dsh-tui-theme 0.6.1 → 0.7.1

package/scripts/validate-themes-against-host.mjs

@@ -100,8 +100,18 @@ assert.deepEqual(
   [...allKeys].sort(),
   'compiled theme keys must match the checked-out host source',
 )
-assert.ok(allKeys.length >= 90, 'host Theme key count drifted; re-check coverage')
-
+// The absolute key floor from the 96-key era does not survive the 0.10.1
+// semantic refactor (73 canonical keys); per-key coverage below is the real
+// guarantee, so the count is reported instead of pinned to a hardcoded floor.
+console.log(`* host Theme key count: ${allKeys.length} (coverage asserted per key)`)
+
+// The color keys the host's /settings screen paints with (screens/Settings.tsx
+// at the pinned baseline: promptBorder card frame, permission card title,
+// selectionBg focused row, suggestion/error/success/inactive/subtle row text
+// and checkbox chips, warning badges). Maintained by hand because the screen
+// has no exported key manifest; revisit this list whenever a dsh-TUI release
+// adds a Theme key to that screen — the per-key coverage assertion below then
+// fails loudly instead of shipping an unreadable settings card.
 const settingsKeys = [
   'promptBorder',
   'selectionBg',
@@ -185,7 +195,19 @@ const cases = [
   ['pink-night', 'success', '#55303E', 3.0],
   ['pink-night', 'inactive', '#55303E', 3.0],
   ['pink-day', 'text', '#F6F3ED', 4.5],
-  ['pink-day', 'claude', '#F6F3ED', 3.0],
+  // claude drives the 5-row header display font and bold+underlined markdown
+  // headings; the sakura-day identity deliberately goes one notch lighter
+  // (#DE6E96), so the large-text floor here is 2.5 instead of 3.0. Body-text
+  // readability stays guarded by the 4.5 `text` case above.
+  ['pink-day', 'claude', '#F6F3ED', 2.5],
+  // The DEEPSEEK pixel word's gradient end (claudeBlue_FOR_SYSTEM_SPINNER,
+  // 0.10.1 `activity`) was lightened one notch with the same sakura-day
+  // family move (#DE6E96 -> #E879A0), so the gradient reads as a fade. The
+  // measured 2.47 is accepted for this decorative gradient end and guarded
+  // here at 2.4 — the floor exists to catch further lightening, not to
+  // re-litigate the accepted 0.03 gap below the 2.5 large-text floor.
+  // Decision record: docs/decisions/2026-09-12-pink-day-claude-family-lightening.md
+  ['pink-day', 'claudeBlue_FOR_SYSTEM_SPINNER', '#F6F3ED', 2.4],
   ['pink-day', 'inactive', '#F6F3ED', 2.5],
   ['pink-day', 'success', '#F6F3ED', 3.0],
   ['pink-day', 'success', '#F3D7E0', 2.5],
@@ -196,12 +218,17 @@ const cases = [
 // ratio is assertable here — the host renders whatever the user's terminal
 // palette defines. Its settings keys are still covered by the per-theme
 // key-coverage assertions above.
+// Hosts >= 0.10.1 resolve built themes to canonical keys, so era keys read
+// their canonical names there; pre-refactor hosts keep the era keys.
+const semanticKeys = 'accent' in built['pink-night']
+const semanticAliases = { claude: 'accent', claudeBlue_FOR_SYSTEM_SPINNER: 'activity' }
 for (const [theme, key, background, minimum] of cases) {
-  const foregroundRgb = parseColor(built[theme][key])
+  const probeKey = (semanticKeys && semanticAliases[key]) || key
+  const foregroundRgb = parseColor(built[theme][probeKey])
   const backgroundRgb = parseColor(background)
-  assert.notEqual(foregroundRgb, undefined, `${theme}.${key} must be parseable`)
+  assert.notEqual(foregroundRgb, undefined, `${theme}.${probeKey} must be parseable`)
   const ratio = contrast(foregroundRgb, backgroundRgb)
-  assert.ok(ratio >= minimum, `${theme}.${key} contrast ${ratio.toFixed(2)} >= ${minimum}`)
+  assert.ok(ratio >= minimum, `${theme}.${probeKey} contrast ${ratio.toFixed(2)} >= ${minimum}`)
 }
 
 console.log(`OK host theme validation: ${Object.keys(built).length} themes, ${allKeys.length - 1} keys each, settings colors covered`)

package/scripts/verify-package.mjs

@@ -7,9 +7,14 @@ import { existsSync, readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import assert from 'node:assert/strict'
 
