pi-ai'));
+        const llmPiAi = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
         const profile = this.piAiProviderProfile(provider);
         const source = openCodeSourceFor(provider, llmPiAi);
         const baseURL = typeof profile?.baseURL === 'string' && profile.baseURL.trim() !== ''
@@ -6821,7 +6829,7 @@ export class SshTui {
     }
     /** Persist a provider/model/effort choice and keep the subagent on the same family. */
     rememberedRoute(provider) {
-        const section = this.ctx.get('settings')?.get(ROUTE_MEMORY_NS);
+        const section = readSettingsSection(this.ctx, ROUTE_MEMORY_NS);
         const memory = section !== null && typeof section === 'object' && !Array.isArray(section)
             ? parseRouteMemory(section.providers)
             : {};
@@ -6870,7 +6878,7 @@ export class SshTui {
         const settings = this.ctx.get('settings');
         if (settings === undefined)
             return;
-        const section = settings.get(ROUTE_MEMORY_NS);
+        const section = readSettingsSection(this.ctx, ROUTE_MEMORY_NS);
         const memory = section !== null && typeof section === 'object' && !Array.isArray(section)
             ? parseRouteMemory(section.providers)
             : {};
@@ -6986,7 +6994,7 @@ export class SshTui {
         }
         if (settings !== undefined) {
             try {
-                await settings.replace(AGENT_DEFAULT_MODEL_SETTINGS_NAMESPACE, {
+                await settings.replace(AGENT_DEFAULT_MODEL_NS, {
                     provider: next.provider,
                     model: next.model,
                     ...(next.reasoningEffort === undefined ? {} : { reasoningEffort: String(next.reasoningEffort) }),
@@ -7586,7 +7594,7 @@ export class SshTui {
     }
     /** /mode: pick an agent preset (standard / minimal / ptc / cordis / routing-suite / ...). */
     async runModeCommand(arg = '') {
-        const agentPresets = this.ctx.get('agentPresets');
+        const agentPresets = this.presetService();
         const direct = arg.trim().toLowerCase();
         if (direct === 'fix' || direct === 'repair') {
             await this.repairRoster();
@@ -7601,13 +7609,7 @@ export class SshTui {
             const profile = profileFromArgv();
             this.pushRow({
                 kind: 'error',
-                text: [
-                    t('mode.missingService'),
-                    t('mode.missingServiceHint', {
-                        profile,
-                        patch: rosterPatchPath(resolveDshHome(), profile),
-                    }),
-                ].join('\n'),
+                text: this.missingPresetService(t('mode.missingService')),
             });
             this.markDirty();
             return;
@@ -7667,6 +7669,13 @@ export class SshTui {
         const selectedName = option.label;
         const hasWork = sessionEvents(this.agent.session).some(event => event.type === 'turn/start');
         if (!hasWork) {
+            // Feature-detected: a host whose registry predates `recompose` still
+            // lists presets, and switching then needs a restarted session.
+            if (typeof agentPresets.recompose !== 'function') {
+                this.pushRow({ kind: 'error', text: t('mode.noRecompose', { id: selected.id }) });
+                this.markDirty();
+                return;
+            }
             await agentPresets.recompose(this.agent.ctx, selected.id);
             this.presetId = selected.id;
             this.presetName = selectedName;
@@ -7690,13 +7699,40 @@ export class SshTui {
      */
     /** Re-read the roster fact this process was composed with (cheap, no IO). */
     refreshRosterHealth() {
-        this.rosterMissing = this.ctx.get('agentPresets') === undefined;
+        // 0.1.7 has no roster to be missing: what a terminal profile owns there is
+        // the agent-plane rows, so the chip reports those instead.
+        this.rosterMissing = this.settingsGeneration === 'forms'
+            ? !formsRowsDeclared(resolveDshHome(), profileFromArgv())
+            : this.ctx.get('agentPresets') === undefined;
+    }
+    /** Which settings protocol this host speaks; decides what "missing" means. */
+    get settingsGeneration() {
+        return hostSettingsGeneration(this.ctx);
+    }
+    /**
+     * The two lines `/mode` and `/preset` print when the preset service is absent.
