From d2fea6d7894593d4a64f85bb1a1474f2996f6fec Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 14:40:13 +0800
Subject: [PATCH 01/16] fix(apiproxy): refuse non-JSON media types on /api POST
 bodies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Browsers send "simple" POSTs (text/plain, form encodings) without a CORS
preflight, so a malicious page could execute side-effectful RPCs blind —
the response stays unreadable cross-origin, but session.prompt would
still run. The carrier now answers 415 unless the declared media type is
application/json, forcing every cross-site attempt into a preflight this
server never answers. Raw-fetch specs gain the header; a new handler case
proves the fence rejects before the impl runs.
---
 packages/host/apiproxy/README.i18n.yaml       |  4 +--
 packages/host/apiproxy/README.md              |  2 +-
 packages/host/apiproxy/README.zh.md           |  2 +-
 packages/host/apiproxy/src/fetch/handler.ts   | 15 ++++++++--
 .../apiproxy/tests/client-handler.spec.ts     | 30 +++++++++++++++----
 .../host/apiproxy/tests/fetch-carrier.spec.ts | 24 +++++++--------
 6 files changed, 53 insertions(+), 24 deletions(-)

diff --git a/packages/host/apiproxy/README.i18n.yaml b/packages/host/apiproxy/README.i18n.yaml
index 28ff470c0b..ede79d610b 100644
--- a/packages/host/apiproxy/README.i18n.yaml
+++ b/packages/host/apiproxy/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: d6db9a9541b0727b61dbe501f7234564ffef139e
-README.zh.md: 4175c8fdb98aad2882718a2c95cd9e45825d787d
+README.md: 63294100cd0dc62f9822a3ca9678c1034880169f
+README.zh.md: 251b4b0356da5f1fb518d133a92f484da957b951
diff --git a/packages/host/apiproxy/README.md b/packages/host/apiproxy/README.md
index d6db9a9541..63294100cd 100644
--- a/packages/host/apiproxy/README.md
+++ b/packages/host/apiproxy/README.md
@@ -6,7 +6,7 @@ The API gateway every client shape shares: the TS contract (`src/api/`, zero Nod
 
 ## Contract layer (`/api`)
 
-Wire messages form a four-quadrant discriminated union — who initiates × request/response — decoupled from the physical channel: `ClientRequest` (POST `/api/<method>` body), `ServerResponse` (that POST's response body), `ServerRequest` (SSE frame), `ClientResponse` (POST `/api/respond` body). Responses always echo the matching request's `rpcId` and never mint a new one. Method parameter/return structures live only in the domain interface signatures (`SessionsApi`, `HostApi`, `EventsApi`); `RpcMethodMap` registers the methods and every other position derives via `RequestPayload<K>`/`ResponseValue<K>`. Zod schemas anchor `satisfies z.ZodType<Wire<T>>` and parse at two levels: envelope first, business payload second, dispatched per method. Business errors ride `RpcResult`'s error branch (`RpcErrorDetailsMap` closes the code set); HTTP status expresses only the carrier.
+Wire messages form a four-quadrant discriminated union — who initiates × request/response — decoupled from the physical channel: `ClientRequest` (POST `/api/<method>` body), `ServerResponse` (that POST's response body), `ServerRequest` (SSE frame), `ClientResponse` (POST `/api/respond` body). Responses always echo the matching request's `rpcId` and never mint a new one. Method parameter/return structures live only in the domain interface signatures (`SessionsApi`, `HostApi`, `EventsApi`); `RpcMethodMap` registers the methods and every other position derives via `RequestPayload<K>`/`ResponseValue<K>`. Zod schemas anchor `satisfies z.ZodType<Wire<T>>` and parse at two levels: envelope first, business payload second, dispatched per method. Business errors ride `RpcResult`'s error branch (`RpcErrorDetailsMap` closes the code set); HTTP status expresses only the carrier. Every `/api` POST must declare the `application/json` media type — anything else is refused with 415 before dispatch, so cross-site "simple" requests (which browsers send without a CORS preflight) can never execute a side-effectful method blind.
 
 The layering/protocol decisions are recorded in the [GUI layering and RPC protocol RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.md); the browser-side consumption architecture in the [web client architecture RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md).
 
diff --git a/packages/host/apiproxy/README.zh.md b/packages/host/apiproxy/README.zh.md
index 4175c8fdb9..251b4b0356 100644
--- a/packages/host/apiproxy/README.zh.md
+++ b/packages/host/apiproxy/README.zh.md
@@ -6,7 +6,7 @@
 
 ## 契约层（`/api`）
 
-协议消息组成一个四象限可辨识联合：发起方 × 请求／响应，与物理通道解耦。四种消息分别是 `ClientRequest`（POST `/api/<method>` 的请求体）、`ServerResponse`（该 POST 的响应体）、`ServerRequest`（SSE 帧）和 `ClientResponse`（POST `/api/respond` 的请求体）。响应始终回显对应请求的 `rpcId`，绝不签发新值。方法的参数与返回值结构只存在于领域接口签名（`SessionsApi`、`HostApi`、`EventsApi`）中；`RpcMethodMap` 注册方法，其他所有位置均通过 `RequestPayload<K>`／`ResponseValue<K>` 派生。Zod schema 以 `satisfies z.ZodType<Wire<T>>` 锚定类型，并分两层解析：先解析信封，再解析业务载荷，随后按方法分发。业务错误由 `RpcResult` 的错误分支承载（`RpcErrorDetailsMap` 封闭错误码集合）；HTTP 状态只表达载体层结果。
+协议消息组成一个四象限可辨识联合：发起方 × 请求／响应，与物理通道解耦。四种消息分别是 `ClientRequest`（POST `/api/<method>` 的请求体）、`ServerResponse`（该 POST 的响应体）、`ServerRequest`（SSE 帧）和 `ClientResponse`（POST `/api/respond` 的请求体）。响应始终回显对应请求的 `rpcId`，绝不签发新值。方法的参数与返回值结构只存在于领域接口签名（`SessionsApi`、`HostApi`、`EventsApi`）中；`RpcMethodMap` 注册方法，其他所有位置均通过 `RequestPayload<K>`／`ResponseValue<K>` 派生。Zod schema 以 `satisfies z.ZodType<Wire<T>>` 锚定类型，并分两层解析：先解析信封，再解析业务载荷，随后按方法分发。业务错误由 `RpcResult` 的错误分支承载（`RpcErrorDetailsMap` 封闭错误码集合）；HTTP 状态只表达载体层结果。每个 `/api` POST 都必须声明 `application/json` 媒体类型——否则在分发前即以 415 拒绝，因此跨站"简单请求"（浏览器不经 CORS 预检就会发出）永远无法盲目执行有副作用的方法。
 
 分层与协议决策记录在 [GUI 分层与 RPC 协议 RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.md)中；浏览器侧消费架构记录在 [Web 客户端架构 RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md)中。
 
diff --git a/packages/host/apiproxy/src/fetch/handler.ts b/packages/host/apiproxy/src/fetch/handler.ts
index f0535dc939..8160f9d69a 100644
--- a/packages/host/apiproxy/src/fetch/handler.ts
+++ b/packages/host/apiproxy/src/fetch/handler.ts
@@ -2,8 +2,8 @@
  * Server side of the fetch carrier: maps an ApiProxy onto a pure
  * WHATWG Request->Response function. Two-level parse: full form (type/rpcId/method +
  * path==method) -> payload dispatched per method. HTTP status expresses only the carrier
- * (404 unknown path / 400 non-JSON body / 500 handler crash); business errors are always
- * 200 + ServerResponse.
+ * (404 unknown path / 415 non-JSON media type / 400 non-JSON body / 500 handler crash);
+ * business errors are always 200 + ServerResponse.
  */
 
 import { randomUUID } from 'node:crypto'
@@ -188,6 +188,17 @@ export function toFetchHandler(api: ApiProxy): { fetch: typeof fetch } {
         return new Response('not found', { status: 404 })
       }
 
+      // Cross-site write fence: browsers send "simple" POSTs (text/plain,
+      // form encodings) without a CORS preflight, so a malicious page could
+      // otherwise execute side-effectful RPCs blind — the response stays
+      // unreadable cross-origin, but session.prompt would still run. Only the
+      // JSON media type is accepted; anything else is forced into a preflight
+      // this server never answers. 415 = carrier layer, like the 400 below.
+      const mediaType = req.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase()
+      if (mediaType !== 'application/json') {
+        return new Response('content type must be application/json', { status: 415 })
+      }
+
       let body: unknown
       try {
         body = await req.json()
diff --git a/packages/host/apiproxy/tests/client-handler.spec.ts b/packages/host/apiproxy/tests/client-handler.spec.ts
index 2dbc962a00..0885b7b896 100644
--- a/packages/host/apiproxy/tests/client-handler.spec.ts
+++ b/packages/host/apiproxy/tests/client-handler.spec.ts
@@ -138,7 +138,7 @@ describe('unary round trip', () => {
   it('rejects a method/path mismatch as bad-request', async () => {
     const handler = toFetchHandler(scriptedApi())
     const body = { type: 'client-request', rpcId: 'r1', method: 'session.create', payload: {} }
-    const response = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify(body) })
+    const response = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
     expect(response.status).toBe(200)
     const parsed = await response.json() as { result: { ok: boolean; error?: { code: string; message: string } } }
     expect(parsed.result.ok).toBe(false)
@@ -149,13 +149,13 @@ describe('unary round trip', () => {
   it('rejects a malformed envelope as bad-request, salvaging the rpcId or falling back to the sentinel', async () => {
     const handler = toFetchHandler(scriptedApi())
     // No salvageable rpcId → the fixed invalid-request sentinel keeps the response a valid ServerResponse.
-    const noId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify({ nonsense: true }) })
+    const noId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ nonsense: true }) })
     expect(noId.status).toBe(200)
     const noIdParsed = await noId.json() as { rpcId: string; result: { ok: boolean } }
     expect(noIdParsed.result.ok).toBe(false)
     expect(noIdParsed.rpcId).toBe('invalid-request')
     // A string rpcId in the otherwise-bad body is salvaged for correlation.
-    const withId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify({ rpcId: 'salvage-me', nonsense: true }) })
+    const withId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ rpcId: 'salvage-me', nonsense: true }) })
     const withIdParsed = await withId.json() as { rpcId: string; result: { ok: boolean } }
     expect(withIdParsed.result.ok).toBe(false)
     expect(withIdParsed.rpcId).toBe('salvage-me')
@@ -164,16 +164,34 @@ describe('unary round trip', () => {
   it('maps carrier failures to HTTP statuses and the client throws transport failure', async () => {
     const handler = toFetchHandler(scriptedApi())
     // Unknown method → 404.
-    const notFound = await handler.fetch('http://dsh.internal/api/no.such', { method: 'POST', body: '{}' })
+    const notFound = await handler.fetch('http://dsh.internal/api/no.such', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' })
     expect(notFound.status).toBe(404)
     // Non-JSON body → 400.
-    const badBody = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: '{oops' })
+    const badBody = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{oops' })
     expect(badBody.status).toBe(400)
     // Impl crash → 500, and through the client that is a throw, not an err result.
     const crashing = scriptedApi({ sessions: { list: () => { throw new Error('impl exploded') } } })
     await expect(client(crashing).sessions.list({})).rejects.toThrow(/transport failure .*500/)
   })
 