+// This repo deliberately ships no package-lock.json: the pinned host tarball
+// bundles @dsh-std/* packages whose manifests still declare workspace:*, and
+// npm replays a committed lockfile faithfully — every install (npm ci too)
+// dies with EUNSUPPORTEDPROTOCOL. Removing the lockfile makes npm skip the
+// bundled directories instead. The peer/dev consistency checks below therefore
+// read package.json only; CI's contract job guards the deletion (REVIEW.md G1).
 const pluginRoot = fileURLToPath(new URL('..', import.meta.url))
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
-const lockfile = JSON.parse(readFileSync(new URL('../package-lock.json', import.meta.url), 'utf8'))
 const packCommand = process.platform === 'win32'
   ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'npm pack --dry-run --json --ignore-scripts'] }
   : { file: 'npm', args: ['pack', '--dry-run', '--json', '--ignore-scripts'] }
@@ -44,6 +49,12 @@ for (const required of [
   'lib/types/runtimeThemes.d.ts',
   'lib/types/toast.js',
   'lib/types/toast.d.ts',
+  'lib/types/statusView.js',
+  'lib/types/statusView.d.ts',
+  'lib/types/ornament.js',
+  'lib/types/ornament.d.ts',
+  'lib/types/shadowCleanup.js',
+  'lib/types/shadowCleanup.d.ts',
   'themes/pink-night.json',
   'themes/pink-day.json',
   'themes/pink-ansi.json',
@@ -84,12 +95,10 @@ for (const name of Object.keys(packageJson.peerDependencies)) {
   assert.equal(devAccepted, true, `${name} dev pin must be accepted by its peer range`)
 }
 assert.equal(packageJson.dependencies?.['@deepseek-ai/schemastery'], undefined)
-const rootLock = lockfile.packages?.['']
-assert.ok(rootLock, 'lockfile must have root metadata')
-assert.equal(lockfile.version, packageJson.version)
-assert.deepEqual(rootLock.devDependencies, packageJson.devDependencies)
-assert.deepEqual(rootLock.peerDependencies, packageJson.peerDependencies)
-assert.equal(rootLock.dependencies, undefined)
+// The lockfile's root metadata is deliberately not compared here: this script
+// also ships inside the published tarball (package.json `files`), and npm never
+// packs a lockfile, so the check could not hold for a consumer. The repo-level
+// lockfile invariant lives in the CI contract job instead (REVIEW.md G1).
 assert.equal(existsSync(new URL('../lib/types/index.js', import.meta.url)), true)
 
 console.log(`✓ package manifest: ${packed.name}@${packed.version}, ${files.size} files`)

