dsh-url-router 0.4.2 → 0.4.3

package/lib/client.js

@@ -78,7 +78,69 @@ window.__ModuleLoader__.load({
 		// another router's route may legitimately be pasted in.
 		// ---------------------------------------------------------------------
 		/** Route kind aliases accepted on input. */
-		const ROUTE_ALIASES = { session: 'session', sessions: 'session', panel: 'panel', panels: 'panel', settings: 'settings', workspace: 'workspace', workspaces: 'workspace' }
+		const ROUTE_ALIASES = { session: 'session', sessions: 'session', panel: 'panel', panels: 'panel', settings: 'settings', power: 'power', workspace: 'workspace', workspaces: 'workspace' }
+		/**
+		 * The power actions a link may name, and the endpoint the power plugin publishes for each.
+		 *
+		 * These are *commands*, not places: a URL that carries one ends the whole application (or
+		 * restarts it), so a fragment that names one is honoured only when the reader typed it into
+		 * the address bar themselves — never when it arrived as a hash change from a link somebody
+		 * else wrote. `dsh-power-menu` already exposes both endpoints (`POST
+		 * /api/dsh-power-menu/{shutdown,restart}`), so no click and no cooperation is needed.
+		 */
+		const POWER_ACTIONS = { shutdown: 'shutdown', restart: 'restart' }
+		/**
+		 * The bases the power actions live under, in the order they are tried.
+		 *
+		 * Two packages publish the same two actions under different paths: the desktop build ships
+		 * `dsh-power-menu-mac` (`/api/dsh-power-menu-mac`) while the plain package uses
+		 * `/api/dsh-power-menu`. Measured 2026-10-29: posting to the wrong one is a silent 404, which
+		 * is exactly how "cannot restart" looked — so both are tried, and a wrong base costs nothing.
+		 */
+		const POWER_ACTION_BASES = ['/api/dsh-power-menu-mac', '/api/dsh-power-menu']
+		/**
+		 * How many drive steps the plugin's own menu gets before the endpoint is used instead.
+		 *
+		 * The drive retries every half second, so this is a couple of seconds: long enough for the
+		 * menu to render, short enough that a plugin which never publishes the item still acts.
+		 */
+		const POWER_ACTION_MENU_LIMIT = 4
+
+		/**
+		 * The power plugin's own menu, when it is on screen.
+		 *
+		 * Contract attribute first (`data-dshpm-menu`), then the class the plugin ships. Neither is
+		 * guessed at: an unreadable menu sends the drive down the endpoint fallback instead.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the menu root.
+		 */
+		function powerMenuOf(document) {
+			const contracted = attemptValue(() => document?.querySelector?.('[data-dshpm-menu]'))
+			if (contracted !== undefined && contracted !== null) return contracted
+			const known = attemptValue(() => document?.getElementsByClassName?.('dshpm-menu')?.[0])
+			return known === undefined || known === null ? undefined : known
+		}
+
+		/**
+		 * The power action a route names, if any.
+		 * @param {string} id - the route's identity segment.
+		 * @returns {string|undefined} the action.
+		 */
+		function powerActionOf(id) {
+			if (typeof id !== 'string') return undefined
+			return Object.prototype.hasOwnProperty.call(POWER_ACTIONS, id) ? POWER_ACTIONS[id] : undefined
+		}
+		/**
+		 * The power menu: a transient popover rendered by a separate plugin, and the one surface
+		 * this router does not own. Its contract is an attribute; the class names are the fallback
+		 * for a build that has not added it yet.
+		 */
+		/** How many times one link may press the settings launcher while no menu appears. */
+		const SETTINGS_PRESS_LIMIT = 3
+		const POWER_MENU_ATTRIBUTE = 'data-dsh-power-menu'
+		const POWER_MENU_CLASS = 'dshpm-menu'
+		const POWER_TRIGGER_ATTRIBUTE = 'data-dsh-power-trigger'
+		const POWER_TRIGGER_CLASS = 'dshpm-trigger'
 		/** Attribute the settings overlay puts on its root element. */
 		const SETTINGS_SURFACE_ATTRIBUTE = 'data-dsh-surface'
 		/**
@@ -93,6 +155,8 @@ window.__ModuleLoader__.load({
 		const SETTINGS_SURFACE_VALUE = 'settings'
 		/** Slot the settings entry is rendered into (its button opens the overlay). */
 		const SETTINGS_TRIGGER_SLOT = 'sidebar.settings'
+		/** Slot the settings sections are registered into — the same list the shell renders. */
+		const SETTINGS_SECTION_SLOT = 'settings.section'
 		/** Canonical fragment shape, plus the bare `#/<kind>` form a modal surface uses. */
 		const ROUTE_PATTERN = /^#\/?([a-z][a-z0-9-]*)(?:\/(.+))?$/
 		/** How often an unsatisfied link is retried while it is authoritative. */
@@ -137,6 +201,48 @@ window.__ModuleLoader__.load({
 		const TURN_SEGMENT = 'turn'
 		/** Inner segment that names the right-hand pane in front. */
 		const PANE_SEGMENT = 'pane'
+		/**
+		 * The parent of a subagent session, as a decoration after the session id.
+		 *
+		 * A subagent session is a session of its own (it opens, it has turns and links), but the
+		 * printed id says nothing about *whose* subagent it is. The catalog knows: the session
+		 * controller resolves a child's durable (parent, child) address without opening anything.
+		 * The parent is written like a workspace name — decoration, never the thing that lands.
+		 */
+		const SUBAGENT_SEGMENT = 'subagent-of'
+		/**
+		 * Segment names other parsers look for, so a decoration never becomes one.
+		 *
+		 * The parent of a subagent is written as a readable segment when the catalog has a title.
+		 * Those parsers (`viewIdOfRoute`, the turn/row/pane lookups) search by segment name, so a
+		 * title that *is* one of these names would be read as a position. Such a title falls back
+		 * to the parent id instead.
+		 */
+		const ROUTE_RESERVED_TOKENS = new Set(['turn', 'row', 'view', 'pane', 'subagent-of', 'provider', 'filter', 'task', 'rule', 'records', 'session', 'workspace', 'settings', 'panel'])
+		/** How long a title may be inside a route before it is clipped. */
+		const SUBAGENT_TITLE_LIMIT = 80
+		/**
+		 * Whether a route segment is a session id (a uuid, with or without the `session-` prefix).
+		 *
+		 * The subagent decoration is a title when the catalog has one and the parent id otherwise,
+		 * so the drive has to tell the two apart: an id is opened by address, anything else is a
+		 * label and the child is opened by its own id.
+		 * @param {unknown} value - the segment.
+		 * @returns {boolean} whether it reads as a session id.
+		 */
+		function isSessionIdLike(value) {
+			return typeof value === 'string' && /^(?:session-)?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(value.trim())
+		}
+		/**
+		 * The readable name of a subagent's parent, or its id when there is no usable title.
+		 * @param {object} parent - `{ id, title }` from the catalog.
+		 * @returns {string} the segment to write.
+		 */
+		function subagentDecorationOf(parent) {
+			const title = typeof parent?.title === 'string' ? parent.title.trim().replace(/\s+/gu, ' ') : ''
+			const usable = title !== '' && !ROUTE_RESERVED_TOKENS.has(title.toLowerCase())
+			return usable ? title.slice(0, SUBAGENT_TITLE_LIMIT) : String(parent?.id ?? '')
+		}
 		/** Service the right-hand pane registers, whose snapshot names the active tab. */
 		const SIDEBAR_RIGHT_SERVICE = 'sidebarRightTabs'
 		/** Panel id of the official plugin manager, whose list rows and detail pages are routed. */
@@ -166,14 +272,14 @@ window.__ModuleLoader__.load({
 		 * The router's own version, for the report a human files. A test keeps it equal to the
 		 * package version, so a release cannot forget to bump it.
 		 */
-		const ROUTER_VERSION = '0.4.2'
+		const ROUTER_VERSION = '0.4.3'
 		/**
 		 * Hand-maintained build marker, reported alongside the version. A working copy that is
 		 * linked into a profile serves this file straight from disk, so the package version
 		 * cannot say *which* copy a live window loaded — this can, and `report().build` is how a
 		 * real-machine check answers that. Bump it whenever a live window must be told apart.
 		 */
-		const ROUTER_BUILD = 'desktop-bar+settings-marker+modal-dismiss+mac-header-bar+bar-select-all+recent-links+copy-link+automation-links+page-over-pane+band-yield+provider-card+perf+compat+turn-jump.12'
+		const ROUTER_BUILD = 'desktop-bar+settings-marker+modal-dismiss+mac-header-bar+bar-select-all+recent-links+copy-link+automation-links+page-over-pane+band-yield+provider-card+perf+compat+turn-jump+subagent-title+hover+view-labels+power+settings-launcher+settings-menu-visible+settings-seat+settings-once+landed-forms+settings-press+settings-store+settings-depth+settings-class-fallback+node-list+power-actions+power-action-lands+power-bases+power-menu-first+typed-rearms+power-contract-only+power-typed-gate+power-leave-focus+power-records+power-gate-precise+power-echo.39'
 
 		const TAG = '[url-router]'
 
@@ -228,11 +334,22 @@ window.__ModuleLoader__.load({
 	 * has no power button. A couple of pixels is rounding, more is a resize.
 	 */
 	const MAC_BAR_RESIZE_SLACK = 8
+	/**
+	 * The bar is hidden until the pointer is over it, when the preference asks for it.
+	 *
+	 * The bar keeps its box (only its opacity drops), so hovering the place where it lives is
+	 * what reveals it — no extra hit area, and nothing else on the row moves.