+  it('rejects non-JSON media types before executing anything (cross-site simple-request fence)', async () => {
+    const list = vi.fn((r: RpcRequest<{}>) => ok(r, { items: [] }))
+    const handler = toFetchHandler(scriptedApi({ sessions: { list } }))
+    const body = JSON.stringify({ type: 'client-request', rpcId: 'r1', method: 'session.list', payload: {} })
+    // A "simple" browser POST (text/plain — sent with no CORS preflight) is
+    // refused at the carrier before the impl runs.
+    const plain = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'text/plain' }, body })
+    expect(plain.status).toBe(415)
+    // A string body with no explicit header defaults to text/plain — same fence.
+    const unlabelled = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body })
+    expect(unlabelled.status).toBe(415)
+    expect(list).not.toHaveBeenCalled()
+    // Media-type parameters pass: the fence checks the type, not the exact string.
+    const charset = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json; charset=utf-8' }, body })
+    expect(charset.status).toBe(200)
+    expect(list).toHaveBeenCalledTimes(1)
+  })
+
   it('rejects when the transport never resolves within timeoutMs', async () => {
     // AbortSignal.timeout is immune to fake timers; a short real timeout keeps this fast.
     const never = new InProcessApiClient({
@@ -421,7 +439,7 @@ describe('respond path', () => {
   it('returns bad-response for a malformed client-response without reaching the impl', async () => {
     const respond = vi.fn()
     const handler = toFetchHandler(scriptedApi({ respond }))
-    const response = await handler.fetch('http://dsh.internal/api/respond', { method: 'POST', body: JSON.stringify({ type: 'client-response' }) })
+    const response = await handler.fetch('http://dsh.internal/api/respond', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ type: 'client-response' }) })
     expect(await response.json()).toEqual({ accepted: false, reason: 'bad-response' })
     expect(respond).not.toHaveBeenCalled()
   })
diff --git a/packages/host/apiproxy/tests/fetch-carrier.spec.ts b/packages/host/apiproxy/tests/fetch-carrier.spec.ts
index 0e6dc8dc4a..318dbc970e 100644
--- a/packages/host/apiproxy/tests/fetch-carrier.spec.ts
+++ b/packages/host/apiproxy/tests/fetch-carrier.spec.ts
@@ -223,7 +223,7 @@ describe('unary round trip (handler ⇄ client, no network)', () => {
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-sig', method: 'command.execute', payload: { sessionId: 's', line: '/hang' } })
     // The fake's /hang settles only when the invoke-level signal aborts: a
     // completed response with the cancelled error proves req.signal reached it.
-    const pending = handler.fetch(new Request('http://x/api/command.execute', { method: 'POST', body, signal: controller.signal }))
+    const pending = handler.fetch(new Request('http://x/api/command.execute', { method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: controller.signal }))
     controller.abort()
     const response = await pending
     const parsed = await response.json() as { rpcId: string; result: { ok: boolean; error?: { code: string } } }
@@ -248,7 +248,7 @@ describe('unary round trip (handler ⇄ client, no network)', () => {
     const controller = new AbortController()
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-picker', method: 'host.pickDirectory', payload: {} })
     const pending = handler.fetch(new Request('http://x/api/host.pickDirectory', {
-      method: 'POST', body, signal: controller.signal,
+      method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: controller.signal,
     }))
     controller.abort()
     const parsed = await (await pending).json() as { result: { error?: { code: string } } }
@@ -260,18 +260,18 @@ describe('handler carrier-layer statuses', () => {
   const handler = toFetchHandler(fakeApi())
 
   it('404s unknown paths and non-POST non-stream methods', async () => {
-    expect((await handler.fetch(new Request('http://x/other', { method: 'POST', body: '{}' }))).status).toBe(404)
+    expect((await handler.fetch(new Request('http://x/other', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' }))).status).toBe(404)
     expect((await handler.fetch(new Request('http://x/api/session.list', { method: 'GET' }))).status).toBe(404)
-    expect((await handler.fetch(new Request('http://x/api/no.such', { method: 'POST', body: JSON.stringify({ type: 'client-request', rpcId: 'r', method: 'no.such', payload: {} }) }))).status).toBe(404)
+    expect((await handler.fetch(new Request('http://x/api/no.such', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ type: 'client-request', rpcId: 'r', method: 'no.such', payload: {} }) }))).status).toBe(404)
   })
 
   it('400s a non-JSON body', async () => {
-    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body: 'not json' }))
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: 'not json' }))
     expect(response.status).toBe(400)
   })
 
   it('rejects a malformed envelope with bad-request and the invalid-request sentinel rpcId', async () => {
-    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body: JSON.stringify({ nope: true }) }))
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ nope: true }) }))
     expect(response.status).toBe(200)
     const body = await response.json() as { rpcId: string; result: { ok: boolean; error?: { code: string } } }
     expect(body.rpcId).toBe('invalid-request')
@@ -280,7 +280,7 @@ describe('handler carrier-layer statuses', () => {
 
   it('rejects a method/path mismatch echoing the envelope rpcId', async () => {
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-9', method: 'session.cancel', payload: {} })
-    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body }))
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body }))
     const parsed = await response.json() as { rpcId: string; result: { error?: { message: string } } }
     expect(parsed.rpcId).toBe('r-9')
     expect(parsed.result.error?.message).toContain('does not match path')
@@ -288,7 +288,7 @@ describe('handler carrier-layer statuses', () => {
 
   it('rejects an invalid payload with the zod issues attached', async () => {
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-10', method: 'session.cancel', payload: {} })
-    const response = await handler.fetch(new Request('http://x/api/session.cancel', { method: 'POST', body }))
+    const response = await handler.fetch(new Request('http://x/api/session.cancel', { method: 'POST', headers: { 'content-type': 'application/json' }, body }))
     const parsed = await response.json() as { result: { error?: { code: string; details: { issues: unknown[] } } } }
     expect(parsed.result.error?.code).toBe('bad-request')
     expect(parsed.result.error?.details.issues.length).toBeGreaterThan(0)
@@ -297,23 +297,23 @@ describe('handler carrier-layer statuses', () => {
   it('500s when the impl itself throws', async () => {
     const crashing = toFetchHandler(fakeApi({ crashOn: 'session.list' }))
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-11', method: 'session.list', payload: {} })
-    const response = await crashing.fetch(new Request('http://x/api/session.list', { method: 'POST', body }))
+    const response = await crashing.fetch(new Request('http://x/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body }))
     expect(response.status).toBe(500)
     expect(await response.text()).toContain('impl crashed')
   })
 
   it('routes /api/respond, rejecting malformed client-responses as a receipt', async () => {
     const good = JSON.stringify({ type: 'client-response', rpcId: 'known', result: { ok: true, value: null } })
-    const goodReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', body: good }))).json()
+    const goodReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', headers: { 'content-type': 'application/json' }, body: good }))).json()
     expect(goodReceipt).toEqual({ accepted: true })
     const bad = JSON.stringify({ type: 'client-request', rpcId: 'r', method: 'x', payload: {} })
-    const badReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', body: bad }))).json()
+    const badReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', headers: { 'content-type': 'application/json' }, body: bad }))).json()
     expect(badReceipt).toEqual({ accepted: false, reason: 'bad-response' })
   })
 
   it('accepts (url, init) form fetch invocation', async () => {
     const body = JSON.stringify({ type: 'client-request', rpcId: 'r-12', method: 'session.list', payload: {} })
-    const response = await handler.fetch('http://x/api/session.list', { method: 'POST', body })
+    const response = await handler.fetch('http://x/api/session.list', { method: 'POST', headers: { 'content-type': 'application/json' }, body })
     expect(response.status).toBe(200)
   })
 })

From 01d68dee4e995a402fa6ebd7dcc511266e0c6300 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 14:56:45 +0800
Subject: [PATCH 02/16] fix(connection): fence every /api request behind one
 browser-trust check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only browser-trust guard covered host.pickDirectory, while the
consequential methods (session.prompt drives bash) accepted any Host —
open to DNS rebinding, where a rebound page reads and writes the API as
if same-origin and only the Host header betrays the attacker's domain.

The pickDirectory-specific loopback guard becomes a prefix-wide fence:
Host must be loopback or an exact host[:port] from the new trustedHosts
config, an attached Origin must equal that authority, and explicit
cross-site markers are refused; requests without browser markers (curl,
tests, native clients) pass, because without a browser there is no
confused deputy. The loopback-socket check is dropped — binding policy
expresses reachability, and the fence is not an auth layer. The Agent
Note records the full threat model and the alternatives.
---
 ...07-28-api-browser-trust-boundary.i18n.yaml |   6 +
 .../2026-07-28-api-browser-trust-boundary.md  |  31 +++++
 ...026-07-28-api-browser-trust-boundary.zh.md |  31 +++++
 docs/config-catalog.md                        |  20 +++-
 packages/client/connection/README.i18n.yaml   |   6 +-
 packages/client/connection/README.md          |   4 +
 packages/client/connection/README.zh.md       |   4 +
 packages/client/connection/package.json       |   3 +-
 .../connection/src/api-request-trust.ts       |  71 +++++++++++
 packages/client/connection/src/index.ts       |  31 ++++-
 .../connection/src/native-dialog-request.ts   |  52 --------
 .../tests/api-request-trust.spec.ts           |  60 ++++++++++
 .../tests/native-dialog-request.spec.ts       |  57 ---------
 .../client/connection/tests/node-half.spec.ts | 112 ++++++++++++------
 packages/host/apiproxy/README.i18n.yaml       |   4 +-
 packages/host/apiproxy/README.md              |   2 +-
 packages/host/apiproxy/README.zh.md           |   2 +-
 pnpm-lock.yaml                                |   3 +
 18 files changed, 339 insertions(+), 160 deletions(-)
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
 create mode 100644 packages/client/connection/src/api-request-trust.ts
 delete mode 100644 packages/client/connection/src/native-dialog-request.ts
 create mode 100644 packages/client/connection/tests/api-request-trust.spec.ts
 delete mode 100644 packages/client/connection/tests/native-dialog-request.spec.ts

diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
new file mode 100644
index 0000000000..11973b755f
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
+2026-07-28-api-browser-trust-boundary.md: c620f1a65e3890bbd2580415e55b25436fefe36e
+2026-07-28-api-browser-trust-boundary.zh.md: 0452eff1017b2f70a00e67c5cfce8dba3a840539
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
new file mode 100644
index 0000000000..c620f1a65e
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
@@ -0,0 +1,31 @@
+# Agent Note: One carrier-level browser-trust boundary for the whole /api surface
+
+Status: implemented
+
+English | [中文](2026-07-28-api-browser-trust-boundary.zh.md)
+
+## Problem
+
+The web GUI host serves `/api` over plain HTTP (default `127.0.0.1:3080`, `--host 0.0.0.0` supported), and the surface includes remote-code-execution-grade methods — `session.prompt` drives an agent that runs bash. A browser turns the operator into a confused deputy against such a local API in two classic ways: a malicious page fires a "simple" cross-site POST (`text/plain` — sent without a CORS preflight) whose side effects execute even though the response stays unreadable, and a DNS-rebound origin talks to the socket as if same-origin, making CORS inapplicable entirely, with only the `Host` header betraying the attacker's domain. Before this decision the system's only browser-trust check (`isTrustedNativeDialogRequest`: loopback socket + same-origin + loopback Host) guarded exactly one cosmetic route — `host.pickDirectory`, whose native dialog pops on the host's screen — while every consequential method was unguarded. Guarding per-RPC also could not survive the upcoming in-app directory browser, whose whole point is serving legitimately remote clients that a loopback rule would refuse.
+
+## Decision
+
+Enforce browser trust once, at the carrier, for the entire `/api` prefix — two halves in two stacked PRs:
+
+- **Media-type fence (dsh-host-apiproxy)**: every `/api` POST must declare `application/json`, else 415 before parsing. Cross-site "simple" requests thereby stop existing: any cross-site attempt is forced into a CORS preflight this server never answers.
+- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: `Host` must be loopback or an exact `host[:port]` from the plugin's `trustedHosts` config (rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. Requests without browser markers pass — a non-browser client is the principal itself, not a deputy. `host.pickDirectory` loses its bespoke guard and rides the same fence.
+
+Two boundaries stay deliberately out of scope: reachability is the webserver binding's policy (`host: 127.0.0.1 | 0.0.0.0`), and authentication for genuinely remote deployments is deferred work recorded in the connection README — the fence is a confused-deputy defense, not an auth layer. The old guard's loopback-socket check was dropped rather than generalized: with binding expressing reachability and `trustedHosts` naming remote authorities, the socket address adds nothing a header fence does not already cover.
+
+## Alternatives considered
+
+- **Per-RPC guards (status quo extended).** Rejected: the guard list trails the method list forever, the highest-value methods were already unguarded, and a loopback rule on browse RPCs would break the remote deployments they exist for.
+- **CORS headers + credential omission.** Rejected: we never want cross-origin reads at all, so answering preflights only widens the surface; refusing them is strictly stronger and simpler.
+- **Auth tokens now.** Rejected for this change: token minting/storage/rotation is real product surface; the fence closes the browser-deputy holes today without pre-deciding the auth design.
+
+## Consequences
+
+- Any future `/api` method is covered by construction; there is no per-route trust decision left to forget.
+- Non-loopback deployments must declare their serving authorities in `trustedHosts` or browsers are refused; plain curl-shape automation is unaffected either way.
+- Clients must label POST bodies `application/json` (ours always did; raw-fetch tests gained the header).
+- The trusted-network assumption of an unauthenticated `0.0.0.0` deployment is now documented instead of implicit.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
new file mode 100644
index 0000000000..0452eff101
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
@@ -0,0 +1,31 @@
+# Agent Note：整个 /api 面共用一道载体级浏览器信任边界
+
+状态：已实现
+
+[English](2026-07-28-api-browser-trust-boundary.md) | 中文
+
+## 问题
+
+Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--host 0.0.0.0`），而这个面上有远程代码执行级别的方法——`session.prompt` 驱动的 agent 可以运行 bash。浏览器会用两种经典方式把操作者变成攻击此类本地 API 的"混淆代理人"：恶意页面发出跨站"简单请求" POST（`text/plain`——不经 CORS 预检即发出），其副作用照常执行、只是响应不可读；以及 DNS rebinding 后的源以"同源"身份直连 socket，CORS 整体失效，只有 `Host` 头会暴露攻击者的域名。在本决策之前，系统里唯一的浏览器信任检查（`isTrustedNativeDialogRequest`：回环 socket + 同源 + 回环 Host）只守着一个装饰性的路由——`host.pickDirectory`，其原生对话框弹在宿主屏幕上——而所有真正要命的方法都在裸奔。按 RPC 逐个设防也活不过即将到来的应用内目录浏览器：它存在的意义就是服务合法的远程客户端，回环规则恰恰会拒绝它们。
+
+## 决策
+
+在载体层对整个 `/api` 前缀一次性执行浏览器信任检查——两半各占一个栈式 PR：
+
+- **媒体类型栅栏（dsh-host-apiproxy）**：每个 `/api` POST 必须声明 `application/json`，否则在解析前以 415 拒绝。跨站"简单请求"由此不复存在：任何跨站尝试都被逼进一次本服务器从不应答的 CORS 预检。
+- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：`Host` 必须是回环地址，或与插件 `trustedHosts` 配置中的某个 `host[:port]` 精确匹配（rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。不带浏览器标头的请求放行——非浏览器客户端是委托人本人，不是代理人。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
+
+两条边界刻意留在范围之外：可达性归 webserver 绑定配置（`host: 127.0.0.1 | 0.0.0.0`）管辖；真正远程部署的认证是延期工作，记录在 connection README——这道栅栏是混淆代理人防御，不是认证层。旧守卫的回环 socket 检查被放弃而非泛化：绑定表达可达性、`trustedHosts` 点名远程权威之后，socket 地址提供不了头部栅栏覆盖不到的任何东西。
+
+## 曾考虑的替代方案
+
+- **按 RPC 设防（延续现状）。** 否决：守卫清单永远追着方法清单跑，价值最高的方法本来就没被守住，而 browse RPC 上的回环规则会破坏它们为之存在的远程部署。
+- **CORS 头 + 省略凭据。** 否决：我们根本不想要任何跨源读取，应答预检只会扩大暴露面；拒绝预检严格更强也更简单。
+- **现在就上认证令牌。** 在本变更中否决：令牌的签发/存储/轮换是真实的产品面；栅栏今天就能封死浏览器代理人漏洞，无需预先决定认证设计。
+
+## 后果
+
+- 未来任何 `/api` 方法天然在覆盖范围内；不存在会被遗忘的按路由信任决定。
+- 非回环部署必须在 `trustedHosts` 中声明服务权威，否则浏览器会被拒绝；curl 形态的自动化不受影响。
+- 客户端必须给 POST 体标注 `application/json`（我们自己的客户端一向如此；裸 fetch 测试补上了该头）。
+- 无认证 `0.0.0.0` 部署的"信任网络"假设从隐含变为成文。
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index b89a49529c..d30aff1f02 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -270,6 +270,25 @@ Depends on: [`agentCore`](../packages/examples/agent-spine-demo/src/index.ts) ·
 
 Source: [`packages/examples/cli-demo/src/index.ts:26`](../packages/examples/cli-demo/src/index.ts)
 
+## `@deepseek-ai/dsh-client-connection`
+
+Requires: `httpServer` · `apiProxy`
+
+```ts config-catalog
+/** Plugin config: the deployment's non-loopback serving authorities. */
+export interface ConnectionConfig {
+  /**
+   * Exact `host[:port]` authorities this deployment serves beyond loopback.
+   * The /api trust fence refuses any request whose Host is neither loopback
+   * nor listed here, so a non-loopback (`0.0.0.0`) deployment must declare
+   * the names it is reached by.
+   */
+  trustedHosts?: string[]
+}
+```
+
+Source: [`packages/client/connection/src/index.ts:20`](../packages/client/connection/src/index.ts)
+
 ## `@deepseek-ai/dsh-client-hmr`
 
 Requires: `clientModuleHost` · `httpServer`
@@ -2143,7 +2162,6 @@ Source: [`packages/context/workspace-context/src/config.ts:17`](../packages/cont
 These load from a `cordis.yml` entry with no `config:` block; they declare no config surface.
 
 - `@deepseek-ai/dsh-agent` ([`packages/core/agent/src/index.ts`](../packages/core/agent/src/index.ts))
-- `@deepseek-ai/dsh-client-connection` — requires `httpServer` · `apiProxy` ([`packages/client/connection/src/index.ts`](../packages/client/connection/src/index.ts))
 - `@deepseek-ai/dsh-client-locale` ([`packages/client/locale/src/index.ts`](../packages/client/locale/src/index.ts))
 - `@deepseek-ai/dsh-client-modules` — requires `httpServer` · `loader` ([`packages/client/modules/src/index.ts`](../packages/client/modules/src/index.ts))
 - `@deepseek-ai/dsh-client-runtime` ([`packages/client/runtime/src/index.ts`](../packages/client/runtime/src/index.ts))
diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
index 0dd8860d65..5c5a825a27 100644
--- a/packages/client/connection/README.i18n.yaml
+++ b/packages/client/connection/README.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-README.md: 80228a180faba0c556ff720e999b29b5bb1635b6
-README.zh.md: f4b857886bfafa891ceb1bd6b79b27e1fb725819
+#   pnpm run verify-translation-pairing --write packages/client/connection/README.md
+README.md: a301b85d707d17d1e8159655b540556eee5c9d83
+README.zh.md: 88d7aa806167033308a9913053f621ecea07c3d8
diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
index 80228a180f..a301b85d70 100644
--- a/packages/client/connection/README.md
+++ b/packages/client/connection/README.md
@@ -4,6 +4,10 @@ English | [中文](README.zh.md)
 
 Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared api client + single-consumer stream-loop starter); the export face carries the wire contract types, the `AbstractApiClient` seam, and the loop's sink/config types. The platform subclasses (WebApiClient/FixtureApiClient), the ConnectionController loop, and the fixture data source are package-internal — apply selects and drives them; tests reach them via src. Contract: api-contracts v3 §3.
 
+## /api browser-trust fence
+
+The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`): the `Host` header must be a loopback authority or an exact `host[:port]` entry from the plugin's `trustedHosts` config (DNS-rebinding defense), an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. Requests without browser markers (curl, tests, native clients) pass — without a browser there is no confused deputy. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment must therefore list the authorities it is reached by in `trustedHosts`; the fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+
 ## Keyless fixture
 
 Any `fixture` query parameter selects the in-memory carrier. `fixture=empty` starts with no Workspace or Session; `fixturePrompt=reject` rejects prompts before acceptance; `fixtureAttach=fail` publishes a Session but rejects its Workspace attachment; `fixtureSessionCreate=drop-response` publishes and frames a Session before dropping the create response; and `fixtureFrames=workspace-first` reverses the default session-first create-frame order. Workspace creation by name/path and caller-preallocated SessionIds remain deterministic enough for assembled Web tests to reconcile list and frame arrival.
diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
index f4b857886b..88d7aa8061 100644
--- a/packages/client/connection/README.zh.md
+++ b/packages/client/connection/README.zh.md
@@ -4,6 +4,10 @@
 
 协议消费层：客户端插件的 apply 会挂载 `ctx.connection`（共享 API 客户端 + 单消费方流循环启动器）；导出表层携带协议契约类型、`AbstractApiClient` seam，以及循环的 sink／配置类型。平台子类（WebApiClient/FixtureApiClient）、ConnectionController 循环和 fixture 数据源都属于包内部：apply 负责选择并驱动它们，测试则通过 src 访问。契约：api-contracts v3 §3。
 