package/scripts/verify.mjs

@@ -64,12 +64,14 @@ const applyAndSettle = async (ctx, config) => {
 }
 
 /** A stub Cordis-like context; every seam optional and recorded. */
-function makeStubCtx({ status, sections, settingsService, themes, toast, deferThemes = false, deferToast = false } = {}) {
+function makeStubCtx({ status, sections, settingsService, themes, toast, dialogs, deferThemes = false, deferToast = false, deferDialogs = false } = {}) {
   const record = { handlers: new Map(), disposers: [], statusCalls: [], sectionsCalls: [], registerCalls: [], watchers: [], themeRegisters: [], warnings: [], infos: [] }
   let availableThemes = themes
   let availableToast = toast
+  let availableDialogs = dialogs
   const deferredThemeCallbacks = []
   const deferredToastCallbacks = []
+  const deferredDialogsCallbacks = []
   const logger = { info: msg => record.infos.push(String(msg)), warn: msg => record.warnings.push(String(msg)), error: () => {} }
   const base = {
     logger,
@@ -78,6 +80,7 @@ function makeStubCtx({ status, sections, settingsService, themes, toast, deferTh
       if (serviceName === 'tuiSettingsSections') return sections
       if (serviceName === 'tuiThemes') return availableThemes
       if (serviceName === 'tuiToast') return availableToast
+      if (serviceName === 'tuiDialogs') return availableDialogs
       return undefined
     },
     on(event, handler) {
@@ -99,6 +102,7 @@ function makeStubCtx({ status, sections, settingsService, themes, toast, deferTh
         tuiSettingsSections: sections,
         tuiThemes: availableThemes,
         tuiToast: availableToast,
+        tuiDialogs: availableDialogs,
       }
       if (deferThemes && availableThemes === undefined && deps.includes('tuiThemes')) {
         deferredThemeCallbacks.push(callback)
@@ -108,6 +112,10 @@ function makeStubCtx({ status, sections, settingsService, themes, toast, deferTh
         deferredToastCallbacks.push(callback)
         return
       }
+      if (deferDialogs && availableDialogs === undefined && deps.includes('tuiDialogs')) {
+        deferredDialogsCallbacks.push(callback)
+        return
+      }
       if (deps.every(dep => services[dep] !== undefined)) {
         const props = Object.fromEntries(deps.map(dep => [dep, services[dep]]))
         callback({ ...base, ...props })
@@ -122,10 +130,29 @@ function makeStubCtx({ status, sections, settingsService, themes, toast, deferTh
     availableToast = service
     for (const callback of deferredToastCallbacks.splice(0)) callback({ ...base, tuiToast: service })
   }
+  record.activateDialogs = service => {
+    availableDialogs = service
+    for (const callback of deferredDialogsCallbacks.splice(0)) callback({ ...base, tuiDialogs: service })
+  }
   return { ctx: base, record }
 }
 
 const fakeStatus = calls => ({ set(key, text) { calls.push([key, text]); return () => {} } })
+/**
+ * A 0.10.1+ status service: registerView present. `refuse` simulates the
+ * host rejecting the registration (returns undefined, warning invisible);
+ * `throws` simulates a hostile service whose registration throws — the
+ * plugin must warn and fall back, never propagate.
+ */
+const fakeRichStatus = (calls, viewCalls, { refuse = false, throws = false } = {}) => ({
+  set(key, text) { calls.push([key, text]); return () => {} },
+  registerView(descriptor, identity) {
+    viewCalls.push([descriptor, identity])
+    if (throws) throw new Error('status view registry unavailable')
+    if (refuse) return undefined
+    return () => {}
+  },
+})
 const fakeSections = calls => ({ register(section) { calls.push(section); return () => {} } })
 const fakeThemes = (record, { throws = false } = {}) => ({
   register(descriptor, identity) {
@@ -155,6 +182,18 @@ const fakeToast = (deliveries, { dropFirst = 0 } = {}) => {
     },
   }
 }
+/**
+ * A tuiDialogs stub: records confirm requests, answers them from the test
+ * via the returned queue (each entry resolves one dialog).
+ */
+const fakeDialogs = (requests, answers) => ({
+  confirm(owner, request) {
+    requests.push({ owner, request })
+    return new Promise(resolve => {
+      answers.push(resolve)
+    })
+  },
+})
 
 const emit = (record, event, ...args) => {
   for (const handler of record.handlers.get(event) ?? []) handler(...args)
@@ -611,6 +650,31 @@ const emit = (record, event, ...args) => {
   console.log('✓ follow logging: baseline docs stay quiet, real toggles still log')
 }
 
+// ── 12c. unreadable bundled source: the directory-level failure stays precise ──
+{
+  const targetDir = join(sandboxHome, 'source-fail-target')
+  const sourceDir = join(pluginRoot, 'themes')
+  const originalReaddir = builtinFs.readdirSync
+  try {
+    builtinFs.readdirSync = (path, ...rest) => {
+      if (String(path) === sourceDir) throw new Error('EACCES: source unreadable')
+      return originalReaddir(path, ...rest)
+    }
+    syncBuiltinESMExports()
+    const result = installBundledThemes(targetDir, sourceDir)
+    assert.deepEqual(result.failed, [], 'no per-file failure exists when nothing was attempted')
+    assert.match(
+      result.sourceError ?? '',
+      /could not read bundled themes from .*themes.*EACCES/,
+      'the directory-level error names the source and the cause',
+    )
+  } finally {
+    builtinFs.readdirSync = originalReaddir
+    syncBuiltinESMExports()
+  }
+  console.log('✓ unreadable bundled source: precise sourceError, no bogus per-file failure')
+}
+
 // ── 12. status injection: session handlers die with tuiStatus activation ────
 {
   const outerHandlers = new Map()
@@ -884,8 +948,9 @@ const emit = (record, event, ...args) => {
     assert.equal(statusCalls.length, baselineCalls, 'firehose events render nothing')
     assert.equal(prefReads, 0, 'firehose events never read the theme pref')
 