+	 */
+	const HOVER_ATTRIBUTE = 'data-dsh-url-router-hover'
+	/** The reveal itself, set by the pointer/focus handlers and read by the stylesheet. */
+	const SHOWN_ATTRIBUTE = 'data-dsh-url-router-shown'
 	const MAC_STYLE_TEXT = [
 		`#${TITLEBAR_BAR_ID}[data-dsh-url-router-platform="mac"]{position:fixed;display:flex;align-items:center;height:${MAC_BAR_HEIGHT}px;z-index:1200;-webkit-app-region:no-drag}`,
 		`#${TITLEBAR_BAR_ID}[data-dsh-url-router-platform="mac"] input{height:${MAC_BAR_HEIGHT}px;width:100%;box-sizing:border-box;border:1px solid rgba(127,127,127,.34);border-radius:8px;padding:0 10px;font:inherit;font-size:12px;color:inherit;background:rgba(127,127,127,.16);outline:none;-webkit-app-region:no-drag}`,
 		`#${TITLEBAR_BAR_ID}[data-dsh-url-router-platform="mac"] input:focus{border-color:var(--dsw-alias-brand-primary,rgba(79,124,255,.9))}`,
 		`#${TITLEBAR_BAR_ID}[data-dsh-url-router-platform="mac"][data-dsh-url-router-state="refused"] input{border-color:rgba(214,69,69,.85);color:rgba(214,69,69,1)}`,
+		`#${TITLEBAR_BAR_ID}[${HOVER_ATTRIBUTE}]{opacity:0;transition:opacity .14s ease}`,
+		`#${TITLEBAR_BAR_ID}[${HOVER_ATTRIBUTE}][${SHOWN_ATTRIBUTE}]{opacity:1}`,
 	].join('')
 	/** Where the bar's last spot is kept, so a screen without a power button still gets it. */
 	const MAC_PLACEMENT_KEY = 'dsh-url-router-placement'
@@ -424,6 +541,8 @@ window.__ModuleLoader__.load({
 			`#${TITLEBAR_BAR_ID} input{height:26px;width:100%;box-sizing:border-box;border:1px solid transparent;border-radius:6px;padding:0 8px;font:inherit;font-size:12px;color:inherit;background:var(--dsw-specific-sidebar-fill,rgba(127,127,127,.14));outline:none;-webkit-app-region:no-drag}`,
 			`#${TITLEBAR_BAR_ID} input:focus{border-color:var(--dsw-alias-brand-primary,rgba(79,124,255,.9))}`,
 			`#${TITLEBAR_BAR_ID}[data-dsh-url-router-state="refused"] input{border-color:rgba(214,69,69,.85);color:rgba(214,69,69,1)}`,
+			`#${TITLEBAR_BAR_ID}[${HOVER_ATTRIBUTE}]{opacity:0;transition:opacity .14s ease}`,
+			`#${TITLEBAR_BAR_ID}[${HOVER_ATTRIBUTE}][${SHOWN_ATTRIBUTE}]{opacity:1}`,
 		].join('')
 		/**
 		 * The recent list's own stylesheet: a browser-style drop-down under the bar.
@@ -492,7 +611,7 @@ window.__ModuleLoader__.load({
 		/** Remembered links, newest first. */
 		const RECENT_KEY = 'dsh-url-router-recent'
 		/** What the bar does before the settings page has ever been opened. */
-		const DEFAULT_SETTINGS = { selectAllOnFocus: true, recentLimit: 8 }
+		const DEFAULT_SETTINGS = { selectAllOnFocus: true, hoverReveal: false, recentLimit: 8 }
 		/**
 		 * The key the plugin manager dispatches a row's configuration under:
 		 * `<package name>#<row id>`. This package declares one row whose package name and
@@ -516,13 +635,14 @@ window.__ModuleLoader__.load({
 		/**
 		 * The settings record, with anything unusable replaced by its default.
 		 * @param {unknown} raw - the parsed record, or anything that was on disk.
-		 * @returns {{selectAllOnFocus: boolean, recentLimit: number}} the record.
+		 * @returns {{selectAllOnFocus: boolean, hoverReveal: boolean, recentLimit: number}} the record.
 		 */
 		function normaliseSettings(raw) {
 			const source = raw !== null && typeof raw === 'object' ? raw : {}
 			const limit = Number(source.recentLimit)
 			return {
 				selectAllOnFocus: typeof source.selectAllOnFocus === 'boolean' ? source.selectAllOnFocus : DEFAULT_SETTINGS.selectAllOnFocus,
+				hoverReveal: typeof source.hoverReveal === 'boolean' ? source.hoverReveal : DEFAULT_SETTINGS.hoverReveal,
 				// A count of remembered links: whole, never negative, and with no upper bound
 				// the reader did not ask for.
 				recentLimit: Number.isFinite(limit) && limit >= 0 ? Math.floor(limit) : DEFAULT_SETTINGS.recentLimit,
@@ -531,7 +651,7 @@ window.__ModuleLoader__.load({
 
 		/**
 		 * Read the settings, once.
-		 * @returns {{selectAllOnFocus: boolean, recentLimit: number}} the record in force.
+		 * @returns {{selectAllOnFocus: boolean, hoverReveal: boolean, recentLimit: number}} the record in force.
 		 */
 		function readSettings() {
 			if (settingsCache !== undefined) return settingsCache
@@ -620,6 +740,8 @@ window.__ModuleLoader__.load({
 		function recentIdentity(hash) {
 			const route = parseRoute(String(hash ?? ''))
 			if (route === undefined || route.unknown !== undefined) return String(hash ?? '')
+			// A command has no place to come back to, so it never enters the recent list.
+			if (route.kind === 'power' && powerActionOf(route.id) !== undefined) return ''
 			if (route.kind === 'workspace') {
 				const inner = innerPath(route.inner)
 				return inner.length >= 2 ? `${ROW_KEY_PREFIX}${inner[1]}` : `${route.kind}:${route.id}`
@@ -778,6 +900,30 @@ window.__ModuleLoader__.load({
 			return ids.length === 0 ? undefined : ids
 		}
 
+		/**
+		 * The conversation views the slot contributes, with the labels the header prints.
+		 *
+		 * The header renders only some of these tabs (the rest go into the "…" menu), so a tab's
+		 * *text* is the only reliable identity a reader can be mapped by — the registry ids alone
+		 * can only be matched positionally, and only while every view is rendered.
+		 * @param {object} slots - the slot service.
+		 * @returns {Array<{id: string, label: string}>} contributions in registration order.
+		 */
+		function conversationViewLabelsOf(slots) {
+			const rows = attemptValue(() => slots?.entries?.('conversation.view'))
+			if (!Array.isArray(rows)) return []
+			const out = []
+			for (const row of rows) {
+				const options = row === null || typeof row !== 'object' ? undefined : row.options
+				const id = options?.id
+				if (typeof id !== 'string' || id === '') continue
+				let label = options?.label
+				if (typeof label === 'function') label = attemptValue(() => label())
+				out.push({ id, label: typeof label === 'string' ? label.trim() : '' })
+			}
+			return out
+		}
+
 		/**
 		 * Read a value, or undefined when reading it throws.
 		 * @param {Function} read - the reader.
@@ -1106,11 +1252,134 @@ window.__ModuleLoader__.load({
 		 * @param {string|Array<string>} inner - the inner path.
 		 * @returns {{tab: string|undefined, provider: string|undefined}} the parts.
 		 */
+		/** A row whose state lives in a styling class: the class has to end in one of these words. */
+		const ROW_ON_CLASS = /(?:On|Active|Selected|Current|Checked)$/
+
+		/**
+		 * The label a control is known by: its own text, without a nested badge.
+		 *
+		 * A chip can read `宠物 12`, where `12` is a count inside a nested element (measured on the
+		 * market's filter row). A count is not identity — it moves — so only the control's own text
+		 * names it, and a link stays valid when the number changes.
+		 * @param {object} control - the control.
+		 * @returns {string} its label.
+		 */
+		function controlLabelOf(control) {
+			let own = ''
+			for (const node of control?.childNodes ?? []) {
+				if (node?.nodeType === 3) own += String(node.textContent ?? '')
+			}
+			const text = own.trim() !== '' ? own : String(control?.textContent ?? '')
+			return text.trim().replace(/\s+/g, ' ')
+		}
+
+		/**
+		 * Whether one settings row's control is the one selected.
+		 * @param {object} row - a row from `settingsRowsOf`.
+		 * @param {object} control - a control of that row.
+		 * @returns {boolean} whether it is on.
+		 */
+		function controlIsOn(row, control) {
+			if (row.marker === 'class') return typeof control.className === 'string' && ROW_ON_CLASS.test(control.className)
+			return control.getAttribute(row.marker) === 'true'
+		}
+
+		/**
+		 * The rows of selectable controls inside the settings overlay, in document order.
+		 *
+		 * The overlay is deeper than one tab row: a section owns tabs, a tab may own another row
+		 * (measured 2026-10-28: `Web 扩展 / 创意工坊` holds `编辑推荐 / 皮肤 / 宠物 / 插件 / 预设`),
+		 * and that row may hold filters of its own. A row is a parent whose children all carry the
+		 * same marker — `aria-selected` for tabs, `aria-pressed` for toggles — with exactly one of
+		 * them true, and the row's place is its first control's place in the document.
+		 * @param {object} overlay - the settings overlay.
+		 * @returns {Array<{node: object, marker: string}>} the rows.
+		 */
+		function settingsRowsOf(overlay) {
+			if (overlay === null || overlay === undefined || typeof overlay.querySelectorAll !== 'function') return []
+			const rows = []
+			const seen = new Set()
+			for (const marker of ['aria-selected', 'aria-pressed']) {
+				// A query result is a NodeList, not an array: spread it *inside* the attempt, or the
+				// guard below silently skips the whole scan in a real DOM (measured 2026-10-28).