+## /api 浏览器信任栅栏
+
+node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）：`Host` 头必须是回环地址权威，或与插件 `trustedHosts` 配置中的某个 `host[:port]` 精确匹配（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不带浏览器标头的请求（curl、测试、原生客户端）直接放行——没有浏览器就不存在"混淆代理人"。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署必须在 `trustedHosts` 中列出自己被访问时使用的权威；这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+
 ## 无密钥 fixture
 
 任何 `fixture` 查询参数都会选择内存载体。`fixture=empty` 启动时不含 Workspace 或 Session；`fixturePrompt=reject` 在接受前拒绝提示词；`fixtureAttach=fail` 发布 Session 但拒绝将其附加到 Workspace；`fixtureSessionCreate=drop-response` 在丢弃创建响应前发布 Session 并为其发出帧；`fixtureFrames=workspace-first` 则反转默认的 Session 优先创建帧顺序。按名称／路径创建 Workspace 以及由调用方预先分配 SessionId，均具有足够的确定性，组装后的 Web 测试可以据此协调列表与帧的到达。
diff --git a/packages/client/connection/package.json b/packages/client/connection/package.json
index c26cafb143..76aee0f06e 100644
--- a/packages/client/connection/package.json
+++ b/packages/client/connection/package.json
@@ -32,7 +32,8 @@
     "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
-    "@deepseek-ai/dsh-tools": "workspace:^"
+    "@deepseek-ai/dsh-tools": "workspace:^",
+    "schemastery": "^3.18.0"
   },
   "files": [
     "lib/index.js",
diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
new file mode 100644
index 0000000000..37819b9fb9
--- /dev/null
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -0,0 +1,71 @@
+/**
+ * Browser-trust fence for every /api request. Defends the two confused-deputy
+ * paths a browser opens against a local HTTP API — DNS rebinding (Host names
+ * the attacker's domain while the socket reaches this server) and cross-site
+ * requests fired from a malicious page — without blocking non-browser clients
+ * (no browser markers → no deputy to confuse) or legitimately remote browsers
+ * (their authority is declared via `trustedHosts`). Network reachability and
+ * authentication stay out of scope: binding policy belongs to the webserver
+ * config, and this fence is not an auth layer.
+ */
+
+import type { IncomingHttpHeaders } from 'node:http'
+
+/** The request facts the fence reads (structural subset of IncomingMessage). */
+interface ApiTrustRequest {
+  headers: IncomingHttpHeaders
+}
+
+function header(headers: IncomingHttpHeaders, name: string): string | undefined {
+  const value = headers[name]
+  return typeof value === 'string' ? value : undefined
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  const parts = hostname.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/** Hostname of a Host-header authority (port stripped, lowercased, IPv6 bracketed), or undefined when unparsable. */
+function authorityHostname(authority: string): string | undefined {
+  try {
+    // http: is a WHATWG "special scheme": parsing yields a non-empty hostname or throws.
+    return new URL(`http://${authority}`).hostname
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Decide whether one /api request may reach the RPC bridge.
+ * @param request - node HTTP request facts (headers).
+ * @param trustedHosts - exact non-loopback `host[:port]` authorities this deployment serves.
+ * @returns true when the Host is ours and any browser markers are same-origin.
+ */
+export function isTrustedApiRequest(request: ApiTrustRequest, trustedHosts: readonly string[]): boolean {
+  // Host fence (DNS-rebinding defense): the browser fills Host from the URL it
+  // believes it is talking to, so a rebound page carries the attacker's domain
+  // here even though the socket lands on this server.
+  const host = header(request.headers, 'host')
+  if (host === undefined) return false
+  const hostname = authorityHostname(host)
+  if (hostname === undefined) return false
+  if (!isLoopbackHostname(hostname) && !trustedHosts.includes(host)) return false
+  // Cross-site fence: modern browsers label the initiator relationship on
+  // every fetch; an explicit cross-site marker is refused regardless of Origin.
+  if (header(request.headers, 'sec-fetch-site') === 'cross-site') return false
+  // Origin fence: when a browser attaches an Origin it must be exactly this
+  // authority. Absent Origin = non-browser client (curl, tests, native shells)
+  // — allowed, because without a browser there is no confused deputy. The
+  // literal "null" (sandboxed iframes, file: pages) is an opaque origin, refused.
+  const origin = header(request.headers, 'origin')
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
index bc73e0e054..77f463149e 100644
--- a/packages/client/connection/src/index.ts
+++ b/packages/client/connection/src/index.ts
@@ -1,11 +1,12 @@
 /** Host HTTP bridge for browser-client RPC. */
 import type { Context } from 'cordis'
+import z from 'schemastery'
 // Activates the httpServer Context merge used below.
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { toFetchHandler } from '@deepseek-ai/dsh-host-apiproxy'
 import { API_PATH } from './api-path.ts'
 import { bridge } from './http-bridge.ts'
-import { isTrustedNativeDialogRequest } from './native-dialog-request.ts'
+import { isTrustedApiRequest } from './api-request-trust.ts'
 
 export { API_PATH } from './api-path.ts'
 
@@ -15,19 +16,37 @@ export const name = 'client-connection'
 /** Services required before mounting the route. */
 export const inject = ['httpServer', 'apiProxy']
 
+/** Plugin config: the deployment's non-loopback serving authorities. */
+export interface ConnectionConfig {
+  /**
+   * Exact `host[:port]` authorities this deployment serves beyond loopback.
+   * The /api trust fence refuses any request whose Host is neither loopback
+   * nor listed here, so a non-loopback (`0.0.0.0`) deployment must declare
+   * the names it is reached by.
+   */
+  trustedHosts?: string[]
+}
+
+export const Config: z<ConnectionConfig> = z.object({
+  trustedHosts: z.array(String).default([]),
+})
+
 /**
- * Mounts the API gateway under the browser transport prefix.
+ * Mounts the API gateway under the browser transport prefix. Every request on
+ * the prefix passes the browser-trust fence first (DNS-rebinding and
+ * cross-site defense — [api-request-trust](./api-request-trust.ts)).
  * @param ctx - Host plugin context.
+ * @param config - resolved plugin config (schema defaults applied).
  */
-export function apply(ctx: Context): void {
+export function apply(ctx: Context, config?: ConnectionConfig): void {
+  // The Loader resolves schema defaults; hand-built test contexts may pass none.
+  const trustedHosts = config?.trustedHosts ?? []
   const apiHandler = toFetchHandler(ctx.apiProxy)
   const route: WebRoute = {
     kind: 'prefix',
     path: API_PATH,
     handler: async (req, res) => {
-      const pathname = new URL(req.url ?? '/', 'http://dsh.internal').pathname
-      if (pathname === `${API_PATH}/host.pickDirectory`
-        && !isTrustedNativeDialogRequest(req)) {
+      if (!isTrustedApiRequest(req, trustedHosts)) {
         res.writeHead(403)
         res.end('forbidden')
         return
diff --git a/packages/client/connection/src/native-dialog-request.ts b/packages/client/connection/src/native-dialog-request.ts
deleted file mode 100644
index fe91bbae2d..0000000000
--- a/packages/client/connection/src/native-dialog-request.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-/** Trust check for browser requests that can open an operating-system dialog. */
-
-import type { IncomingHttpHeaders } from 'node:http'
-
-interface NativeDialogRequest {
-  headers: IncomingHttpHeaders
-  socket: { remoteAddress?: string | undefined }
-}
-
-function header(headers: IncomingHttpHeaders, name: string): string | undefined {
-  const value = headers[name]
-  return typeof value === 'string' ? value : undefined
-}
-
-function isLoopback(address: string | undefined): boolean {
-  if (address === undefined) return false
-  if (address === '::1') return true
-  const ipv4 = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address
-  const first = ipv4.split('.')[0]
-  return first === '127'
-}
-
-function isLoopbackHostname(hostname: string): boolean {
-  if (hostname === 'localhost' || hostname === '[::1]' || hostname === '::1') return true
-  const parts = hostname.split('.')
-  return parts.length === 4
-    && parts[0] === '127'
-    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
-}
-
-/**
- * Require a local socket plus browser-controlled same-origin metadata.
- * @param request - the node HTTP request facts used by the carrier guard.
- * @returns true only for a same-origin browser request whose peer and URL are loopback.
- */
-export function isTrustedNativeDialogRequest(request: NativeDialogRequest): boolean {
-  if (!isLoopback(request.socket.remoteAddress)) return false
-  if (header(request.headers, 'sec-fetch-site') !== 'same-origin') return false
-  const origin = header(request.headers, 'origin')
-  const host = header(request.headers, 'host')
-  if (origin === undefined || host === undefined) return false
-  try {
-    const parsed = new URL(origin)
-    const hostUrl = new URL(`http://${host}`)
-    return (parsed.protocol === 'http:' || parsed.protocol === 'https:')
-      && parsed.host === host
-      && isLoopbackHostname(parsed.hostname)
-      && isLoopbackHostname(hostUrl.hostname)
-  } catch {
-    return false
-  }
-}
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
new file mode 100644
index 0000000000..eab878e734
--- /dev/null
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -0,0 +1,60 @@
+/** Behavior of the /api browser-trust fence (rebinding + cross-site defense). */
+
+import { describe, expect, it } from 'vitest'
+import { isTrustedApiRequest } from '../src/api-request-trust.ts'
+
+function request(headers: Record<string, string | undefined>): { headers: Record<string, string | undefined> } {
+  return { headers }
+}
+
+describe('isTrustedApiRequest', () => {
+  it('accepts loopback Hosts in every spelling, with and without ports', () => {
+    for (const host of ['localhost', 'localhost:3080', '127.0.0.1', '127.0.0.1:3080', '127.8.9.10:80', '[::1]', '[::1]:3080', 'LOCALHOST:3080']) {
+      expect(isTrustedApiRequest(request({ host }), [])).toBe(true)
+    }
+  })
+
+  it('accepts non-browser requests (no Origin, no sec-fetch-site) — curl, tests, native clients', () => {
+    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080' }), [])).toBe(true)
+  })
+
+  it('refuses a rebound Host: the attacker domain names the socket it did not expect', () => {
+    expect(isTrustedApiRequest(request({
+      host: 'evil.example:3080',
+      origin: 'http://evil.example:3080',
+      'sec-fetch-site': 'same-origin',
+    }), [])).toBe(false)
+  })
+
+  it('accepts a declared public authority only on exact host[:port] match', () => {
+    const headers = { host: 'harness.internal:3080', origin: 'http://harness.internal:3080' }
+    expect(isTrustedApiRequest(request(headers), ['harness.internal:3080'])).toBe(true)
+    expect(isTrustedApiRequest(request(headers), ['harness.internal'])).toBe(false)
+    expect(isTrustedApiRequest(request(headers), [])).toBe(false)
+  })
+
+  it('refuses cross-origin browser markers even on a loopback Host', () => {
+    // Origin present and different → cross-site request that survived preflight rules.
+    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080', origin: 'http://evil.example' }), [])).toBe(false)
+    // Explicit cross-site label → refused regardless of Origin.
+    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080', 'sec-fetch-site': 'cross-site' }), [])).toBe(false)
+    // Opaque origin (sandboxed iframe, file: page) parses to no authority.
+    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080', origin: 'null' }), [])).toBe(false)
+  })
+
+  it('accepts a same-origin browser request', () => {
+    expect(isTrustedApiRequest(request({
+      host: 'localhost:3080',
+      origin: 'http://localhost:3080',
+      'sec-fetch-site': 'same-origin',
+    }), [])).toBe(true)
+  })
+
+  it('refuses malformed authorities', () => {
+    expect(isTrustedApiRequest(request({}), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ host: '' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ host: 'bad host' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ host: '127.0.0.999' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ host: '128.0.0.1' }), [])).toBe(false)
+  })
+})
diff --git a/packages/client/connection/tests/native-dialog-request.spec.ts b/packages/client/connection/tests/native-dialog-request.spec.ts
deleted file mode 100644
index 1a3d70dd15..0000000000
--- a/packages/client/connection/tests/native-dialog-request.spec.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import type { IncomingHttpHeaders } from 'node:http'
-import { describe, expect, it } from 'vitest'
-import { isTrustedNativeDialogRequest } from '../src/native-dialog-request.ts'
-
-function request(
-  remoteAddress: string | undefined,
-  headers: IncomingHttpHeaders = {
-    host: '127.0.0.1:3080',
-    origin: 'http://127.0.0.1:3080',
-    'sec-fetch-site': 'same-origin',
-  },
-) {
-  return { socket: { remoteAddress }, headers }
-}
-
-describe('native dialog request trust', () => {
-  it('accepts loopback same-origin browser requests', () => {
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1'))).toBe(true)
-    expect(isTrustedNativeDialogRequest(request('::1', {
-      host: '[::1]:3080', origin: 'http://[::1]:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(true)
-    expect(isTrustedNativeDialogRequest(request('::ffff:127.0.0.1'))).toBe(true)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: 'localhost:3080', origin: 'http://localhost:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(true)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.2', {
-      host: '127.0.0.2:3080', origin: 'https://127.0.0.2:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(true)
-  })
-
-  it('rejects remote sockets and requests without matching browser metadata', () => {
-    expect(isTrustedNativeDialogRequest(request('192.168.1.5'))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request(undefined))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: '127.0.0.1:3080', origin: 'http://evil.example', 'sec-fetch-site': 'cross-site',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: '127.0.0.1:3080', origin: 'http://localhost:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', { host: '127.0.0.1:3080' }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      origin: 'http://127.0.0.1:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: 'attacker.example:3080', origin: 'http://attacker.example:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: '127.0.0.1:3080', origin: 'ftp://127.0.0.1:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: '127.999.0.1:3080', origin: 'http://127.999.0.1:3080', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-    expect(isTrustedNativeDialogRequest(request('127.0.0.1', {
-      host: '[invalid', origin: 'http://[invalid', 'sec-fetch-site': 'same-origin',
-    }))).toBe(false)
-  })
-})
diff --git a/packages/client/connection/tests/node-half.spec.ts b/packages/client/connection/tests/node-half.spec.ts
index 86af61ba0d..a492a7a9c0 100644
--- a/packages/client/connection/tests/node-half.spec.ts
+++ b/packages/client/connection/tests/node-half.spec.ts
@@ -1,4 +1,6 @@
 /** Node half: registers the /api prefix route bridging to the api gateway. */
+import { EventEmitter } from 'node:events'
+import { Readable } from 'node:stream'
 import { Context } from 'cordis'
 import { describe, expect, it } from 'vitest'
 import type { IncomingMessage, ServerResponse } from 'node:http'
@@ -6,46 +8,84 @@ import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy/api'
 import type { HttpServerService, WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { API_PATH, apply, inject } from '../src/index.ts'
 