-    // A turn boundary renders — served by the warm pref cache (no disk hit
-    // within the TTL), so even boundary renders stay off the filesystem.
+    // A turn boundary renders — the mtime gate costs one stat (not counted
+    // here), and the warm cache answers without a read, so even boundary
+    // renders stay off the read path.
     emit(record, 'session/event', session, { type: 'turn/end' })
     assert.equal(statusCalls.length, baselineCalls + 1, 'a turn boundary renders')
     assert.equal(prefReads, 0, 'the warm cache serves the boundary render')
@@ -897,18 +962,28 @@ const emit = (record, event, ...args) => {
     assert.match(statusCalls.at(-1)[1], /0✦$/)
     assert.equal(prefReads, 0)
 
-    // Inside the TTL a pref rewrite is not yet visible and costs no read…
+    // A pref rewrite (the host's /theme switch) is seen at the very next
+    // render: the stat notices the moved mtime and pays exactly one re-read,
+    // and the non-pink pref hides the line — no waiting out the TTL (the
+    // stale window used to show as wrong rich-view colors).
     writeFileSync(themePrefPath, JSON.stringify({ theme: 'dark' }, null, 2))
     emit(record, 'session/event', nextSession, { type: 'turn/end' })
     assert.equal(statusCalls.length, baselineCalls + 3)
-    assert.match(statusCalls.at(-1)[1], /1✦$/, 'the cached pink pref keeps the line visible')
-    assert.equal(prefReads, 0, 'the TTL serves the stale-but-pink answer without I/O')
+    assert.equal(statusCalls.at(-1)[1], undefined, 'the pref rewrite is seen at the next render')
+    assert.equal(prefReads, 1, 'the moved mtime costs exactly one re-read')
+
+    // An unchanged pref keeps the cache warm: the render reruns, but the
+    // hidden line's text is unchanged so set() is deduplicated away, and
+    // no read happens.
+    emit(record, 'session/event', nextSession, { type: 'turn/end' })
+    assert.equal(statusCalls.length, baselineCalls + 3, 'an unchanged line does not rewrite the store')
+    assert.equal(prefReads, 1, 'the unchanged mtime serves the cache')
 
-    // …after invalidation (TTL expiry in production) the next render re-reads.
+    // Test-only invalidation (the TTL-expiry stand-in) re-reads too.
     invalidateThemePrefCacheForTests()
     emit(record, 'session/event', nextSession, { type: 'turn/end' })
-    assert.equal(prefReads, 1, 'invalidation re-reads the pref exactly once')
-    assert.equal(statusCalls.at(-1)[1], undefined, 'the non-pink pref hides the line')
+    assert.equal(prefReads, 2, 'invalidation re-reads the pref exactly once')
+    assert.equal(statusCalls.at(-1)[1], undefined, 'the non-pink pref keeps the line hidden')
   } finally {
     builtinFs.readFileSync = originalRead
     syncBuiltinESMExports()
@@ -917,5 +992,298 @@ const emit = (record, event, ...args) => {
   console.log('✓ hot path: firehose events render nothing and never read the pref; boundaries use the cache')
 }
 