+				const nodes = attemptValue(() => [...overlay.querySelectorAll(`[${marker}]`)])
+				if (!Array.isArray(nodes)) continue
+				for (const node of nodes) {
+					const parent = node?.parentElement
+					if (parent === null || parent === undefined || seen.has(parent)) continue
+					const children = attemptValue(() => [...parent.children]) ?? []
+					const marked = children.filter(child => typeof child.getAttribute === 'function' && child.getAttribute(marker) !== null)
+					if (marked.length < 2) continue
+					const on = marked.find(child => child.getAttribute(marker) === 'true')
+					if (on === undefined) continue
+					if (controlLabelOf(on) === '') continue
+					seen.add(parent)
+					rows.push({ node: parent, marker })
+				}
+			}
+			// A row with no ARIA at all: some plugins only toggle a styling class (measured on the
+			// market's filter chips: `…_filterChipOn`, no aria-* anywhere). It is a last resort and it
+			// is deliberately narrow — the class has to *end* in one of these words, exactly one
+			// sibling may carry it, and the row must have at least two controls.
+			const buttons = attemptValue(() => [...overlay.querySelectorAll('button')])
+			if (Array.isArray(buttons)) {
+				for (const node of buttons) {
+					const parent = node?.parentElement
+					if (parent === null || parent === undefined || seen.has(parent)) continue
+					const children = (attemptValue(() => [...parent.children]) ?? []).filter(child => typeof child.className === 'string')
+					if (children.length < 2) continue
+					const marked = children.filter(child => ROW_ON_CLASS.test(child.className))
+					if (marked.length !== 1) continue
+					if (controlLabelOf(marked[0]) === '') continue
+					seen.add(parent)
+					rows.push({ node: parent, marker: 'class' })
+				}
+			}
+			return rows.sort((a, b) => {
+				if (a.node === b.node) return 0
+				const position = attemptValue(() => a.node.compareDocumentPosition?.(b.node)) ?? 0
+				// 4 is DOCUMENT_POSITION_FOLLOWING: `a` comes first.
+				return (position & 4) !== 0 ? -1 : 1
+			})
+		}
+
+		/**
+		 * What each settings row has selected, in row order — the path a link can name.
+		 * @param {object} overlay - the settings overlay.
+		 * @returns {string[]} the labels.
+		 */
+		function settingsSelectedLabelsOf(overlay) {
+			const out = []
+			for (const row of settingsRowsOf(overlay)) {
+				const on = [...row.node.children].find(child => controlIsOn(row, child))
+				const label = on === undefined ? '' : controlLabelOf(on)
+				if (label !== '') out.push(label)
+			}
+			return out
+		}
+
+		/**
+		 * The control inside one settings row whose label is the one a link names.
+		 * @param {object} row - a row from `settingsRowsOf`.
+		 * @param {string} label - the wanted label.
+		 * @returns {object|undefined} the control.
+		 */
+		function settingsControlOf(row, label) {
+			const wanted = label.trim().toLowerCase()
+			for (const child of attemptValue(() => [...row.node.children]) ?? []) {
+				if (typeof child.getAttribute !== 'function') continue
+				if (row.marker !== 'class' && child.getAttribute(row.marker) === null) continue
+				if (controlLabelOf(child).toLowerCase() !== wanted) continue
+				return child
+			}
+			return undefined
+		}
+
 		function settingsPartsOf(inner) {
 			const parts = innerPath(inner)
 			const at = parts.indexOf(PROVIDER_SEGMENT)
-			if (at < 0) return { tab: parts[0], provider: undefined }
-			return { tab: at > 0 ? parts[0] : undefined, provider: parts[at + 1] }
+			const levels = at < 0 ? parts : parts.slice(0, at)
+			return { levels, provider: at < 0 ? undefined : parts[at + 1] }
 		}
 
 		/**
@@ -1269,7 +1538,7 @@ window.__ModuleLoader__.load({
 			const kind = ROUTE_ALIASES[match[1]]
 			if (kind === undefined) return { unknown: match[1] }
 			// A modal surface needs no identity: `#/settings` is the whole route.
-			if (match[2] === undefined) return kind === 'settings' ? { kind, id: '' } : undefined
+			if (match[2] === undefined) return kind === 'settings' || kind === 'power' ? { kind, id: '' } : undefined
 			// A conversation can be named inside its workspace — the shape the sidebar itself shows,
 			// and the only way a link says *where* a conversation lives.
 			if (kind === 'workspace') {
@@ -1296,9 +1565,9 @@ window.__ModuleLoader__.load({
 			}
 			const segments = match[2].replace(/\/+$/, '').split('/')
 			const head = segments.shift() ?? ''
-			if (head === '') return kind === 'settings' ? { kind, id: '' } : undefined
+			if (head === '') return kind === 'settings' || kind === 'power' ? { kind, id: '' } : undefined
 			const id = decodePart(head).trim()
-			if (id === '') return kind === 'settings' ? { kind, id: '' } : undefined
+			if (id === '') return kind === 'settings' || kind === 'power' ? { kind, id: '' } : undefined
 			// A settings section has no stable id in the DOM (measured: the nav item carries only
 			// aria-current), so its identity is its *label* — the string the user actually sees and
 			// clicks. Round-tripping the label keeps the link self-consistent; a locale change
@@ -1324,6 +1593,10 @@ window.__ModuleLoader__.load({
 		function routeHash(kind, id, inner) {
 			// A modal surface has no identity: `#/settings`, not `#/settings/`.
 			if (kind === 'settings' && (id === undefined || id === '')) return '#/settings'
+			// The power menu has no identity of its own — there is one of it — but an *action* does:
+			// dropping it here would make the bar compare a typed `#/power/restart` against a bare
+			// `#/power` and call a command it had already sent "打不开" (measured 2026-10-29).
+			if (kind === 'power') return powerActionOf(id) === undefined ? '#/power' : `#/power/${encodeURIComponent(id)}`
 			if (kind === 'workspace') {
 				const rest = innerPath(inner)
 				const tail = rest.length === 0 ? '' : `/${rest.map(encodeURIComponent).join('/')}`
@@ -1493,6 +1766,10 @@ window.__ModuleLoader__.load({
 				panelAttempts = 0
 				innerAttempts = 0
 				paneOpenedFor = undefined
+				powerActionSent = false
+				powerActionAttempts = 0
+				linkedTyped = false
+				attemptValue(() => host.resetSettingsDrive?.())
 				dropTimer()
 			}
 			/**
@@ -1500,15 +1777,19 @@ window.__ModuleLoader__.load({
 			 * conversation behind it, because the panel is what fills the screen.
 			 */
 			const canonical = () => {
+				// The power menu is a popover, not a surface: it is on top of everything, it closes
+				// the moment the reader touches anything else, and a link can only ever *open* it.
+				// While it is up it names itself, the same way the settings overlay does.
+				if (powerMenuOpenOf(window.document)) return { kind: 'power', id: '' }
 				// The settings overlay covers the main column, so while it is up it is what is on
 				// screen; when it closes the ordinary surface takes the address bar back.
 				if (settingsOverlayOf(window.document) !== undefined) {
 					const section = host.activeSettingsSection() ?? ''
-					const tab = section === '' ? undefined : host.activeSettingsTab()
+					const levels = section === '' ? [] : (attemptValue(() => host.activeSettingsLevels?.()) ?? [])
 					// A model-provider card whose editor is open is a page of its own: its id rides
 					// after the section (and after the tab, when the section has one).
 					const provider = section === '' ? undefined : host.activeSettingsProvider()
-					const inner = [...(tab === undefined ? [] : [tab]), ...(provider === undefined ? [] : [PROVIDER_SEGMENT, provider])]
+					const inner = [...levels, ...(provider === undefined ? [] : [PROVIDER_SEGMENT, provider])]
 					return inner.length === 0 ? { kind: 'settings', id: section } : { kind: 'settings', id: section, inner }
 				}
 				const panelId = host.activePanelId()
@@ -1551,7 +1832,14 @@ window.__ModuleLoader__.load({
 					// but never while a turn link is in flight: that link owns the address bar until it lands,
 					// and naming the turn here too is what made it look "landed" before it ever drove.
 					const anchoredTurn = linked === undefined && turnAnchor !== undefined && turnAnchor.session === id && turnAnchor.turn !== undefined && turnAnchor.turn !== '' ? [TURN_SEGMENT, turnAnchor.turn] : []
+					// Whose subagent this conversation is (empty for an ordinary session). It sits right
+					// after the id: everything after it is a position *inside* the conversation. The
+					// parent is decoration — landing compares the child id — so it is written as the
+					// parent's *title* when the catalog has one, and as its id otherwise.
+					const subagentOf = host.subagentParentOf(id)
+					const subagentLabel = subagentOf === undefined ? undefined : subagentDecorationOf(subagentOf)
 					const position = [
+						...(subagentLabel === undefined || subagentLabel === '' ? [] : [SUBAGENT_SEGMENT, subagentLabel]),
 						...(rowAnchor !== undefined && rowAnchor.session === id ? (rowAnchor.turn === undefined || rowAnchor.turn === '' ? [ROW_SEGMENT, ...rowAnchor.parts] : [TURN_SEGMENT, rowAnchor.turn, ROW_SEGMENT, ...rowAnchor.parts]) : []),
 						...(anchoredTurn.length > 0 && rowAnchor !== undefined && rowAnchor.session === id ? [] : anchoredTurn),
 						...(view !== undefined && view.index !== 0 ? [VIEW_SEGMENT, view.id] : []),
@@ -1590,6 +1878,11 @@ window.__ModuleLoader__.load({
 				if (route?.kind === 'session') return route.id
 				return undefined
 			}
+			const subagentParentOfRoute = route => {
+				const parts = innerPath(route?.inner)
+				const at = parts.indexOf(SUBAGENT_SEGMENT)
+				return at < 0 ? undefined : parts[at + 1]
+			}
 			const viewIdOfRoute = route => {
 				const parts = innerPath(route?.inner)
 				const at = parts.indexOf(VIEW_SEGMENT)
@@ -1672,7 +1965,10 @@ window.__ModuleLoader__.load({
 				if (current.id !== linked.id) return false
 				const wanted = settingsPartsOf(linked.inner)
 				const shown = settingsPartsOf(current.inner)
-				if (wanted.tab !== undefined && wanted.tab !== shown.tab) return false
+				// Every level a link names has to be showing; extra levels on screen are a refinement
+				// of it (the same prefix rule the panel pages use, one row deeper each time).