+     *
+     * The reason differs by host line: 0.1.5 lost a roster the profile can mount,
+     * while 0.1.7 composes the agent process-wide and has no terminal presets at
+     * all — the repair there is the agent-plane rows, not a roster.
+     */
+    missingPresetService(first) {
+        const profile = profileFromArgv();
+        const patch = rosterPatchPath(resolveDshHome(), profile);
+        return this.settingsGeneration === 'forms'
+            ? [first, t('mode.formsHost'), t('mode.formsHint', { profile, patch })].join('\n')
+            : [first, t('mode.missingServiceHint', { profile, patch })].join('\n');
     }
     async repairRoster() {
         const profile = profileFromArgv();
         const patch = rosterPatchPath(resolveDshHome(), profile);
         try {
-            const result = await ensureRosterRows(resolveDshHome(), profile);
+            // Which rows are "the rows" is a host-line fact: 0.1.7 composes the agent
+            // process-wide and owns the agent-plane rows instead of the roster. Both
+            // the list and the header come from the same generation `/doctor` uses,
+            // or this writes rows the running host cannot resolve.
+            const generation = this.settingsGeneration;
+            const result = await ensureRosterRows(resolveDshHome(), profile, rosterRows(generation), generation);
             this.refreshRosterHealth();
             this.pushRow({
                 kind: 'system',
@@ -7817,7 +7853,7 @@ export class SshTui {
                 return;
             }
             const provider = this.currentProviderId();
-            const llmPiAi = this.ctx.get('settings')?.get(settingsNamespace('llm-pi-ai'));
+            const llmPiAi = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
             const source = openCodeSourceFor(provider, llmPiAi);
             if (source?.flavor === 'zen') {
                 this.pushRow({ kind: 'system', text: this.zenUsageText(source) });
@@ -7879,7 +7915,7 @@ export class SshTui {
      * neither gets nothing.
      */
     hasQuotaSurface(provider) {
-        const llmPiAi = this.ctx.get('settings')?.get(settingsNamespace('llm-pi-ai'));
+        const llmPiAi = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
         return providerHasQuotaSurface(provider, llmPiAi);
     }
     async refreshQuota(options) {
@@ -7938,7 +7974,7 @@ export class SshTui {
             const apiKey = await this.resolveCredential('DEEPSEEK_API_KEY');
             if (apiKey === undefined)
                 throw new Error(t('usage.noDeepseekKey'));
-            const section = this.ctx.get('settings')?.get(settingsNamespace('llm-deepseek'));
+            const section = readSettingsSection(this.ctx, settingsNamespace('llm-deepseek'));
             const baseURL = typeof section?.baseURL === 'string' && section.baseURL.trim() !== ''
                 ? section.baseURL.trim()
                 : (process.env.DEEPSEEK_BASE_URL?.trim() || DEEPSEEK_PUBLIC_BASE_URL);
@@ -8007,7 +8043,7 @@ export class SshTui {
                 return parseSuperGrokBilling(payload);
             }
         }
-        const llmPiAi = this.ctx.get('settings')?.get(settingsNamespace('llm-pi-ai'));
+        const llmPiAi = readSettingsSection(this.ctx, settingsNamespace('llm-pi-ai'));
         const commandCode = commandCodeSourceFor(provider, llmPiAi);
         if (commandCode !== null)
             return this.fetchCommandCodeQuota(commandCode);
@@ -9374,6 +9410,10 @@ export class SshTui {
         const shadowed = shadowing !== undefined && shadowing !== '';
         if (credentials !== undefined && !shadowed) {
             await credentials.set(credentialRef(envRef), key);
+            // The store writes it; we are the reason it exists. On Windows that write
+            // ignored any mode the store passed, so the file that holds every API key
+            // gets its ACL tightened here.