+// ── 15. settings panel UX: groups, ornament drafts, follow format ───────────
+{
+  const dataDir = join(sandboxHome, '.dsh-tui')
+  rmSync(dataDir, { recursive: true, force: true })
+  mkdirSync(dataDir, { recursive: true })
+  writeFileSync(join(dataDir, 'theme.json'), JSON.stringify({ theme: 'pink-night' }, null, 2))
+  invalidateThemePrefCacheForTests()
+  const statusCalls = []
+  const sectionsCalls = []
+  const settingsRecord = { registerCalls: [], watchers: [] }
+  const { ctx, record } = makeStubCtx({
+    status: fakeStatus(statusCalls),
+    sections: fakeSections(sectionsCalls),
+    settingsService: fakeSettingsService(settingsRecord, {}),
+  })
+  await applyAndSettle(ctx)
+  const section = sectionsCalls[0]
+  const fieldByPath = path =>
+    section.fields.find(field => JSON.stringify(field.path) === JSON.stringify(path))
+
+  // Navigation groups: two subpages, every field assigned.
+  assert.deepEqual(
+    section.groups.map(group => group.id).sort(),
+    ['follow', 'status-line'],
+  )
+  assert.equal(fieldByPath(['followSystem']).group, 'follow')
+  for (const path of [['showGlyph'], ['statusGlyph'], ['showClock'], ['showTurns'], ['statusSeparator'], ['statusScope']]) {
+    assert.equal(fieldByPath(path).group, 'status-line')
+  }
+
+  // Ornament draft gate: 1–2 display cells, control chars refused, empty
+  // resets to the built-in default, unset displays the effective value.
+  const glyph = fieldByPath(['statusGlyph'])
+  assert.equal(glyph.kind, 'text')
+  assert.deepEqual(glyph.parse(''), { kind: 'clear' })
+  assert.deepEqual(glyph.parse('❀'), { kind: 'set', value: '❀' })
+  assert.deepEqual(glyph.parse('樱'), { kind: 'set', value: '樱' }, 'a 2-cell CJK char is allowed')
+  assert.equal(glyph.parse('abc'), undefined, '3 cells are rejected')
+  assert.equal(glyph.parse('a\u0007b'), undefined, 'control characters are rejected')
+  assert.deepEqual(glyph.parse(' \u00A0 '), { kind: 'clear' }, 'whitespace-only drafts reset to the default')
+  assert.equal(glyph.format(undefined), '✿', 'unset shows the effective default')
+  assert.equal(glyph.format('❀'), '❀')
+  const separator = fieldByPath(['statusSeparator'])
+  assert.equal(separator.kind, 'text')
+  assert.deepEqual(separator.parse('✦'), { kind: 'set', value: '✦' })
+  assert.equal(separator.format(undefined), '·')
+
+  // followSystem format surfaces the cached follow state the startup would
+  // consult — the "toggled on, nothing happened" reason, on the surface.
+  const follow = fieldByPath(['followSystem'])
+  assert.equal(follow.format(undefined), 'off', 'the cordis layer default is off')
+  assert.equal(follow.format(false), 'off')
+  assert.equal(follow.format(true), 'on（无缓存，启动时不动）')
+  writeFileSync(join(dataDir, 'theme-follow.json'), JSON.stringify({ light: true, at: Date.UTC(2026, 8, 12) }))
+  assert.match(follow.format(true), /^on（缓存: light · \d{4}-\d{2}-\d{2}）$/)
+  writeFileSync(join(dataDir, 'theme-follow.json'), JSON.stringify({ light: false }))
+  assert.equal(follow.format(true), 'on（缓存: dark）', 'a cache without a timestamp omits the date')
+
+  // A committed ornament edit lands live on the scalar line.
+  for (const watcher of settingsRecord.watchers) {
+    watcher({ statusGlyph: '❀', statusSeparator: '~' })
+  }
+  emit(record, 'session/event', { id: 'u1' }, { type: 'turn/end' })
+  assert.match(statusCalls.at(-1)[1], /^❀ ~ \d{2}:\d{2} ~ 1✦$/)
+
+  // Hand-edited config layers bypass the draft gate; the render side
+  // sanitizes anyway (control chars stripped, capped at 2 cells).
+  for (const watcher of settingsRecord.watchers) {
+    watcher({ statusGlyph: 'x\u0007yz', statusSeparator: '~' })
+  }
+  emit(record, 'session/event', { id: 'u1' }, { type: 'turn/end' })
+  assert.match(statusCalls.at(-1)[1], /^xy ~ /, 'control chars stripped and the rest capped at 2 cells')
+  console.log('✓ settings panel: two groups, ornament drafts gated, follow format shows the cache state')
+}
+
+// ── 16. rich status view: themed one-row view on registerView-capable hosts ─
+{
+  const themePrefPath = join(sandboxHome, '.dsh-tui', 'theme.json')
+  writeFileSync(themePrefPath, JSON.stringify({ theme: 'pink-night' }, null, 2))
+  invalidateThemePrefCacheForTests()
+  const statusCalls = []
+  const viewCalls = []
+  const settingsRecord = { registerCalls: [], watchers: [] }
+  const { ctx, record } = makeStubCtx({
+    status: fakeRichStatus(statusCalls, viewCalls),
+    sections: fakeSections([]),
+    settingsService: fakeSettingsService(settingsRecord, {}),
+  })
+  await applyAndSettle(ctx)
+
+  assert.equal(viewCalls.length, 1, 'the rich view is registered exactly once')
+  assert.equal(statusCalls.length, 0, 'the rich path never writes scalar text')
+  const [descriptor, identity] = viewCalls[0]
+  assert.equal(descriptor.key, 'dsh-tui-theme', 'the rich view keeps the shared contribution key')