+				if (wanted.levels.length > shown.levels.length) return false
+				if (!wanted.levels.every((level, index) => level === shown.levels[index])) return false
 				// A provider card is a page one level deeper than its section: a link that names one
 				// has to see that one open (the section alone is satisfied by any of its cards).
 				return wanted.provider === undefined || wanted.provider === shown.provider
@@ -1747,6 +2043,8 @@ window.__ModuleLoader__.load({
 				// (and re-entry can drop the link), so every read below must use the snapshot: reading the
 				// live binding again is how a drive turned into "Cannot read properties of undefined".
 				const link = linked
+				// The parent a subagent link names (decoration: the child alone is what opens).
+				const linkParent = subagentParentOfRoute(link)
 
 				if (sameRoute(current, link)) {
 					dropRetry()
@@ -1807,7 +2105,7 @@ window.__ModuleLoader__.load({
 					const shown = host.mainViewSessionId()
 					if (shown !== rowSession && panelAttempts < INNER_ATTEMPT_LIMIT) {
 						panelAttempts += 1
-						host.openSession(rowSession)
+						host.openSession(rowSession, linkParent)
 					} else if (shown === rowSession && innerAttempts < INNER_ATTEMPT_LIMIT) {
 						innerAttempts += 1
 						if (!host.revealPosition(rowParts.slice(rowAt)) && wantedTurn >= 0) host.revealPosition(rowParts.slice(wantedTurn, wantedTurn + 2), rowSession)
@@ -1823,7 +2121,7 @@ window.__ModuleLoader__.load({
 					const shown = host.mainViewSessionId()
 					if (shown !== wantedSession && panelAttempts < INNER_ATTEMPT_LIMIT) {
 						panelAttempts += 1
-						host.openSession(wantedSession)
+						host.openSession(wantedSession, linkParent)
 					} else if (shown === wantedSession && innerAttempts < INNER_ATTEMPT_LIMIT) {
 						innerAttempts += 1
 						host.openConversationView(wantedView)
@@ -1838,7 +2136,88 @@ window.__ModuleLoader__.load({
 					const shown = host.mainViewSessionId()
 					if (shown !== target && source !== 'hash' && panelAttempts < INNER_ATTEMPT_LIMIT) {
 						panelAttempts += 1
-						host.openSession(target)
+						host.openSession(target, linkParent)
+					}
+					armRetry()
+					return
+				}
+				if (link.kind === 'power') {
+					// `#/power/shutdown` and `#/power/restart` are commands, and they are the one route
+					// that must not be reachable by a link somebody else wrote: a URL is easy to click
+					// by accident, and this one ends the application. So the action runs only for a
+					// fragment the reader typed into the address bar (`typedClaim`), exactly once per
+					// claim — and a hash read lowers the flag, which is what makes a link in a chat
+					// message, a README or an AI reply harmless.
+					const action = powerActionOf(link.id)
+					if (action !== undefined) {
+						if (!linkedTyped || powerActionSent) {
+							// This branch is the one that used to answer a typed command with nothing at
+							// all, and it left no trace: a desktop window has no console, so say it in
+							// the report instead of guessing next time.
+							if (!linkedTyped && !powerIgnored) {
+								powerIgnored = true
+								note(`${TAG} ignoring power action "${action}": this fragment did not come from the address bar`)
+							}
+							armRetry()
+							return
+						}
+						// Refuse only when the address bar names a *different* power action: that is the
+						// claim having gone stale, and running it would fire the wrong command (a shutdown
+						// fired by a link that asked for a restart is not something to be clever about).
+						//
+						// It must not refuse merely because the bar does not name *this* action: the router
+						// itself rewrites the bar to the canonical of what is on screen, and opening the
+						// menu makes that canonical `#/power` — so a stricter rule refused our own first
+						// drive step, and the reader had to press Enter twice (measured 2026-10-29).
+						const typed = parseRoute(String(host.readLocation().hash ?? ''))
+						const namesOtherAction = typed !== undefined && typed.kind === 'power' && typed.id !== '' && typed.id !== link.id
+						if (namesOtherAction) {
+							note(`${TAG} refusing power action "${action}": the address bar names "${String(typed.id)}"`)
+							powerActionSent = true
+							armRetry()
+							return
+						}
+						// The plugin's own path first: its menu, then the item it publishes for this
+						// action — that way its own flow runs (its overlay, and any confirmation it may
+						// add later). The endpoint is the fallback for a menu that never yields the
+						// item, so a command can never end in a silent no-op.
+						if (!powerMenuOpenOf(window.document)) {
+							if (powerActionAttempts < POWER_ACTION_MENU_LIMIT) {
+								powerActionAttempts += 1
+								innerAttempts += 1
+								host.openPowerMenu()
+								// The focus is deliberately left alone: the plugin keeps it on its own
+								// trigger and hangs its arrow-key navigation there (fixed 2026-10-29 by
+								// removing its `first.focus()`), so stealing it back would kill that.
+							} else {
+								note(`${TAG} running power action "${action}" through the plugin endpoint (its menu published no item)`)
+								powerActionSent = true
+								host.powerAction(action)
+							}
+							armRetry()
+							return
+						}
+						if (host.clickPowerItem(action)) {
+							note(`${TAG} running power action "${action}" through the plugin's own menu item`)
+							powerActionSent = true
+							armRetry()
+							return
+						}
+						powerActionAttempts += 1
+						if (powerActionAttempts >= POWER_ACTION_MENU_LIMIT) {
+							note(`${TAG} running power action "${action}" through the plugin endpoint (no menu item published it)`)
+							powerActionSent = true
+							host.powerAction(action)
+						}
+						armRetry()
+						return
+					}
+					// A bare `#/power` only opens the menu. It is a toggle: it is clicked only while it
+					// is closed, so a retry can never open it and close it again. The items inside it
+					// are never clicked — opening a menu is a place, acting on it is a person's call.
+					if (innerAttempts < INNER_ATTEMPT_LIMIT && !powerMenuOpenOf(window.document)) {
+						innerAttempts += 1
+						host.openPowerMenu()
 					}
 					armRetry()
 					return
@@ -1847,7 +2226,7 @@ window.__ModuleLoader__.load({
 					if (source !== 'hash' && innerAttempts < INNER_ATTEMPT_LIMIT) {
 						innerAttempts += 1
 						const parts = settingsPartsOf(link.inner)
-						host.openSettings(link.id, parts.tab, parts.provider)
+						host.openSettings(link.id, parts.levels, parts.provider)
 					}
 					armRetry()
 					return
@@ -1891,7 +2270,7 @@ window.__ModuleLoader__.load({
 						// idempotent on a conversation that is not shown yet (no seats, nothing to scroll to, and
 						// the paging path is a no-op too), and waiting for the main-view counter to catch up is
 						// what left a cold-opened turn link doing nothing at all.
-						host.openSession(wantedSession)
+						host.openSession(wantedSession, linkParent)
 						host.revealPosition(innerPath([TURN_SEGMENT, wantedTurn]), wantedSession)
 						// A row may follow the turn (`turn/<n>/row/…`): reveal it after the turn.
 						const rowAt = innerPath(link.inner).indexOf(ROW_SEGMENT)
@@ -1962,7 +2341,7 @@ window.__ModuleLoader__.load({
 				}
 				if ((!claimed || moved) && host.isOpenable(link.id)) {
 					claimed = true
-					host.openSession(link.id)
+					host.openSession(link.id, linkParent)
 				}
 			}
 			/** Adopt the surface the address bar names, if it names one. */
@@ -1996,6 +2375,7 @@ window.__ModuleLoader__.load({
 					return
 				}
 				if (linked === undefined || linked.kind !== parsed.kind || linked.id !== parsed.id) {
+					linkedTyped = typedClaim
 					linked = { kind: parsed.kind, id: parsed.id, inner: parsed.inner, deadline: host.now() + LINK_ENFORCE_WINDOW_MS }
 					if (parsed.kind === 'panel' && parsed.inner !== undefined) panelScope = innerPath(parsed.inner)[0]
 					claimed = false
@@ -2048,7 +2428,43 @@ window.__ModuleLoader__.load({
 				retryTimer?.()
 				retryTimer = undefined
 			}
+			// A power action is honoured only for a fragment the reader typed themselves: the flag is
+			// raised by the address bar's own hand-off and lowered by every browser-driven hash read.
+			let typedClaim = false
+			/**
+			 * The fragment the reader last drove by hand.
+			 *
+			 * Writing the hash makes the browser deliver a `hashchange` of our own write, one task
+			 * later. That echo arrives after the link has already been dropped (a command lands
+			 * immediately, by definition), so it would create a *fresh* claim that is not typed —
+			 * and the command the reader typed was then refused, silently, until they pressed Enter
+			 * a second time (measured 2026-10-29). Recognising the echo keeps the claim theirs.