+/** Structural httpServer fake: the plugin only touches register(). */
+function fakeHttpServer(routes: WebRoute[]): Pick<HttpServerService, 'register' | 'tapIndex' | 'port'> {
+  return {
+    register(route) {
+      routes.push(route)
+      return () => { routes.splice(routes.indexOf(route), 1) }
+    },
+    tapIndex: () => () => {},
+    port: 0,
+  }
+}
+
+/** Bodyless GET carrying the given headers (enough for the trust fence + bridge). */
+function fakeRequest(headers: Record<string, string>): IncomingMessage {
+  const request = Readable.from([]) as unknown as IncomingMessage
+  Object.assign(request, { url: `${API_PATH}/session.list`, method: 'GET', headers })
+  return request
+}
+
+/** Response recorder compatible with both the fence's short-circuit and the bridge. */
+function fakeResponse(): { response: ServerResponse; state: { status?: number; body?: unknown } } {
+  const state: { status?: number; body?: unknown } = {}
+  const response = Object.assign(new EventEmitter(), {
+    writableEnded: false,
+    writeHead(value: number) { state.status = value; return this },
+    write() { return true },
+    end(this: { writableEnded: boolean }, value?: unknown) {
+      if (value !== undefined) state.body = value
+      this.writableEnded = true
+      return this
+    },
+  }) as unknown as ServerResponse
+  return { response, state }
+}
+
+async function mounted(config?: { trustedHosts?: string[] }): Promise<{ routes: WebRoute[]; dispose: () => Promise<void> }> {
+  const ctx = new Context()
+  const routes: WebRoute[] = []
+  ctx.provide('httpServer', fakeHttpServer(routes) as HttpServerService)
+  ctx.provide('apiProxy', {} as unknown as ApiProxy)
+  const fiber = ctx.plugin({ inject: [...inject], apply }, config)
+  await fiber.await()
+  return { routes, dispose: () => fiber.dispose() }
+}
+
 describe('connection node half', () => {
   it('registers the /api prefix route and removes it with the fiber', async () => {
-    const ctx = new Context()
-    const routes: WebRoute[] = []
-    // Structural fake: the plugin only touches register(); the service class
-    // carries private state a literal cannot (and need not) reproduce.
-    const httpServer: Pick<HttpServerService, 'register' | 'tapIndex' | 'port'> = {
-      register(route) {
-        routes.push(route)
-        return () => { routes.splice(routes.indexOf(route), 1) }
-      },
-      tapIndex: () => () => {},
-      port: 0,
-    }
-    ctx.provide('httpServer', httpServer as HttpServerService)
-    ctx.provide('apiProxy', {} as unknown as ApiProxy)
-
-    const fiber = ctx.plugin({ inject: [...inject], apply })
-    await fiber.await()
+    const { routes, dispose } = await mounted()
     expect(routes).toHaveLength(1)
     expect(routes[0]).toMatchObject({ kind: 'prefix', path: API_PATH })
-
-    let status: number | undefined
-    let body: unknown
-    const deniedRequest = {
-      url: '/api/host.pickDirectory',
-      headers: {
-        host: 'harness.example', origin: 'http://harness.example', 'sec-fetch-site': 'same-origin',
-      },
-      socket: { remoteAddress: '192.168.1.8' },
-    } as unknown as IncomingMessage
-    const deniedResponse = {
-      writeHead(value: number) { status = value; return this },
-      end(value?: unknown) { body = value; return this },
-    } as unknown as ServerResponse
-    await routes[0]!.handler(deniedRequest, deniedResponse)
-    expect(status).toBe(403)
-    expect(body).toBe('forbidden')
-
-    await fiber.dispose()
+    await dispose()
     expect(routes).toHaveLength(0)
   })
+
+  it('refuses an untrusted Host on any /api path before the bridge runs', async () => {
+    const { routes, dispose } = await mounted()
+    const { response, state } = fakeResponse()
+    await routes[0]!.handler(fakeRequest({
+      host: 'harness.example', origin: 'http://harness.example', 'sec-fetch-site': 'same-origin',
+    }), response)
+    expect(state.status).toBe(403)
+    expect(state.body).toBe('forbidden')
+    await dispose()
+  })
+
+  it('passes loopback and declared-authority requests through to the bridge', async () => {
+    const { routes, dispose } = await mounted({ trustedHosts: ['harness.example:3080'] })
+    // Loopback, no browser markers (curl shape): the fence passes; the carrier
+    // answers 404 for a GET unary path — proof the bridge ran.
+    const loopback = fakeResponse()
+    await routes[0]!.handler(fakeRequest({ host: '127.0.0.1:3080' }), loopback.response)
+    expect(loopback.state.status).toBe(404)
+    // Declared public authority, same-origin browser shape.
+    const declared = fakeResponse()
+    await routes[0]!.handler(fakeRequest({
+      host: 'harness.example:3080', origin: 'http://harness.example:3080', 'sec-fetch-site': 'same-origin',
+    }), declared.response)
+    expect(declared.state.status).toBe(404)
+    await dispose()
+  })
 })
diff --git a/packages/host/apiproxy/README.i18n.yaml b/packages/host/apiproxy/README.i18n.yaml
index ede79d610b..bfda016b16 100644
--- a/packages/host/apiproxy/README.i18n.yaml
+++ b/packages/host/apiproxy/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: 63294100cd0dc62f9822a3ca9678c1034880169f
-README.zh.md: 251b4b0356da5f1fb518d133a92f484da957b951
+README.md: 2f51aa23e2639e2e98dfdd8aaf71e807d641c3dc
+README.zh.md: 687e60879702a762d9e85295789b77daea4bd4ac
diff --git a/packages/host/apiproxy/README.md b/packages/host/apiproxy/README.md
index 63294100cd..2f51aa23e2 100644
--- a/packages/host/apiproxy/README.md
+++ b/packages/host/apiproxy/README.md
@@ -16,7 +16,7 @@ Session model routing is a session-domain contract. `session.models` returns the
 
 Workspace and Session lists are separate reconnect baselines. `workspace.create` creates a unique name or adopts an existing directory, `workspace.delete` removes only the Workspace registration, `session.create` accepts an optional preallocated Session id, and `host/workspace-changed`, `host/workspace-removed`, plus `host/session-added` carry committed increments in either arrival order. Registration deletion preserves the directory and session logs; its Sessions remain in `session.list` and become Ungrouped. `SessionSummary.blank` and the `host/session-added` frame carry the derived zero-events bit: clients hide blank sessions and reuse them per workspace, flip blank on the first `host/session-status(running:true)`, and treat `session.list` as the reconnect authority; cold summaries are never blank because lazy persistence keeps never-appended sessions out of `list()`.
 
-`host.pickDirectory` opens one native directory picker and returns its selected path, or `null` when the user cancels. Its host implementation invokes platform tools without a shell: `osascript` on macOS, an STA PowerShell `FolderBrowserDialog` on Windows, and Zenity with a KDialog fallback on Linux. The picker function is injectable for tests. This user-paced method is the sole unary call exempt from the default 30-second timeout; caller and connection aborts still propagate to the native process. The browser carrier separately restricts this privileged method to loopback, same-origin requests.
+`host.pickDirectory` opens one native directory picker and returns its selected path, or `null` when the user cancels. Its host implementation invokes platform tools without a shell: `osascript` on macOS, an STA PowerShell `FolderBrowserDialog` on Windows, and Zenity with a KDialog fallback on Linux. The picker function is injectable for tests. This user-paced method is the sole unary call exempt from the default 30-second timeout; caller and connection aborts still propagate to the native process. The browser carrier's prefix-wide trust fence (dsh-client-connection) covers this method like every other `/api` request.
 