+  assert.equal(descriptor.maxRows, 1)
+  assert.equal(typeof descriptor.component, 'function')
+  assert.equal(identity?.tuiStatus !== undefined, true, 'identity is the inject-scoped context')
+
+  // Render the component against a minimal fake of the host kit: the element
+  // tree must map the snapshot to themed Text cells.
+  const renderComponent = () =>
+    descriptor.component({
+      React: {
+        createElement: (type, props, ...children) => ({ type, props, children: children.length === 1 && Array.isArray(children[0]) ? children[0] : children }),
+        useSyncExternalStore: (_subscribe, getSnapshot) => getSnapshot(),
+      },
+      ui: { Box: 'box', Text: 'text' },
+    })
+  const element = renderComponent()
+  assert.equal(element.type, 'box', 'one row Box')
+  assert.equal(element.children[0].type, 'text')
+  assert.equal(element.children[0].props.color, 'rgb(242,123,166)', 'the glyph uses the brand key of the active palette')
+  assert.equal(element.children[0].children[0], '✿')
+  assert.equal(element.children[1].props.color, '#77646D', 'the separator uses the subtle key')
+  assert.match(element.children[2].children[0], /^\d{2}:\d{2}$/)
+  assert.equal(element.children[2].props.color, '#C4B0B9', 'the clock uses the bottom-bar inactiveShimmer key')
+
+  // Turn boundaries push through the store and land in the next render.
+  const session = { id: 'r1' }
+  emit(record, 'session/event', session, { type: 'turn/end' })
+  const withTurns = renderComponent()
+  assert.equal(withTurns.children.at(-1).children[0], '1✦')
+  assert.equal(withTurns.children.at(-1).props.color, '#C4B0B9')
+
+  // A /theme switch (the host rewrites the pref) lands at the very next
+  // render: rewrite the pref to pink-day and the palette moves with it,
+  // without any TTL wait.
+  writeFileSync(themePrefPath, JSON.stringify({ theme: 'pink-day' }, null, 2))
+  emit(record, 'session/event', session, { type: 'turn/end' })
+  const dayView = renderComponent()
+  assert.equal(dayView.children[0].props.color, 'rgb(222,110,150)', 'the glyph follows the new palette')
+  assert.equal(dayView.children[2].props.color, '#9E6E82', 'the clock follows the new palette immediately')
+
+  // Toggles fold into the snapshot: all off renders nothing (no scalar
+  // fallback either — the rich view just shows nothing).
+  for (const watcher of settingsRecord.watchers) {
+    watcher({ showGlyph: false, showClock: false, showTurns: false })
+  }
+  emit(record, 'session/event', session, { type: 'turn/end' })
+  assert.equal(renderComponent(), null, 'all toggles off render nothing')
+
+  // Master switch off: registered but never visible.
+  const quietCalls = []
+  const quietViews = []
+  const quietCtx = makeStubCtx({ status: fakeRichStatus(quietCalls, quietViews) })
+  await applyAndSettle(quietCtx.ctx, { statusEnabled: false })
+  assert.equal(quietViews.length, 1, 'the view is still registered')
+  assert.equal(
+    quietViews[0][0].component({
+      React: {
+        createElement: (type, props, ...children) => ({ type, props, children: children.length === 1 && Array.isArray(children[0]) ? children[0] : children }),
+        useSyncExternalStore: (_subscribe, getSnapshot) => getSnapshot(),
+      },
+      ui: { Box: 'box', Text: 'text' },
+    }),
+    null,
+    'statusEnabled=false renders nothing',
+  )
+  console.log('✓ rich status view: themed cells from the palette, mutual exclusion from set()')
+}
+
+// ── 17. refused rich registration falls back to the scalar path ─────────────
+{
+  const statusCalls = []
+  const viewCalls = []
+  const { ctx } = makeStubCtx({ status: fakeRichStatus(statusCalls, viewCalls, { refuse: true }) })
+  await applyAndSettle(ctx)
+  assert.equal(viewCalls.length, 1, 'the registration was attempted')
+  assert.equal(statusCalls.length > 0, true, 'a refused registration (undefined) falls back to set()')
+  console.log('✓ refused rich registration: the scalar path keeps the line alive')
+}
+
+// ── 17b. hostile rich registration throws: warn, fall back, never propagate ─
+{
+  const statusCalls = []
+  const viewCalls = []
+  const { ctx, record } = makeStubCtx({ status: fakeRichStatus(statusCalls, viewCalls, { throws: true }) })
+  // applyAndSettle resolving at all is the non-propagation half of the
+  // invariant: a synchronous throw escaping the inject callback would land here.
+  await applyAndSettle(ctx)
+  assert.equal(viewCalls.length, 1, 'the registration was attempted')
+  assert.equal(statusCalls.length > 0, true, 'a throwing registration falls back to set()')
+  assert.equal(
+    record.warnings.some(msg => msg.includes('rich status view registration failed')),
+    true,
+    'the failure is warned, never propagated',
+  )
+  assert.equal(
+    (record.handlers.get('session/event') ?? []).length >= 1,
+    true,