+			 */
+			let typedEcho = ''
+			/** Whether this claim already said out loud that it was not the reader's. */
+			let powerIgnored = false
+			// Whether *the claim in flight* came from the address bar's own hand-off. The flag above
+			// only survives one read; a command needs its authority for the whole claim, because its
+			// drive retries (that is how the plugin's menu gets its budget).
+			let linkedTyped = false
+			// How many steps the plugin's own menu has had for this claim, before the endpoint takes over.
+			let powerActionAttempts = 0
+			// One action per claim: a POST that is retried because the app is slow to die would
+			// otherwise fire twice.
+			let powerActionSent = false
 			const safeReadLink = () => guard(readLink)
+			/**
+			 * Record a line about a command the reader typed.
+			 *
+			 * A desktop window has no console, so `host.warn` alone leaves no trace anyone can read:
+			 * the observation report is where a person can see what a destructive command actually
+			 * did. Both get the line.
+			 * @param {string} message - the line.
+			 */
+			const note = message => {
+				if (!observed.warnings.includes(message)) observed.warnings.push(message)
+				host.warn(message)
+			}
 			// The desktop address bar hands its fragment over here instead of relying on the
 			// browser: a programmatic hash write fires `hashchange` in a browser, but a hash
 			// equal to the current one fires nothing at all, and the desktop shell serves the
@@ -2056,15 +2472,34 @@ window.__ModuleLoader__.load({
 			// listener uses makes the bar work in both cases. The hash is still written, so the
 			// address bar, Back/Forward and copied links all agree with what is on screen.
 			driveTypedFragment = fragment => {
+				typedClaim = true
+				typedEcho = fragment
+				// A fresh command gets the full menu budget, however many times the reader pastes it.
+				powerActionSent = false
+				powerActionAttempts = 0
+				powerIgnored = false
+				// And it re-arms the claim it names. Without this, a link that had *already* arrived
+				// some other way (a chat message the reader clicked) keeps the claim it made, and the
+				// same fragment typed afterwards found `linked.id === parsed.id`, made no new claim,
+				// and stayed refused — a command the reader typed was answered with nothing at all
+				// (measured 2026-10-29).
+				if (linked !== undefined) linkedTyped = true
 				attemptValue(() => {
 					window.location.hash = fragment
 				})
 				safeReadLink()
+				typedClaim = false
 			}
 			const offPanel = host.onPanelChange(() => safeReconcile('panel'))
 			const offCatalog = host.onCatalogChange(() => safeReconcile('catalog'))
 			const offDom = host.onDomChange(() => safeReconcile('dom'))
-			const offHashChange = host.onHashChange(() => safeReadLink())
+			const offHashChange = host.onHashChange(() => {
+				// A hash read is never a typed link: whoever wrote the fragment (a chat message, a
+				// page, a plugin) does not get to run a command — with one exception, the echo of the
+				// reader's own write, which is what makes a command work on the first Enter.
+				typedClaim = readableFragment(String(attemptValue(() => window.location.hash) ?? '')) === readableFragment(typedEcho)
+				safeReadLink()
+			})
 			safeReadLink()
 			// Pointing at a turn records a position, never a navigation: the listener is passive
 			// and it refuses to act on any interactive element, so clicks keep working exactly as
@@ -2630,7 +3065,15 @@ window.__ModuleLoader__.load({
 				faces: {
 					catalog: list,
 					archivedSessionIds: () => registry.getSnapshot().archivedSessionIds,
-					openSession: id => openSession.call(navigation, id),
+					openSession: (id, parent) => {
+						if (parent === undefined || parent === null || parent === '') return openSession.call(navigation, id)
+						// A subagent view is opened by its address (parent + child + mode), not by the
+						// plain session id: that is the shape `uiWorkspace.openSession` declares
+						// (`SessionTarget = SessionId | SubagentAddress`). The mode is durable in the
+						// catalog, so it is read back rather than guessed.
+						const mode = attemptValue(() => sessions?.subagentAddress?.(id)?.mode) ?? 'unknown'
+						return openSession.call(navigation, { parentSessionId: parent, childSessionId: id, mode })
+					},
 					selectPanel: selectPanel === undefined ? undefined : id => selectPanel(id),
 					beginNavigation: beginNavigation === undefined ? undefined : () => beginNavigation(),
 				openRightbar: openRightbar === undefined ? undefined : track => openRightbar(track),
@@ -2661,6 +3104,14 @@ window.__ModuleLoader__.load({
 					return fallback
 				}
 			}
+			/**
+			 * How many times this link has pressed the settings launcher.
+			 *
+			 * The launcher is a *toggle*, so it may only be pressed while no menu is on screen: a
+			 * press that opened nothing may be retried (bounded), a press that opened something must
+			 * never be repeated — that would close it again. Reset with the claim, never per retry.
+			 */
+			let settingsLauncherPresses = 0
 			const archived = () => {
 				const ids = attempt(() => faces.archivedSessionIds(), [])
 				return Array.isArray(ids) ? ids : []
@@ -2794,9 +3245,20 @@ window.__ModuleLoader__.load({
 				// A panel id nobody registered is refused by the layout by THROWING
 				// (`selectPanel: main panel "x" is not registered`), so the claim is
 				// swallowed here and reported as "the view did not move" at expiry.
-				openSession: id => {
-					attempt(() => faces.openSession(id))
+				openSession: (id, parent) => {
+					// A parent segment that is a title (not an id) is a label: the child still opens by
+					// its own id, which is the identity the route carries anyway.
+					attempt(() => faces.openSession(id, isSessionIdLike(parent) ? parent : undefined))
 				},
+				// The parent a subagent session belongs to, from the catalog (no session opened), with the
+				// title the catalog keeps for it — the decoration reads better than a uuid.
+				subagentParentOf: id => attemptValue(() => {
+					const snapshot = faces.catalog.getSnapshot()
+					const parentId = snapshot?.byId?.[id]?.parentSessionId ?? faces.sessions?.subagentAddress?.(id)?.parentSessionId
+					if (parentId === undefined || parentId === null || parentId === '') return undefined
+					const title = snapshot?.byId?.[parentId]?.title
+					return { id: String(parentId), title: typeof title === 'string' ? title : '' }
+				}, undefined),
 				// A row's own identity, in the shape the trajectory views publish it. The value is a
 				// percent-encoded NUL-separated triple, so the route can read as a plain path.
 				rowIdentityOf: element => {
@@ -2943,18 +3405,39 @@ window.__ModuleLoader__.load({
 						break
 					}
 					if (index < 0) return undefined
+					const selected = tabs[index]
+					// The header prints one label per visible tab, and the slot says which id carries
+					// it — that pair survives the "…" overflow, which hides tabs from the DOM while
+					// their views still exist (positional mapping cannot see those at all).
+					const text = typeof selected?.textContent === 'string' ? selected.textContent.trim() : ''
+					const labelled = conversationViewLabelsOf(faces.slots)
+					if (text !== '') {
+						const match = labelled.filter(entry => entry.label === text)
+						if (match.length === 1) {
+							const at = labelled.indexOf(match[0])
+							return { id: match[0].id, index: at, total: labelled.length }
+						}
+					}
+					// No label pair (a build with no slot labels): fall back to registration order,
+					// and only while every view is rendered — a wrong id is worse than none.
 					const ids = conversationViewIdsOf(faces)
 					if (ids === undefined || ids.length !== tabs.length) return undefined
 					return { id: ids[index], index, total: ids.length }
 				},
 				openConversationView: viewId => {
 					const row = window.document?.querySelector?.(`[${CONVERSATION_TABS_ATTRIBUTE}]`)
-					const tabs = typeof row?.querySelectorAll === 'function' ? row.querySelectorAll('[role="tab"]') : undefined
-					if (tabs === undefined || tabs === null) return
+					const tabs = typeof row?.querySelectorAll === 'function' ? [...row.querySelectorAll('[role="tab"]')] : undefined
+					if (tabs === undefined || tabs.length === 0) return
+					// By label first, for the same reason the reflect side does: the tab's text is
+					// what the reader picks, and the slot says which id sits behind it.
+					const labelled = conversationViewLabelsOf(faces.slots)
+					const entry = labelled.find(item => item.id === viewId)
+					const byLabel = entry === undefined || entry.label === ''
+						? undefined
+						: tabs.find(tab => (typeof tab.textContent === 'string' ? tab.textContent.trim() : '') === entry.label)
 					const ids = conversationViewIdsOf(faces)
-					if (ids === undefined) return
-					const index = ids.indexOf(viewId)
-					const tab = index < 0 ? undefined : tabs[index]
+					const index = ids === undefined ? -1 : ids.indexOf(viewId)
+					const tab = byLabel ?? (index < 0 ? undefined : tabs[index])
 					if (typeof tab?.click === 'function') attempt(() => tab.click())
 				},
 				// The right-hand pane names the tab in front. The service is the source of truth;
@@ -3021,17 +3504,9 @@ window.__ModuleLoader__.load({
 				// The model-provider card whose editor is open, when one is (see the helper).
 				activeSettingsProvider: () => openSettingsProviderId(window.document),
 				// The tab a settings section is showing: the same ARIA contract one level deeper.
-				activeSettingsTab: () => {
-					const overlay = settingsOverlayOf(window.document)
-					if (overlay === null || overlay === undefined || typeof overlay.querySelectorAll !== 'function') return undefined
-					for (const candidate of overlay.querySelectorAll('[role="tab"]')) {
-						if (typeof candidate.getAttribute !== 'function') continue
-						if (candidate.getAttribute('aria-selected') !== 'true') continue
-						const label = (candidate.textContent ?? '').trim()
-						if (label !== '') return label
-					}
-					return undefined
-				},
+				// Every settings row's selected control, in row order: the section's tabs, then the
+				// row a tab reveals, and so on — the path a settings link can name.