 `session.history` pages on message boundaries, and its tail page (no `beforeSeq`) carries two session-level extras the page window cannot supply: the in-flight partial's chunk events, and `todos` — the latest `todo/write` whole-list projection over the full log. Older pages omit `todos` because the projection is session-level, not per-page; a tail response that omits it means the whole log holds no `todo/write`, so clients read the absent field as the empty plan rather than as unchanged state.
 
diff --git a/packages/host/apiproxy/README.zh.md b/packages/host/apiproxy/README.zh.md
index 251b4b0356..687e608797 100644
--- a/packages/host/apiproxy/README.zh.md
+++ b/packages/host/apiproxy/README.zh.md
@@ -16,7 +16,7 @@ mux 流会在每个已附加会话的订阅基线之后，以及对应的实时
 
 Workspace 列表与 Session 列表是相互独立的重连基线。`workspace.create` 会创建唯一名称或接纳现有目录，`workspace.delete` 只移除 Workspace 注册记录，`session.create` 接受可选的预分配 Session id，`host/workspace-changed`、`host/workspace-removed` 与 `host/session-added` 则以任意到达顺序携带已提交的增量。删除注册记录会保留目录和会话日志；相关 Session 仍留在 `session.list` 中，并进入 Ungrouped。`SessionSummary.blank` 与 `host/session-added` 帧携带派生的零事件位：客户端隐藏空白会话并按 workspace 复用它们，在首个 `host/session-status(running:true)` 时翻转 blank，并以 `session.list` 作为重连权威；冷会话摘要永远不是空白：惰性持久化让从未追加过事件的会话根本不出现在 `list()` 中。
 
-`host.pickDirectory` 会打开一个原生目录选择器并返回选中的路径；用户取消时返回 `null`。宿主实现不经 shell 调用平台工具：macOS 使用 `osascript`，Windows 使用以 STA 模式运行的 PowerShell `FolderBrowserDialog`，Linux 使用 Zenity，并以 KDialog 作为回退。选择器函数可在测试中注入。该方法需等待用户完成操作，是唯一不受默认 30 秒超时限制的一元调用；调用方发出的中止信号和连接中止仍会传播至原生进程。浏览器载体另行将这一特权方法限制为仅接受来自回环地址的同源请求。
+`host.pickDirectory` 会打开一个原生目录选择器并返回选中的路径；用户取消时返回 `null`。宿主实现不经 shell 调用平台工具：macOS 使用 `osascript`，Windows 使用以 STA 模式运行的 PowerShell `FolderBrowserDialog`，Linux 使用 Zenity，并以 KDialog 作为回退。选择器函数可在测试中注入。该方法需等待用户完成操作，是唯一不受默认 30 秒超时限制的一元调用；调用方发出的中止信号和连接中止仍会传播至原生进程。浏览器载体的前缀级信任栅栏（dsh-client-connection）像覆盖其他所有 `/api` 请求一样覆盖该方法。
 
 `session.history` 按消息边界分页，其尾页（不带 `beforeSeq`）额外携带两项页窗口本身无法提供的会话级数据：进行中局部消息的 chunk 事件，以及 `todos`——整份日志上最后一次 `todo/write` 的整表投影。较早的页面不带 `todos`，因为该投影是会话级而非分页级的；尾页响应缺少该字段意味着整份日志中没有任何 `todo/write`，因此客户端要把缺失字段读作空计划，而不是读作「状态未变」。
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b9538051cd..f8343b2404 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -797,6 +797,9 @@ importers:
       '@deepseek-ai/dsh-tools':
         specifier: workspace:^
         version: link:../../core/tools
+      schemastery:
+        specifier: ^3.18.0
+        version: 3.18.0
     devDependencies:
       '@deepseek-ai/dsh-host-webserver':
         specifier: workspace:^

From d1ce22e7ad142f99dba86f94de0c353b43bc5a57 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 15:04:59 +0800
Subject: [PATCH 03/16] doc(packages): add the host/ and client/ group READMEs
 and table rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both web-GUI groups shipped without the group README that the packages
table names as each group's canonical package/ctx-key map, and without
rows in that table. Adds both bilingual pairs, the two table rows
(ceiling 835→870: two genuinely new product groups joined the canonical
table at minimal row width), and fixes webserver README drift
(WebServerService/ctx.webServer → HttpServerService/ctx.httpServer,
matching src/index.ts).
---
 packages/README.i18n.yaml                |  4 +--
 packages/README.md                       |  2 ++
 packages/README.zh.md                    |  2 ++
 packages/client/README.i18n.yaml         |  6 +++++
 packages/client/README.md                | 34 ++++++++++++++++++++++++
 packages/client/README.zh.md             | 34 ++++++++++++++++++++++++
 packages/host/README.i18n.yaml           |  6 +++++
 packages/host/README.md                  | 12 +++++++++
 packages/host/README.zh.md               | 12 +++++++++
 packages/host/webserver/README.i18n.yaml |  6 ++---
 packages/host/webserver/README.md        |  2 +-
 packages/host/webserver/README.zh.md     |  2 +-
 scripts/doc-budgets.manifest.json        |  2 +-
 13 files changed, 116 insertions(+), 8 deletions(-)
 create mode 100644 packages/client/README.i18n.yaml
 create mode 100644 packages/client/README.md
 create mode 100644 packages/client/README.zh.md
 create mode 100644 packages/host/README.i18n.yaml
 create mode 100644 packages/host/README.md
 create mode 100644 packages/host/README.zh.md