+    'the session wiring survived the throw',
+  )
+  console.log('✓ hostile rich registration: warn + scalar fallback, session wiring intact')
+}
+
+// ── 18. shadow cleanup dialog: one confirm, byte-checked deletion ───────────
+{
+  const seedShadow = () => {
+    rmSync(sandboxThemes, { recursive: true, force: true })
+    mkdirSync(sandboxThemes, { recursive: true })
+    for (const theme of ['pink-night', 'pink-day', 'pink-ansi']) {
+      writeFileSync(join(sandboxThemes, `${theme}.json`), readFileSync(join(pluginRoot, 'themes', `${theme}.json`), 'utf8'))
+    }
+  }
+
+  // 18a. Dialog answered with "delete": the byte-identical copies are
+  // removed and the result is toasted.
+  seedShadow()
+  const requests = []
+  const answers = []
+  const cleanDeliveries = []
+  const cleanContext = makeStubCtx({
+    deferThemes: true,
+    toast: fakeToast(cleanDeliveries),
+    dialogs: fakeDialogs(requests, answers),
+  })
+  apply(cleanContext.ctx)
+  cleanContext.record.activateThemes(fakeThemes(cleanContext.record))
+  await settle()
+  assert.equal(requests.length, 1, 'exactly one confirm dialog is offered')
+  assert.equal(requests[0].owner?.tuiDialogs !== undefined, true, 'the owner is the inject-scoped context')
+  for (const file of ['pink-night.json', 'pink-day.json', 'pink-ansi.json']) {
+    assert.ok(requests[0].request.message.includes(file), `the dialog names ${file}`)
+  }
+  assert.ok(requests[0].request.title.includes('旧主题文件'))
+  answers[0](true)
+  await settle()
+  assert.equal(existsSync(join(sandboxThemes, 'pink-night.json')), false, 'confirmation removes the shadowing copy')
+  assert.equal(existsSync(join(sandboxThemes, 'pink-day.json')), false, 'confirmation removes the shadowing copy')
+  assert.equal(existsSync(join(sandboxThemes, 'pink-ansi.json')), false, 'confirmation removes the shadowing copy')
+  const cleanToast = cleanDeliveries.find(delivery => delivery[0].includes('已清理'))
+  assert.ok(cleanToast, 'the cleanup result is toasted')
+  assert.equal(cleanToast[1], 'success')
+
+  // 18b. Declining keeps the previous behavior exactly: files stay, no
+  // cleanup toast.
+  seedShadow()
+  const declineRequests = []
+  const declineAnswers = []
+  const declineDeliveries = []
+  const declineContext = makeStubCtx({
+    deferThemes: true,
+    toast: fakeToast(declineDeliveries),
+    dialogs: fakeDialogs(declineRequests, declineAnswers),
+  })
+  apply(declineContext.ctx)
+  declineContext.record.activateThemes(fakeThemes(declineContext.record))
+  await settle()
+  assert.equal(declineRequests.length, 1, 'the dialog is offered again for the new activation')
+  declineAnswers[0](false)
+  await settle()
+  assert.equal(existsSync(join(sandboxThemes, 'pink-night.json')), true, 'declining keeps the file')
+  assert.equal(
+    declineDeliveries.some(delivery => delivery[0].includes('已清理')),
+    false,
+    'no cleanup toast without a confirmation',
+  )
+
+  // 18c. The dialogs seam arriving late still asks exactly once; a file the
+  // user edited between detection and confirmation is never deleted.
+  seedShadow()
+  writeFileSync(join(sandboxThemes, 'pink-day.json'), '{ "name": "pink-day", "colors": { "text": "#123456" } }')
+  const lateRequests = []
+  const lateAnswers = []
+  const lateContext = makeStubCtx({ deferThemes: true, deferDialogs: true, toast: fakeToast([]) })
+  apply(lateContext.ctx)
+  lateContext.record.activateThemes(fakeThemes(lateContext.record))
+  await settle()
+  assert.equal(lateRequests.length, 0, 'no dialog before the seam arrives')
+  lateContext.record.activateDialogs(fakeDialogs(lateRequests, lateAnswers))
+  await settle()
+  assert.equal(lateRequests.length, 1, 'the parked offer fires when the seam arrives')
+  lateAnswers[0](true)
+  await settle()
+  assert.equal(existsSync(join(sandboxThemes, 'pink-night.json')), false, 'the still-identical file is removed')
+  assert.equal(existsSync(join(sandboxThemes, 'pink-day.json')), true, 'the edited file survives the byte check')
+  assert.equal(existsSync(join(sandboxThemes, 'pink-ansi.json')), false)
+
+  // 18d. A hostile dialogs service must not take the activation down.
+  seedShadow()
+  const hostileContext = makeStubCtx({
+    deferThemes: true,
+    dialogs: { confirm() { throw new Error('dialog machinery broken') } },
+  })
+  apply(hostileContext.ctx)
+  hostileContext.record.activateThemes(fakeThemes(hostileContext.record))
+  await settle()
+  assert.equal(existsSync(join(sandboxThemes, 'pink-night.json')), true, 'a failed dialog deletes nothing')
+
+  rmSync(sandboxThemes, { recursive: true, force: true })
+  console.log('✓ shadow cleanup dialog: offered once, byte-checked deletion, decline/late/hostile all safe')
+}
+
 console.log('\nAll plugin verifications passed.')
 console.log(`(sandbox used: ${sandboxHome} — the real home was never touched)`)