+            await restrictPathToUser(join(dshHomeDir(), '.credentials.yaml'), { mode: 0o600 });
             this.pushRow({ kind: 'system', text: t('onboard.credSaved', { env: envRef, path: displayDshPath('.credentials.yaml') }) });
             return;
         }
@@ -9384,13 +9424,13 @@ export class SshTui {
                 ? IS_WINDOWS
                     ? t('onboard.envShadowWin', { env: envRef })
                     : t('onboard.envShadowUnix', { env: envRef })
-                : t('onboard.credMissing', { path: displayDshPath(IS_WINDOWS ? 'env.cmd' : 'env.sh') }),
+                : t('onboard.credMissing', { path: displayDshPath(envFileName()) }),
         });
     }
     /** Write launch-environment overrides so they beat system-injected variables. */
     async writeLaunchEnv(entries) {
         const home = dshHomeDir();
-        const file = join(home, IS_WINDOWS ? 'env.cmd' : 'env.sh');
+        const file = join(home, envFileName());
         await mkdir(home, { recursive: true, mode: 0o700 });
         if (IS_WINDOWS) {
             let previous = '';
@@ -9414,6 +9454,10 @@ export class SshTui {
             const additions = Object.entries(entries).map(([name, value]) => `set "${name}=${value.replaceAll('"', '')}"`);
             const lines = ['@echo off', 'rem Generated by dsh-ssh-tui onboarding.', ...preserved, ...additions];
             await writeFile(file, `${lines.join('\r\n')}\r\n`, { mode: 0o600 });
+            // This file holds API keys. `mode` covers POSIX; on Windows the same
+            // intent has to be an ACL or the keys sit under whatever the parent
+            // directory allowed.
+            await restrictPathToUser(file, { mode: 0o600 });
             // Persist for future processes; best-effort, env.cmd remains as a manual fallback.
             await Promise.all(Object.entries(entries).map(([name, value]) => this.setWindowsEnv(name, value))).catch(() => { });
             return;
@@ -9437,6 +9481,7 @@ export class SshTui {
         });
         const additions = Object.entries(entries).map(([name, value]) => `export ${name}=${quote(value)}`);
         await writeFile(file, `${['# Generated by dsh-ssh-tui onboarding.', ...preserved, ...additions].join('\n')}\n`, { mode: 0o600 });
+        await restrictPathToUser(file, { mode: 0o600 });
         await this.ensurePosixEnvHook();
     }
     /** Persist one variable into the Windows user environment (best-effort). */
@@ -9699,6 +9744,16 @@ export class SshTui {
         this.leaveHistoryBrowse();
         this.write(osc52Clipboard(text));
         this.pushRow({ kind: 'system', text: notice });
+        // The write is a request the terminal may ignore: VTE (GNOME/XFCE/…) has
+        // never implemented OSC 52, conhost and screen cannot, Konsole only from
+        // 24.12, and xterm/tmux need configuration. The write still goes out — it is
+        // how the terminals that *do* honour it work — but where the table does not
+        // promise it the user is told once per session rather than at every copy, or
+        // not at all until they paste into an empty clipboard.
+        if (!this.terminalCaps.osc52 && !this.osc52HintShown) {
+            this.osc52HintShown = true;
+            this.pushRow({ kind: 'system', text: t('copy.osc52Hint', { terminal: this.terminalCaps.label }) });
+        }
         this.markDirty();
     }
     copyFocusedCard(arg = '') {
@@ -10388,7 +10443,16 @@ export function mountTui(ctx, config) {
         else
             process.exit(1);
     };
-    const disposeCreated = ctx.on('agent/created', ({ agent }) => start(agent));
+    // The explicit `return undefined` is deliberate, not noise: 0.1.6-alpha.2 turns
+    // `agent/created` into a serial event whose handler must return
+    // `undefined | Promise<undefined>`, and a bare `void` body is *not* assignable
+    // to that (verified by compiling this file against the published 0.1.6-alpha.2
+    // types: TS2322/TS2345). Returning `undefined` satisfies the whole 0.1.5 line
+    // too, so the handler is ready for the next line without a compat branch.
+    const disposeCreated = ctx.on('agent/created', ({ agent }) => {
+        start(agent);
+        return undefined;
+    });
     const disposeFailure = ctx.on('agent-loop/config-start-failed', ({ sessionId: failedSessionId, error }) => fail(failedSessionId, error));
     const stopWaiting = () => {
         disposeCreated();