diff --git a/packages/README.i18n.yaml b/packages/README.i18n.yaml
index 5dd168f03e..2415b8c578 100644
--- a/packages/README.i18n.yaml
+++ b/packages/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: d16e395a42e491461c0862227205931894c27e39
-README.zh.md: 3fb4181ce7ae7b0d79a13ca4358b9df39d83ef1f
+README.md: ed1c2b65ef53793baf905791179b474c2f696637
+README.zh.md: 14c91a5e1899e1df6c9ceedb274423a4b8e12461
diff --git a/packages/README.md b/packages/README.md
index d16e395a42..ed1c2b65ef 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -43,6 +43,8 @@ Packages live at `packages/<group>/<pkg>/`; groups are containers, while names r
 | [`sdk/`](sdk/README.md) | Project SDK tooling | Product — stable surface |
 | [`acp/`](acp/README.md) | Automation-only Agent Client Protocol server | Product — stable surface |
 | [`ui/`](ui/README.md) | Human/client integrations: TUI and JSON-RPC, approval/interaction seams, ask-user tool | Product — stable surface |
+| [`host/`](host/README.md) | Web-GUI host half: shared API gateway + HTTP route server | Product — stable surface |
+| [`client/`](client/README.md) | Web-GUI browser half: shell, wire consumer, object services, slot system, `ui-*` feature plugins | Product — stable surface |
 | [`examples/`](examples/README.md) | Demo bundles (agent-spine + TUI/CLI/ACP/JSON-RPC bins) leaves load | Support — example infra |
 | [`support/`](support/README.md) | Support infrastructure (testkits, invariants, replay, Loader smokes) | Support — lower compatibility expectations |
 | [`util/`](util/README.md) | Low-level zero-dependency utilities shared across groups (`Branded<B>`, Harness home/path helpers, timeout, retention) | Support — small, stable, harness-dep-free |
diff --git a/packages/README.zh.md b/packages/README.zh.md
index 3fb4181ce7..14c91a5e18 100644
--- a/packages/README.zh.md
+++ b/packages/README.zh.md
@@ -43,6 +43,8 @@
 | [`sdk/`](sdk/README.md) | 项目 SDK 工具 | 产品：稳定表面 |
 | [`acp/`](acp/README.md) | 仅面向自动化的 Agent Client Protocol 服务器 | 产品：稳定表面 |
 | [`ui/`](ui/README.md) | 人类／客户端集成：TUI 与 JSON-RPC、批准／交互 seam、用户问答工具 | 产品：稳定表面 |
+| [`host/`](host/README.md) | web GUI 宿主半侧：共享 API 网关 + HTTP 路由服务器 | 产品：稳定表面 |
+| [`client/`](client/README.md) | web GUI 浏览器半侧：shell、协议消费层、对象服务、slot 系统、`ui-*` 特性插件 | 产品：稳定表面 |
 | [`examples/`](examples/README.md) | 演示组合包（agent-spine + TUI/CLI/ACP/JSON-RPC bin），由叶节点加载 | 支持：示例基础设施 |
 | [`support/`](support/README.md) | 支持基础设施（testkit、不变式、回放、Loader 冒烟测试） | 支持：兼容性预期较低 |
 | [`util/`](util/README.md) | 组间共享的低层零依赖工具（`Branded<B>`、Harness home／路径辅助函数、超时、保留策略） | 支持：小型、稳定、无 harness 依赖 |
diff --git a/packages/client/README.i18n.yaml b/packages/client/README.i18n.yaml
new file mode 100644
index 0000000000..0bac8a9924
--- /dev/null
+++ b/packages/client/README.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/client/README.md
+README.md: b111d67fa49e06227e324a33bd53417ad28c3a5b
+README.zh.md: b498008eb82f6ab357718f2af761f38e51140ef8
diff --git a/packages/client/README.md b/packages/client/README.md
new file mode 100644
index 0000000000..b111d67fa4
--- /dev/null
+++ b/packages/client/README.md
@@ -0,0 +1,34 @@
+# client/ — web-GUI browser half
+
+English | [中文](README.zh.md)
+
+The browser side of the dsh web GUI: shell kernel, module system, wire consumer, React-free object services, the slot system, and the `ui-*` feature-plugin roster. Authoring rules live in [AGENTS.md](AGENTS.md); the host half is [`host/`](../host/README.md). All **product** packages, named `@deepseek-ai/dsh-client-<name>`.
+
+| Package | Role | ctx key / slot |
+|---|---|---|
+| `web/` | Shell kernel: `AppWebEntry` runs the two-stage boot over the host-pushed entry graph | (boots the tree) |
+| `modules/` | Client module system: browser peer of Node's ESM loader as a lazy CJS table under the vendored cordis Loader | (module face) |
+| `web-react/` | Shell-side React glue: `createSlotRenderer` + `SessionProvider` render seats | (renderer install) |
+| `connection/` | Wire consumer both ends: browser `ctx.connection` (shared api client + stream loop) and the node half mounting the `/api` route with its browser-trust fence | `ctx.connection` |
+| `runtime/` | Client cordis boot and React-free object services: slots, Sessions, Workspaces, per-session bindings | `ctx.slots` `ctx.sessions` `ctx.workspaces` |
+| `hmr/` | Dev-only hot reload for fetch-arrival client plugins (`--dev` graphs) | (dev entry) |
+| `locale/` | Browser locale preference (`zh`/`en`) plus the ns×locale dictionary registry | `ctx.locale` |
+| `ui-slots/` | Slot registry pure core: SlotMap merging, single `register` API, the four-share props family | (types + core) |
+| `ui-theme/` | Theme preference over the `--dsw-*` token stylesheets (`light`/`dark`/`system`) | `ctx.theme` |
+| `ui-primitives/` | Pure React atoms: icons, Button/Pill/Menu/Modal/Input, markdown family | (component library) |
+| `ui-layout/` | Shell three-column AppFrame; declares `sidebar` / `conversation` / `details` / `conversation.empty` | `ctx.layout` |
+| `ui-sidebar/` | Sidebar shell: Workspace/session rail, search, collapse; declares `sidebar.workspaces` | (slot host) |
+| `ui-workspace/` | Shared Workspace picker: browser region + hero picker over the same creation flow | (fills `sidebar.workspaces`, `conversation.hero.workspace`) |
+| `ui-conversation/` | Conversation domain: skeleton, chat view, input dock, per-tool row slots | (slot host) |
+| `ui-trajectory/` | Trajectory/Waterfall view tabs; the minimal pure-consumer plugin exemplar | (fills `conversation.view`) |
+| `ui-command/` | Command surface: session-keyed directory cache, `/` source, three-kind dispatch | `ctx.command` |
+| `ui-slash/` | Input trigger pipeline: `/` and `@` detection, grouped candidate menu, source roster | `ctx.slash` |
+| `ui-skill/` | `/`-trigger skill reference source over the `skill.list` RPC | (registers into `ctx.slash`) |
+| `ui-subagent/` | `@`-trigger subagent reference source over the sessions snapshot | (registers into `ctx.slash`) |
+| `ui-model/` | Model selection: `/model` popupSelect + the composer model seat over `ModelService` | `ctx.models` |
+| `ui-question/` | Web `ask_user_question`: host half mounts the tool, browser half fills the composer seat | (fills `conversation.composer`) |
+| `ui-settings/` | Settings shell: trigger chrome + modal panel; declares the `settings.*` slots | (slot host) |
+| `ui-settings-general/` | Settings ownerless copy: chrome content + General section skeleton | (fills `settings.*`) |
+| `ui-models/` | Models settings nav entry (content column lands in a later phase) | (fills `settings.section`) |
+
+Feature UI composes only through the slot system (`ctx.slots.register`) — the [slot system standard](../../.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md) is the definitive model; the [web client architecture note](../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md) owns the loading chain and object layer.
diff --git a/packages/client/README.zh.md b/packages/client/README.zh.md
new file mode 100644
index 0000000000..b498008eb8
--- /dev/null
+++ b/packages/client/README.zh.md
@@ -0,0 +1,34 @@
+# client/ — web GUI 浏览器半侧
+
+[English](README.md) | 中文
+
+dsh web GUI 的浏览器侧：shell 内核、模块系统、协议消费层、无 React 依赖的对象服务、slot 系统，以及 `ui-*` 特性插件阵列。编写规则见 [AGENTS.md](AGENTS.md)；宿主半侧是 [`host/`](../host/README.md)。全部为**产品**包，命名为 `@deepseek-ai/dsh-client-<name>`。
+
+| 包 | 角色 | ctx 键／slot |
+|---|---|---|
+| `web/` | shell 内核：`AppWebEntry` 基于宿主推送的条目图运行两阶段启动 | （启动整棵树） |
+| `modules/` | 客户端模块系统：Node ESM 加载器的浏览器对等物，是 vendored cordis Loader 之下的惰性 CJS 表 | （模块面） |
+| `web-react/` | shell 侧 React 胶水：`createSlotRenderer` + `SessionProvider` 渲染座位 | （渲染器安装） |
+| `connection/` | 协议两端的消费者：浏览器侧 `ctx.connection`（共享 api 客户端 + 流循环），node 半侧挂载带浏览器信任栅栏的 `/api` 路由 | `ctx.connection` |
+| `runtime/` | 客户端 cordis 启动与无 React 对象服务：slots、Session、Workspace、逐会话绑定 | `ctx.slots` `ctx.sessions` `ctx.workspaces` |
+| `hmr/` | 仅开发用的 fetch 到达型客户端插件热重载（`--dev` 图） | （开发条目） |
+| `locale/` | 浏览器语言偏好（`zh`／`en`）与 ns×locale 词典注册表 | `ctx.locale` |
+| `ui-slots/` | slot 注册表纯核心：SlotMap 合并、单一 `register` API、四份额 props 族 | （类型 + 核心） |
+| `ui-theme/` | 基于 `--dsw-*` token 样式表的主题偏好（`light`／`dark`／`system`） | `ctx.theme` |
+| `ui-primitives/` | 纯 React 原子：图标、Button/Pill/Menu/Modal/Input、markdown 族 | （组件库） |
+| `ui-layout/` | shell 三栏 AppFrame；声明 `sidebar`／`conversation`／`details`／`conversation.empty` | `ctx.layout` |
+| `ui-sidebar/` | 侧栏 shell：Workspace/会话栏、搜索、折叠；声明 `sidebar.workspaces` | （slot 宿主） |
+| `ui-workspace/` | 共享 Workspace 选择器：浏览区域 + hero 选择器共用同一创建流程 | （填充 `sidebar.workspaces`、`conversation.hero.workspace`） |
+| `ui-conversation/` | 会话域：骨架、聊天视图、输入坞、逐工具行 slot | （slot 宿主） |
+| `ui-trajectory/` | Trajectory／Waterfall 视图标签；最小纯消费者插件范例 | （填充 `conversation.view`） |
+| `ui-command/` | 命令面：按会话键控的目录缓存、`/` 源、三类分发 | `ctx.command` |
+| `ui-slash/` | 输入触发流水线：光标下的 `/` 与 `@` 检测、分组候选菜单、源名册 | `ctx.slash` |
+| `ui-skill/` | 基于 `skill.list` RPC 的 `/` 触发技能引用源 | （注册进 `ctx.slash`） |
+| `ui-subagent/` | 基于会话快照的 `@` 触发子代理引用源 | （注册进 `ctx.slash`） |
+| `ui-model/` | 模型选择：`/model` popupSelect + 输入坞模型座位，均由 `ModelService` 驱动 | `ctx.models` |
+| `ui-question/` | Web `ask_user_question`：宿主半侧挂载工具，浏览器半侧填充输入坞座位 | （填充 `conversation.composer`） |
+| `ui-settings/` | 设置 shell：触发 chrome + 模态面板；声明 `settings.*` slot | （slot 宿主） |
+| `ui-settings-general/` | 设置的无主文案：chrome 内容 + General 分区骨架 | （填充 `settings.*`） |
+| `ui-models/` | 模型设置导航项（内容列留待后续阶段） | （填充 `settings.section`） |
+
+特性 UI 只通过 slot 系统组合（`ctx.slots.register`）——[slot 系统标准](../../.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md)是权威模型；[web 客户端架构 Note](../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md) 拥有加载链与对象层。
diff --git a/packages/host/README.i18n.yaml b/packages/host/README.i18n.yaml
new file mode 100644
index 0000000000..b406dd394e
--- /dev/null
+++ b/packages/host/README.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/host/README.md
+README.md: 61e50cb64b95932085342b01a22d029cf8d5a228
+README.zh.md: 3109eccf89ee4c2d4d01be546e3ee9ead9084edc
diff --git a/packages/host/README.md b/packages/host/README.md
new file mode 100644
index 0000000000..61e50cb64b
--- /dev/null
+++ b/packages/host/README.md
@@ -0,0 +1,12 @@
+# host/ — web-GUI host half
+
+English | [中文](README.zh.md)
+
+The host side of the dsh web GUI: the API gateway every client shape shares, and the plain HTTP server it rides on. The browser side lives in [`client/`](../client/README.md); the composed application is [`apps/cli`](../../apps/cli/cordis.yml) serving [`apps/web`](../../apps/web/). All **product** packages.
+
+| Package | Role | ctx key |
+|---|---|---|
+| `apiproxy/` | The shared API gateway: the zero-Node TS wire contract (`src/api/`), the fetch carrier pair (`toFetchHandler` host-side, `AbstractApiClient` client-side), and the host implementation over `ctx.agents`/`ctx.workspace` | `ctx.apiProxy` |
+| `webserver/` | Plain HTTP route-registration carrier: `node:http` server listening on activation; routes register as named `exact`/`prefix` handlers | `ctx.httpServer` |
+
+`apiproxy` is transport-agnostic by design — it registers no routes; carriers wrap `ctx.apiProxy` themselves. The HTTP carrier route (with its `/api` browser-trust fence) is mounted by [`client/connection`](../client/connection/README.md)'s node half, which is why that package lives in the client group: it owns both ends of the wire.
diff --git a/packages/host/README.zh.md b/packages/host/README.zh.md
new file mode 100644
index 0000000000..3109eccf89
--- /dev/null
+++ b/packages/host/README.zh.md
@@ -0,0 +1,12 @@
+# host/ — web GUI 宿主半侧
+
+[English](README.md) | 中文
+
+dsh web GUI 的宿主侧：所有客户端形态共用的 API 网关，以及承载它的纯 HTTP 服务器。浏览器侧位于 [`client/`](../client/README.md)；组合后的应用是 [`apps/cli`](../../apps/cli/cordis.yml)，它负责服务 [`apps/web`](../../apps/web/)。全部为**产品**包。
+
+| 包 | 角色 | ctx 键 |
+|---|---|---|
+| `apiproxy/` | 共享 API 网关：零 Node 依赖的 TS 协议契约（`src/api/`）、fetch 载体对（宿主侧 `toFetchHandler`、客户端侧 `AbstractApiClient`），以及基于 `ctx.agents`／`ctx.workspace` 的宿主实现 | `ctx.apiProxy` |
+| `webserver/` | 纯 HTTP 路由注册载体：激活即监听的 `node:http` 服务器；路由以命名的 `exact`／`prefix` 处理器注册 | `ctx.httpServer` |
+
+`apiproxy` 在设计上与传输方式无关——它不注册任何路由；载体自行包装 `ctx.apiProxy`。HTTP 载体路由（连同其 `/api` 浏览器信任栅栏）由 [`client/connection`](../client/connection/README.md) 的 node 半侧挂载，这正是该包住在 client 组的原因：它拥有这条线的两端。
diff --git a/packages/host/webserver/README.i18n.yaml b/packages/host/webserver/README.i18n.yaml
index 9addd33a69..40d5fcf9d3 100644
--- a/packages/host/webserver/README.i18n.yaml
+++ b/packages/host/webserver/README.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-README.md: c589c32c4e641e188f19ac6c5ad2e88e3eb79be3
-README.zh.md: 767195086b90a76160d87865caebf514ca75b0e3
+#   pnpm run verify-translation-pairing --write packages/host/webserver/README.md
+README.md: e715e4452ddb808f36e6b097eee0fda7b8d0bfb0
+README.zh.md: 05e7e10d7815c8f26bb90597b38b7c6b83a86dbc
diff --git a/packages/host/webserver/README.md b/packages/host/webserver/README.md
index c589c32c4e..e715e4452d 100644
--- a/packages/host/webserver/README.md
+++ b/packages/host/webserver/README.md
@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-Plain HTTP route-registration plugin (default-exported `WebServerService`, config `{host, port, distIndex}`): a `node:http` server that listens on activation and provides `ctx.webServer` — `register(route)` adds a named `exact`/`prefix` route (duplicate `(kind, path)` throws: route patterns are a composition-level contract, so a collision is a misconfiguration; the returned disposer removes the route), `tapIndex(transform)` adds an index.html transform applied in registration order, and `port` reads the listening port (the OS-assigned value when `port` is 0). The match order is fixed — exact over the whole table, then longest prefix, then the static dist fallback with the locked semantics: traversal outside the dist root is 403, any miss falls back to `index.html` with HTTP 200 (SPA routing), unknown extensions ship as octet-stream, non-GET/HEAD is 405. Registration order carries no request-facing semantics.
+Plain HTTP route-registration plugin (default-exported `HttpServerService`, config `{host, port, distIndex}`): a `node:http` server that listens on activation and provides `ctx.httpServer` — `register(route)` adds a named `exact`/`prefix` route (duplicate `(kind, path)` throws: route patterns are a composition-level contract, so a collision is a misconfiguration; the returned disposer removes the route), `tapIndex(transform)` adds an index.html transform applied in registration order, and `port` reads the listening port (the OS-assigned value when `port` is 0). The match order is fixed — exact over the whole table, then longest prefix, then the static dist fallback with the locked semantics: traversal outside the dist root is 403, any miss falls back to `index.html` with HTTP 200 (SPA routing), unknown extensions ship as octet-stream, non-GET/HEAD is 405. Registration order carries no request-facing semantics.
 