package/themes/pink-day.json

@@ -5,12 +5,12 @@
   "colors": {
     "autoAccept": "#8F6BAC",
     "bashBorder": "#C05C7E",
-    "claude": "#D5517F",
+    "claude": "rgb(222,110,150)",
     "toolNameMutate": "#8A6A00",
     "toolNameExec": "#0E7A8A",
-    "claudeShimmer": "#E879A0",
-    "claudeBlue_FOR_SYSTEM_SPINNER": "#D5517F",
-    "claudeBlueShimmer_FOR_SYSTEM_SPINNER": "#E879A0",
+    "claudeShimmer": "rgb(242,160,191)",
+    "claudeBlue_FOR_SYSTEM_SPINNER": "rgb(232,121,160)",
+    "claudeBlueShimmer_FOR_SYSTEM_SPINNER": "rgb(242,160,191)",
     "permission": "#D5517F",
     "permissionShimmer": "#E879A0",
     "planMode": "#43916B",

package/themes/pink-night.json

@@ -5,12 +5,12 @@
   "colors": {
     "autoAccept": "#B598D9",
     "bashBorder": "#E08CA8",
-    "claude": "#F27BA6",
+    "claude": "rgb(242,123,166)",
     "toolNameMutate": "#E5C07B",
     "toolNameExec": "#72C4CF",
-    "claudeShimmer": "#F8AFC6",
-    "claudeBlue_FOR_SYSTEM_SPINNER": "#F27BA6",
-    "claudeBlueShimmer_FOR_SYSTEM_SPINNER": "#F8AFC6",
+    "claudeShimmer": "rgb(248,175,198)",
+    "claudeBlue_FOR_SYSTEM_SPINNER": "rgb(242,123,166)",
+    "claudeBlueShimmer_FOR_SYSTEM_SPINNER": "rgb(248,175,198)",
     "permission": "#F2A0BF",
     "permissionShimmer": "#F8C1D6",
     "planMode": "#7FB596",