+				activeSettingsLevels: () => settingsSelectedLabelsOf(settingsOverlayOf(window.document)),
 				// The overlay is a modal, and the platform's own dismiss path is a document-level
 				// Escape: the shipped modal layer registers `document.addEventListener('keydown',
 				// handler, true)` gated on `key === 'Escape'` and closes the topmost modal there.
@@ -3045,50 +3520,118 @@ window.__ModuleLoader__.load({
 						window.document?.dispatchEvent?.(event)
 					})
 				},
-				openSettings: (section, tab, provider) => {
-					if (typeof section === 'string' && section !== '') {
-						// A section is named by the label the user reads, so the request is a label match.
-						const overlay = settingsOverlayOf(window.document)
-						const scope = overlay ?? window.document
-						if (typeof scope?.querySelectorAll === 'function') {
-							const candidates = [...scope.querySelectorAll('button')].filter(candidate => {
-								if (typeof candidate.closest === 'function' && candidate.closest('nav') === null) return false
-								return (candidate.textContent ?? '').trim() !== ''
-							})
-							const wanted = section.trim().toLowerCase()
-							const match = candidates.find(candidate => (candidate.textContent ?? '').trim().toLowerCase() === wanted)
-							if (match !== undefined && typeof match.click === 'function') {
-								// The section that is already showing is not pressed again: a section
-								// re-render can close a card editor the link asked for (its drive is
-								// retried every half second, so pressing twice would flap).
-								const current = candidates.find(candidate => attemptValue(() => candidate.getAttribute?.('aria-current')) === 'true')
-								if (current !== match) attempt(() => match.click())
-								// The section may own tabs: a named one is clicked once the section is up.
-								if (typeof tab === 'string' && tab !== '') {
-									const wantedTab = tab.trim().toLowerCase()
-									const tabs = [...scope.querySelectorAll('[role="tab"]')]
-									const matchTab = tabs.find(candidate => (candidate.textContent ?? '').trim().toLowerCase() === wantedTab)
-									if (matchTab !== undefined && typeof matchTab.click === 'function') attempt(() => matchTab.click())
+				// Run a power action through the power plugin's own published endpoint. The endpoint
+				// answers by ending the application (or relaunching it), so nothing is read back: the
+				// call is fire-and-forget, and a composition without that plugin simply 404s.
+				// Click the item the power plugin publishes for an action. Contract attribute first
+				// (`data-dsh-power-action`), then the item's own label; when neither matches, the
+				// caller falls back to the endpoint rather than guessing at a button.
+				clickPowerItem: action => {
+					if (POWER_ACTIONS[action] === undefined) return false
+					const menu = powerMenuOf(window.document)
+					if (menu === undefined) return false
+					// Contract attribute only. Matching the item by its *label* would be guessing at a
+					// button that ends the application, and the two labels are a hair apart (关闭DSH /
+					// 重启DSH) — a wrong guess is not recoverable, so an unlabelled menu is left to the
+					// endpoint, which names the action in the URL itself.
+					const contracted = attemptValue(() => [...(menu.querySelectorAll?.(`[data-dsh-power-action="${action}"]`) ?? [])])
+					if (!Array.isArray(contracted) || contracted.length === 0) return false
+					pressElement(contracted[0])
+					return true
+				},
+				powerAction: action => {
+					// A wrong base answers 404 and does nothing, so the candidates are tried in order
+					// until one accepts the request. The last failure is named once, because a desktop
+					// window has no console and a silent no-op is the worst possible answer here.
+					const send = index => {
+						if (index >= POWER_ACTION_BASES.length) {
+							host.warn(`${TAG} no power plugin answered ${action}: tried ${POWER_ACTION_BASES.join(', ')}`)
+							return
+						}
+						const endpoint = `${POWER_ACTION_BASES[index]}/${action}`
+						const result = attemptValue(() => window.fetch?.(endpoint, {
+							method: 'POST',
+							credentials: 'same-origin',
+							headers: { 'content-type': 'application/json' },
+							body: '{}',
+						}))
+						if (result === undefined || typeof result.then !== 'function') return
+						result.then(response => {
+							if (response?.ok !== true) send(index + 1)
+						}).catch(() => send(index + 1))
+					}
+					send(0)
+				},
+				// Open the power menu. A link may do this; nothing inside the menu is ever clicked.
+				openPowerMenu: () => {
+					if (powerMenuOpenOf(window.document)) return
+					const trigger = powerTriggerOf(window.document)
+					if (typeof trigger?.click === 'function') attempt(() => trigger.click())
+				},
+				openSettings: (section, levels, provider) => {
+					const overlay = settingsOverlayOf(window.document)
+					if (overlay !== undefined) {
+						// The overlay is what the link asked for. A named section (and its tab, and one of
+						// its cards) is picked inside it; a bare link is already satisfied.
+						settingsLauncherPresses = 0
+						if (typeof section !== 'string' || section === '') return
+						if (typeof overlay.querySelectorAll !== 'function') return
+						const candidates = [...overlay.querySelectorAll('button')].filter(candidate => {
+							if (typeof candidate.closest === 'function' && candidate.closest('nav') === null) return false
+							return (candidate.textContent ?? '').trim() !== ''
+						})
+						const wanted = section.trim().toLowerCase()
+						const match = candidates.find(candidate => (candidate.textContent ?? '').trim().toLowerCase() === wanted)
+						if (match === undefined || typeof match.click !== 'function') return
+						// The section that is already showing is not pressed again: a section re-render can
+						// close a card editor the link asked for (its drive is retried every half second).
+						const current = candidates.find(candidate => attemptValue(() => candidate.getAttribute?.('aria-current')) === 'true')
+						if (current !== match) attempt(() => match.click())
+						// Deeper levels, in order, each looked up in a row *after* the one the previous
+						// level matched — two rows can share a label (`皮肤` is both a section tab and a
+						// row inside 创意工坊), and a cursor keeps them apart. One level per call: the
+						// row a click reveals arrives with the next render, and the retry picks it up.
+						let cursor = -1
+						for (const level of innerPath(levels)) {
+							const rows = settingsRowsOf(overlay)
+							let hit
+							for (let index = cursor + 1; index < rows.length; index += 1) {
+								const control = settingsControlOf(rows[index], level)
+								if (control !== undefined) {
+									hit = { index, control, row: rows[index] }
+									break
 								}
-								// And one of its cards may be the page a link named.
-								if (typeof provider === 'string' && provider !== '') clickSettingsProvider(provider)
-								return
 							}
+							if (hit === undefined) break
+							cursor = hit.index
+							if (!controlIsOn(hit.row, hit.control)) attempt(() => hit.control.click())
 						}
+						// And one of its cards may be the page a link named.
+						if (typeof provider === 'string' && provider !== '') clickSettingsProvider(provider)
+						return
 					}
-					const slot = window.document?.querySelector?.(`[data-slot="${SETTINGS_TRIGGER_SLOT}"]`)
-					const button =
-						(typeof slot?.querySelector === 'function' ? slot.querySelector('button') : null) ??
-						(typeof slot?.closest === 'function' ? slot.closest('button') : null)
-					if (typeof button?.click === 'function') {
-						attempt(() => button.click())
+					// The seat carries the shell's own store, and its actions own the panel's open state and
+					// active section — so the panel is opened through it, without replaying any clicks.
+					if (openSettingsThroughStore(faces, section)) return
+					// Otherwise the reader's own path is replayed. A settings item already on
+					// screen (the reader's menu, or one this link opened) is pressed instead of the launcher;
+					// otherwise the launcher is pressed — never while a menu is up (that would close it
+					// again), and only a bounded number of times (a press that opened nothing is retried).
+					const item = settingsMenuItemOf(window.document)
+					if (item !== undefined) {
+						settingsLauncherPresses = 0
+						pressElement(item)
 						return
 					}
-					// Fallback for a composition without that slot: the labelled entry.
-					const labelled = typeof window.document?.querySelectorAll === 'function'
-						? [...window.document.querySelectorAll('button')].find(candidate => /^(settings|设置)$/i.test((candidate.textContent ?? '').trim()))
-						: undefined
-					if (typeof labelled?.click === 'function') attempt(() => labelled.click())
+					if (visibleMenuOf(window.document) !== undefined) return
+					if (settingsLauncherPresses >= SETTINGS_PRESS_LIMIT) return
+					const button = settingsLauncherOf(window.document) ?? labelledSettingsEntryOf(window.document)
+					if (button === undefined) return
+					settingsLauncherPresses += 1
+					pressElement(button)
+				},
+				resetSettingsDrive: () => {
+					settingsLauncherPresses = 0
 				},
 				openPane: (kind, track, warn) => {
 					if (typeof kind !== 'string' || kind === '') return
@@ -3304,6 +3847,231 @@ window.__ModuleLoader__.load({
 			return undefined
 		}
 
+		/**
+		 * The "Settings" item of the launcher menu, when this build puts the overlay one menu down.
+		 *
+		 * The sidebar gear opens a popover on rc.3 (measured: Settings / Feedback / Sign in), so
+		 * clicking the gear alone leaves the overlay closed and every settings link expires. The
+		 * item's text carries its shortcut (`Settings⌥⌘,`), so only the head of the label matches.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the menu item that opens the overlay.
+		 */
+		/**
+		 * Whether an element is really on screen.
+		 *
+		 * The shell keeps closed popovers mounted, so "the selector matches" proves nothing: a
+		 * hidden item is unpressable, and pressing it also stops the launcher from being pressed
+		 * again. `offsetParent` is useless here — a fixed-position popover reports null while it
+		 * is perfectly visible — so the rect list is the test.
+		 * @param {object} node - the element.
+		 * @returns {boolean} whether it is visible.
+		 */
+		function onScreen(node) {
+			if (node === null || node === undefined) return false
+			if (typeof node.closest === 'function' && node.closest('[hidden]') !== null) return false
+			const rects = attemptValue(() => node.getClientRects?.())
+			if (Array.isArray(rects) && rects.length === 0) return false
+			return true
+		}
+
+		/**
+		 * The open popover, when one is on screen.
+		 *
+		 * One selector at a time: a comma list is beyond a small DOM stub.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the popover root.
+		 */
+		function visibleMenuOf(document) {
+			for (const selector of ['[role="menu"]']) {
+				const nodes = attemptValue(() => [...(document?.querySelectorAll?.(selector) ?? [])])
+				if (!Array.isArray(nodes)) continue
+				for (const node of nodes) {
+					if (onScreen(node)) return node
+				}
+			}
+			return undefined
+		}
+
+		/**
+		 * The "Settings" item of the launcher menu, when this build puts the overlay one menu down.
+		 *
+		 * The seat is single-occupant, so a shell that seats an account row there turns the gear
+		 * into a menu trigger (measured on the desktop: the trigger is labelled with the account
+		 * name and carries `aria-haspopup="menu"`). The item is matched by its label — its head may
+		 * carry a shortcut (`Settings⌥⌘,`) and it need not be a `menuitem` at all — and only while
+		 * the menu is really on screen.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the menu item that opens the overlay.
+		 */
+		function settingsMenuItemOf(document) {
+			const menu = visibleMenuOf(document)
+			const scopes = menu === undefined ? [document] : [menu]
+			for (const scope of scopes) {
+				for (const selector of ['[role="menuitem"]', 'button', '[role="option"]', 'a']) {
+					const nodes = attemptValue(() => [...(scope?.querySelectorAll?.(selector) ?? [])])
+					if (!Array.isArray(nodes)) continue
+					for (const node of nodes) {
+						if (!onScreen(node)) continue
+						const label = String(node.textContent ?? '').trim()
+						if (!/设置|settings/i.test(label)) continue
+						// Outside a menu, only a real menu item counts: a stray button that happens to
+						// be labelled "设置" is not this drive's to press.
+						if (menu === undefined && node.getAttribute?.('role') !== 'menuitem') continue
+						return node
+					}
+				}
+			}
+			return undefined
+		}
+
+		/**
+		 * Whether the power menu is open.
+		 *
+		 * It is the one surface this router reads from another *plugin*, not from the platform, so
+		 * the contract attribute comes first and the plugin's own class names are the fallback for
+		 * a build that predates it. Nothing here writes anything: it only answers "is the popover
+		 * up", which is what makes the menu a routable (if transient) place.
+		 * @param {object} document - the document.
+		 * @returns {boolean} whether the menu is on screen.
+		 */
+		function powerMenuOpenOf(document) {
+			const marked = attemptValue(() => document?.querySelector?.(`[${POWER_MENU_ATTRIBUTE}]`))
+			if (marked !== null && marked !== undefined) {
+				const value = typeof marked.getAttribute === 'function' ? marked.getAttribute(POWER_MENU_ATTRIBUTE) : null
+				return value === null || value === '' || value === 'open'
+			}
+			const menus = attemptValue(() => document?.getElementsByClassName?.(POWER_MENU_CLASS))
+			if (menus !== undefined && menus !== null && menus.length > 0) return true
+			const triggers = attemptValue(() => document?.getElementsByClassName?.(POWER_TRIGGER_CLASS))
+			const trigger = triggers?.[0]
+			if (trigger === undefined || trigger === null) return false
+			return typeof trigger.getAttribute === 'function' && trigger.getAttribute('aria-expanded') === 'true'
+		}
+
+		/**
+		 * Open the settings panel through the shell's own store.
+		 *
+		 * The `sidebar.settings` seat is a single-occupant slot, and the shell's registration carries
+		 * the store that owns the panel: `create().actions.openSection(id)` opens it on a section with
+		 * no clicking at all. Measured 2026-10-28: a seat occupied by an account row opens a popover
+		 * whose item the drive could not press, and every settings link died there — this path does
+		 * not depend on that popover at all.
+		 * @param {object} faces - the probed faces.
+		 * @param {string} section - the section label a link names (empty for a bare link).
+		 * @returns {boolean} whether the store accepted the call.
+		 */
+		function openSettingsThroughStore(faces, section) {
+			const seat = attemptValue(() => faces.slots?.entries?.(SETTINGS_TRIGGER_SLOT)?.[0]?.store)
+			if (seat === undefined || seat === null || typeof seat.create !== 'function') return false
+			const actions = attemptValue(() => seat.create()?.actions)
+			if (actions === undefined || actions === null) return false
+			const wanted = typeof section === 'string' ? section.trim() : ''
+			if (wanted === '') {
+				if (typeof actions.open !== 'function') return false
+				return attemptValue(() => { actions.open(); return true }) === true
+			}
+			const id = settingsSectionIdOf(faces, wanted)
+			if (id === undefined) return false
+			if (typeof actions.openSection !== 'function') return false
+			return attemptValue(() => { actions.openSection(id); return true }) === true
+		}
+
+		/**
+		 * The id of the section a link names, read from the slot the shell renders its nav from.
+		 *
+		 * A link names a section by the label the reader sees (that is the only identity the DOM
+		 * carries), while the store wants the registration id — this is the one place that maps one
+		 * to the other, and it is the same list the shell itself maps over.
+		 * @param {object} faces - the probed faces.
+		 * @param {string} label - the section label.
+		 * @returns {string|undefined} the section id.
+		 */
+		function settingsSectionIdOf(faces, label) {
+			const rows = attemptValue(() => faces.slots?.entries?.(SETTINGS_SECTION_SLOT))
+			if (!Array.isArray(rows)) return undefined
+			const wanted = label.trim().toLowerCase()
+			for (const row of rows) {
+				const id = row === null || typeof row !== 'object' ? undefined : row.options?.id
+				if (typeof id !== 'string' || id === '') continue
+				let text = row.options?.label
+				if (typeof text === 'function') text = attemptValue(() => text())
+				if (typeof text !== 'string') continue
+				if (text.trim().toLowerCase() === wanted) return id
+			}
+			return undefined
+		}
+
+		/**
+		 * The labelled settings entry, for a composition whose seat carries no launcher at all.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the entry.
+		 */
+		function labelledSettingsEntryOf(document) {
+			const buttons = attemptValue(() => [...(document?.querySelectorAll?.('button') ?? [])])
+			if (!Array.isArray(buttons)) return undefined
+			return buttons.find(candidate => /^(settings|设置)$/i.test(String(candidate?.textContent ?? '').trim()))
+		}
+
+		/**
+		 * Press an element the way a pointer does.
+		 *
+		 * A popover trigger commonly opens on `pointerdown`/`mousedown`, so a bare `element.click()`
+		 * is a no-op on it (measured: the settings seat's account row opens its menu only for a real
+		 * pointer press — the menu was never opened by the drive, so the link never landed). The
+		 * sequence is dispatched at the element's centre, and a missing constructor is skipped so a
+		 * minimal DOM still works.
+		 * @param {object} element - the element to press.
+		 * @returns {boolean} whether anything was dispatched.
+		 */
+		function pressElement(element) {
+			if (element === null || element === undefined) return false
+			const box = attemptValue(() => element.getBoundingClientRect?.()) ?? { left: 0, top: 0, width: 0, height: 0 }
+			const options = {
+				bubbles: true,
+				cancelable: true,
+				view: window,
+				clientX: (box.left ?? 0) + (box.width ?? 0) / 2,
+				clientY: (box.top ?? 0) + (box.height ?? 0) / 2,
+			}
+			for (const type of ['pointerdown', 'mousedown', 'pointerup', 'mouseup']) {
+				const Constructor = type.startsWith('pointer') ? window.PointerEvent : window.MouseEvent
+				if (typeof Constructor !== 'function') continue
+				attemptValue(() => element.dispatchEvent?.(new Constructor(type, options)))
+			}
+			if (typeof element.click === 'function') attemptValue(() => element.click())
+			return true
+		}
+
+		/**
+		 * The settings launcher: the dialog trigger when the shell seats one, the seat's own button
+		 * otherwise.
+		 *
+		 * A dialog trigger opens the overlay in one press; a menu trigger (the account row some
+		 * shells seat there) needs its menu followed, which the caller does on the next step.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the element a reader clicks to reach the settings surface.
+		 */
+		function settingsLauncherOf(document) {
+			const slot = attemptValue(() => document?.querySelector?.(`[data-slot="${SETTINGS_TRIGGER_SLOT}"]`))
+			const dialog = attemptValue(() => slot?.querySelector?.('button[aria-haspopup="dialog"]'))
+			if (dialog !== null && dialog !== undefined) return dialog
+			const own = attemptValue(() => slot?.querySelector?.('button'))
+			if (own !== null && own !== undefined) return own
+			return undefined
+		}
+
+		/**
+		 * The power button, by contract attribute first and by the plugin's class name after it.
+		 * @param {object} document - the document.
+		 * @returns {object|undefined} the element a reader clicks to open the menu.
+		 */
+		function powerTriggerOf(document) {
+			const marked = attemptValue(() => document?.querySelector?.(`[${POWER_TRIGGER_ATTRIBUTE}]`))
+			if (marked !== null && marked !== undefined) return marked
+			const found = attemptValue(() => document?.getElementsByClassName?.(POWER_TRIGGER_CLASS)?.[0])
+			return found === undefined ? undefined : found
+		}
+
 		/**
 		 * The fragment a reader can read: percent escapes decoded, or the raw text when the
 		 * escapes are malformed. Display only — the router still writes the encoded form.
@@ -3343,6 +4111,34 @@ window.__ModuleLoader__.load({
 		 */
 		function landedFragment(wanted, now) {
 			if (String(wanted) === String(now)) return true
+			// A power action is a command, not a place: nothing on screen can ever equal it, so
+			// waiting for a match would make the bar cry "打不开" over the one or two seconds the
+			// application takes to go away. Sending it *is* landing it.
+			const wantedRoute = parseRoute(String(wanted))
+			if (wantedRoute?.kind === 'power' && powerActionOf(wantedRoute.id) !== undefined) return true
+			// The reader hands over what they read — a settings section is raw Chinese — while the
+			// canonical form is percent-encoded, so one route has two spellings. Comparing the raw
+			// strings called a link that had already landed "打不开": the overlay was open on that
+			// very section while the bar said it could not open it (measured 2026-10-28).
+			if (readableFragment(wanted) === readableFragment(now)) return true
+			const nowRoute = parseRoute(String(now))
+			if (wantedRoute === undefined || nowRoute === undefined) return false
+			if (wantedRoute.unknown !== undefined || nowRoute.unknown !== undefined) return false
+			// A section is a refinement of the overlay: a bare settings link is satisfied by any
+			// section, and a named one by that same section.
+			if (wantedRoute.kind === 'settings' && nowRoute.kind === 'settings') {
+				const section = wantedRoute.id ?? ''
+				if (section !== '' && section !== (nowRoute.id ?? '')) return false
+				const wantedLevels = settingsPartsOf(wantedRoute.inner).levels
+				const shownLevels = settingsPartsOf(nowRoute.inner).levels
+				return wantedLevels.length <= shownLevels.length && wantedLevels.every((level, index) => level === shownLevels[index])
+			}
+			// A panel link may be wider than the page on screen (`plugins/<pkg>` for an open row).
+			if (wantedRoute.kind === 'panel' && nowRoute.kind === 'panel' && wantedRoute.id === nowRoute.id) {
+				const wantedPage = innerPath(wantedRoute.inner)
+				const shownPage = innerPath(nowRoute.inner)
+				if (wantedPage.length <= shownPage.length && wantedPage.every((part, index) => shownPage[index] === part)) return true
+			}
 			const target = targetSessionOf(wanted)
 			return target !== undefined && target === targetSessionOf(now)
 		}
@@ -3671,6 +4467,11 @@ window.__ModuleLoader__.load({
 			show(window.location?.hash)
 			/** Whether the view has arrived where the link asked, judged by what is on screen. */
 			const arrived = wanted => {
+				// A command is not a place: nothing on screen can ever match it, so it counts as
+				// arrived the moment it is sent — otherwise the bar would cry "打不开" over the
+				// second or two the application takes to go away (measured 2026-10-29).
+				const typed = parseRoute(String(wanted))
+				if (typed?.kind === 'power' && powerActionOf(typed.id) !== undefined) return true
 				const report = attemptValue(() => window.__dshUrlRouter?.report?.())
 				const canonical = report?.canonical
 				if (canonical === undefined || canonical === null) return false
@@ -3955,6 +4756,7 @@ window.__ModuleLoader__.load({
 				// The copy's own field came and went: this is not the reader focusing the bar.
 				if (quietFocus) return
 				narrowed = false
+				revealBar()
 				selectAll()
 				drawRecent()
 			}
@@ -3984,6 +4786,8 @@ window.__ModuleLoader__.load({
 				if (quietFocus) return
 				narrowed = false
 				hideRecent()
+				// The pointer may still be on the bar; concealBar() checks that and the list.
+				attemptValue(() => window.setTimeout?.(concealBar, 0))
 			}
 			const onKeyDown = event => {
 				if (event?.key === 'Escape') {
@@ -4012,12 +4816,47 @@ window.__ModuleLoader__.load({
 				driveTypedFragment(fragment)
 				settle(fragment, false)
 			}
+			/** Whether the bar is asked to stay out of sight until the pointer is on it. */
+			const hoverMode = () => readSettings().hoverReveal === true
+			/** Whether the drop-down is up (a reveal must outlive the pointer leaving). */
+			const recentIsOpen = () => attemptValue(() => recentList.getAttribute?.('data-open') !== null, false)
+			/** Whether the reader is typing in the bar. */
+			const inputIsFocused = () => attemptValue(() => window.document?.activeElement === input, false)
+			/** Show the bar; only meaningful in hover mode (the stylesheet does the rest). */
+			const revealBar = () => {
+				if (!hoverMode()) return
+				attemptValue(() => bar.setAttribute?.(SHOWN_ATTRIBUTE, ''))
+			}
+			/** Hide it again — unless a focused field or an open list still needs it visible. */
+			const concealBar = () => {
+				if (!hoverMode()) return
+				if (inputIsFocused() || recentIsOpen()) return
+				attemptValue(() => bar.removeAttribute?.(SHOWN_ATTRIBUTE))
+			}
+			/**
+			 * Put the bar into the state the preference asks for. Called once at mount, again
+			 * whenever the preference changes, and never while a route is being written (the
+			 * bar's contents are independent of whether it is visible).
+			 */
+			const applyHoverMode = () => {
+				attemptValue(() => {
+					if (hoverMode()) bar.setAttribute?.(HOVER_ATTRIBUTE, '')
+					else {
+						bar.removeAttribute?.(HOVER_ATTRIBUTE)
+						bar.removeAttribute?.(SHOWN_ATTRIBUTE)
+					}
+				})
+			}
+			bar.addEventListener?.('mouseenter', revealBar)
+			bar.addEventListener?.('mouseleave', concealBar)
 			input.addEventListener('keydown', onKeyDown)
 			input.addEventListener('focus', onFocus)
 			input.addEventListener('mousedown', onMouseDown)
 			input.addEventListener('input', onInput)
 			input.addEventListener('paste', onPaste)
 			input.addEventListener('blur', onBlur)
+			applyHoverMode()
+			const offHoverSettings = subscribeSettings(() => applyHoverMode())
 			// Both platforms mount the bar in the body: Windows pins it into the
 			// title-bar strip, macOS pins it over the resident header row.
 			document.body.appendChild(bar)
@@ -4060,6 +4899,9 @@ window.__ModuleLoader__.load({
 				input.removeEventListener?.('input', onInput)
 				input.removeEventListener?.('paste', onPaste)
 				input.removeEventListener?.('blur', onBlur)
+				bar.removeEventListener?.('mouseenter', revealBar)
+				bar.removeEventListener?.('mouseleave', concealBar)
+				offHoverSettings?.()
 				for (const timer of copiedTimers) attemptValue(() => window.clearTimeout(timer))
 				copiedTimers.clear()
 				if (toastTimer !== undefined) attemptValue(() => window.clearTimeout(toastTimer))
@@ -4118,7 +4960,7 @@ window.__ModuleLoader__.load({
 				setRemembered(recentEntries().length)
 			}), [])
 			if (view === 'summary') {
-				return `点击全选 ${settings.selectAllOnFocus ? '开' : '关'} · 记忆 ${settings.recentLimit} 条`
+				return `全选 ${settings.selectAllOnFocus ? '开' : '关'} · 悬浮显示 ${settings.hoverReveal ? '开' : '关'} · 记忆 ${settings.recentLimit} 条`
 			}
 			/**
 			 * Take a typed count: an empty field, a minus sign or anything else unusable is a
@@ -4141,11 +4983,26 @@ window.__ModuleLoader__.load({
 								checked: settings.selectAllOnFocus,
 								onChange: event => setSettings(updateSettings({ selectAllOnFocus: event?.target?.checked === true })),
 							}),
-							h('span', null, '首次点击地址栏时全选'),
+							h('span', null, '首次点击全选链接'),
 						]),
 						h('span', { className: 'dshur-state' }, settings.selectAllOnFocus ? '开' : '关'),
 					]),
-					h('p', { className: 'dshur-hint' }, '像浏览器地址栏：第一次点进去，框里原来的链接整条选中，直接输入就替换它；已经在框里时再点，才是放光标。'),
+					h('p', { className: 'dshur-hint' }, '第一次点进去整条选中，直接输入就替换；已在框内再点，才放光标。'),
+				]),
+				h('div', { className: 'dshur-block', key: 'hover' }, [
+					h('div', { className: 'dshur-row' }, [
+						h('label', { className: 'dshur-label' }, [
+							h('input', {
+								type: 'checkbox',
+								className: 'dshur-check',
+								checked: settings.hoverReveal,
+								onChange: event => setSettings(updateSettings({ hoverReveal: event?.target?.checked === true })),
+							}),
+							h('span', null, '悬浮时才显示地址栏'),
+						]),
+						h('span', { className: 'dshur-state' }, settings.hoverReveal ? '开' : '关'),
+					]),
+					h('p', { className: 'dshur-hint' }, '平时隐去，鼠标移到地址栏的位置才出现。'),
 				]),
 				h('div', { className: 'dshur-block', key: 'recent' }, [
 					h('div', { className: 'dshur-row' }, [
@@ -4162,7 +5019,7 @@ window.__ModuleLoader__.load({
 							onBlur: () => setDraft(String(readSettings().recentLimit)),
 						}),
 					]),
-					h('p', { className: 'dshur-hint' }, '默认 8 条，最低 0 条（0 = 不记忆，地址栏也不再弹最近列表），没有上限。这个数就是点地址栏时下拉框里能看到的条数 —— 地址栏里正显示的那个界面不算（它已经在你眼前了，离开之后才会回到列表里）。'),
+					h('p', { className: 'dshur-hint' }, '下拉框里能看到的条数，默认 8；0 = 不记忆、不弹列表；没有上限。当前界面不占名额。'),
 					h('p', { className: 'dshur-meta' }, [
 						h('span', { key: 'count' }, `已记住 ${remembered} 条`),
 						h('button', {