 The package knows no harness concepts: the `/api` bridge is the connection plugin's route, plugin bundles and the HMR event stream are the modules/hmr plugins' routes. `host` accepts only `127.0.0.1` (default posture) and `0.0.0.0` (deliberate network exposure); `distIndex` is an assembly fact the composing app resolves and injects, never self-resolved (dist location is workspace knowledge of the app). Web (browser) shape only — Electron loads dist over `file://` and carries fetch over an IPC bridge, not this server. This package never prints; the URL line belongs to the shell.
 
diff --git a/packages/host/webserver/README.zh.md b/packages/host/webserver/README.zh.md
index 767195086b..05e7e10d78 100644
--- a/packages/host/webserver/README.zh.md
+++ b/packages/host/webserver/README.zh.md
@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-朴素的 HTTP 路由注册插件（默认导出 `WebServerService`，配置为 `{host, port, distIndex}`）：一个在激活时开始监听的 `node:http` 服务器，提供 `ctx.webServer`。`register(route)` 添加具名的 `exact`／`prefix` 路由；重复的 `(kind, path)` 会抛错，因为路由模式是组合层契约，冲突即配置错误；返回的 disposer 会移除该路由。`tapIndex(transform)` 添加按注册顺序应用的 index.html 转换，`port` 读取正在监听的端口（当 `port` 为 0 时读取 OS 分配的值）。匹配顺序固定不变：先在整张表中匹配精确路由，再匹配最长前缀，最后回退到静态 dist，并遵循固定语义：越出 dist 根目录的遍历返回 403，任何未命中项都以 HTTP 200 回退到 `index.html`（SPA 路由），未知扩展名按 octet-stream 提供，GET／HEAD 之外的方法返回 405。注册顺序不承载任何面向请求的语义。
+朴素的 HTTP 路由注册插件（默认导出 `HttpServerService`，配置为 `{host, port, distIndex}`）：一个在激活时开始监听的 `node:http` 服务器，提供 `ctx.httpServer`。`register(route)` 添加具名的 `exact`／`prefix` 路由；重复的 `(kind, path)` 会抛错，因为路由模式是组合层契约，冲突即配置错误；返回的 disposer 会移除该路由。`tapIndex(transform)` 添加按注册顺序应用的 index.html 转换，`port` 读取正在监听的端口（当 `port` 为 0 时读取 OS 分配的值）。匹配顺序固定不变：先在整张表中匹配精确路由，再匹配最长前缀，最后回退到静态 dist，并遵循固定语义：越出 dist 根目录的遍历返回 403，任何未命中项都以 HTTP 200 回退到 `index.html`（SPA 路由），未知扩展名按 octet-stream 提供，GET／HEAD 之外的方法返回 405。注册顺序不承载任何面向请求的语义。
 
 该包不了解任何 harness 概念：`/api` 桥接是 connection 插件的路由，插件 bundle 与 HMR（热模块替换）事件流则是 modules／hmr 插件的路由。`host` 只接受 `127.0.0.1`（默认姿态）和 `0.0.0.0`（有意向网络开放）；`distIndex` 是由组合应用解析并注入的组装事实，绝不会自行解析，因为 dist 位置属于应用的工作区知识。该服务器只服务 Web（浏览器）形态；Electron 通过 `file://` 加载 dist，并经 IPC 桥接承载 fetch，而不使用本服务器。该包从不打印内容；URL 行属于 shell。
 
diff --git a/scripts/doc-budgets.manifest.json b/scripts/doc-budgets.manifest.json
index 4cae854147..ea8cb380c9 100644
--- a/scripts/doc-budgets.manifest.json
+++ b/scripts/doc-budgets.manifest.json
@@ -7,5 +7,5 @@
   "docs/testing.md": 1100,
   "examples/AGENTS.md": 310,
   "packages/AGENTS.md": 675,
-  "packages/README.md": 835
+  "packages/README.md": 870
 }

From 01eea07bab1b73dac380919c8dafa94fa5adc9ba Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 15:40:02 +0800
Subject: [PATCH 04/16] fix(connection): keep LAN serving working under the
 /api browser-trust fence

Markerless requests pass on any Host (a non-browser sender is the principal
and forges headers anyway); browser Host matching gains port-less entries and
WHATWG normalization; dsh derives LAN IP-literal authorities for an
all-interfaces bind and web grows --trusted-host for named ones.
---
 ...07-28-api-browser-trust-boundary.i18n.yaml |  4 +-
 .../2026-07-28-api-browser-trust-boundary.md  |  4 +-
 ...026-07-28-api-browser-trust-boundary.zh.md |  4 +-
 apps/cli/README.i18n.yaml                     |  6 +-
 apps/cli/README.md                            |  2 +-
 apps/cli/README.zh.md                         |  2 +-
 apps/cli/src/app-cli-entry.ts                 | 41 +++++++++++++
 apps/cli/src/args.ts                          |  5 ++
 apps/cli/src/bin.ts                           |  2 +-
 apps/cli/src/web.ts                           | 19 +++----
 apps/cli/tests/args.spec.ts                   |  3 +
 apps/cli/tests/trusted-hosts.spec.ts          | 40 +++++++++++++
 docs/config-catalog.md                        |  9 +--
 packages/client/connection/README.i18n.yaml   |  4 +-
 packages/client/connection/README.md          |  2 +-
 packages/client/connection/README.zh.md       |  2 +-
 .../connection/src/api-request-trust.ts       | 57 +++++++++++++------
 packages/client/connection/src/index.ts       |  9 +--
 .../tests/api-request-trust.spec.ts           | 45 ++++++++++-----
 .../client/connection/tests/node-half.spec.ts |  5 ++
 20 files changed, 199 insertions(+), 66 deletions(-)
 create mode 100644 apps/cli/tests/trusted-hosts.spec.ts

diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
index 11973b755f..68473ee893 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
-2026-07-28-api-browser-trust-boundary.md: c620f1a65e3890bbd2580415e55b25436fefe36e
-2026-07-28-api-browser-trust-boundary.zh.md: 0452eff1017b2f70a00e67c5cfce8dba3a840539
+2026-07-28-api-browser-trust-boundary.md: 45a332fcfe59fb930a85cfc595dd02c5fe12a5d7
+2026-07-28-api-browser-trust-boundary.zh.md: 731d6c81f71a2f50b716e52e278f2c53ad62a04b
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
index c620f1a65e..45a332fcfe 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
@@ -13,7 +13,7 @@ The web GUI host serves `/api` over plain HTTP (default `127.0.0.1:3080`, `--hos
 Enforce browser trust once, at the carrier, for the entire `/api` prefix — two halves in two stacked PRs:
 
 - **Media-type fence (dsh-host-apiproxy)**: every `/api` POST must declare `application/json`, else 415 before parsing. Cross-site "simple" requests thereby stop existing: any cross-site attempt is forced into a CORS preflight this server never answers.
-- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: `Host` must be loopback or an exact `host[:port]` from the plugin's `trustedHosts` config (rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. Requests without browser markers pass — a non-browser client is the principal itself, not a deputy. `host.pickDirectory` loses its bespoke guard and rides the same fence.
+- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: requests without browser markers (no `Origin`, no `sec-fetch-site`) pass on any Host — a non-browser client is the principal itself, not a deputy, and forges every header anyway, so fencing it buys nothing and breaks non-browser LAN automation. For browser requests, `Host` must be loopback or match a `trustedHosts` entry (exact on `host:port`, any port on port-less entries, WHATWG-normalized; rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. `host.pickDirectory` loses its bespoke guard and rides the same fence.
 
 Two boundaries stay deliberately out of scope: reachability is the webserver binding's policy (`host: 127.0.0.1 | 0.0.0.0`), and authentication for genuinely remote deployments is deferred work recorded in the connection README — the fence is a confused-deputy defense, not an auth layer. The old guard's loopback-socket check was dropped rather than generalized: with binding expressing reachability and `trustedHosts` naming remote authorities, the socket address adds nothing a header fence does not already cover.
 
@@ -26,6 +26,6 @@ Two boundaries stay deliberately out of scope: reachability is the webserver bin
 ## Consequences
 
 - Any future `/api` method is covered by construction; there is no per-route trust decision left to forget.
-- Non-loopback deployments must declare their serving authorities in `trustedHosts` or browsers are refused; plain curl-shape automation is unaffected either way.
+- Non-loopback deployments must have their serving authorities trusted or browsers are refused. The dsh CLI keeps its advertised `--host 0.0.0.0` LAN URL working by deriving the machine's LAN IP literals into the connection row (port-less entries — an IP-literal Host cannot be a rebound name, and the bound port may be OS-assigned) and offers `dsh web --trusted-host` for named authorities; compositions the CLI does not boot declare `trustedHosts` themselves. Plain curl-shape automation is unaffected everywhere.
 - Clients must label POST bodies `application/json` (ours always did; raw-fetch tests gained the header).
 - The trusted-network assumption of an unauthenticated `0.0.0.0` deployment is now documented instead of implicit.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
index 0452eff101..731d6c81f7 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
@@ -13,7 +13,7 @@ Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--ho
 在载体层对整个 `/api` 前缀一次性执行浏览器信任检查——两半各占一个栈式 PR：
 
 - **媒体类型栅栏（dsh-host-apiproxy）**：每个 `/api` POST 必须声明 `application/json`，否则在解析前以 415 拒绝。跨站"简单请求"由此不复存在：任何跨站尝试都被逼进一次本服务器从不应答的 CORS 预检。
-- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：`Host` 必须是回环地址，或与插件 `trustedHosts` 配置中的某个 `host[:port]` 精确匹配（rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。不带浏览器标头的请求放行——非浏览器客户端是委托人本人，不是代理人。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
+- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`）在任何 Host 上都放行——非浏览器客户端是委托人本人，不是代理人，且本就可以伪造任何请求头，对它设栅一无所获，反而会打断非浏览器的 LAN 自动化。对浏览器请求，`Host` 必须是回环地址，或与某个 `trustedHosts` 条目匹配（带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，均经 WHATWG 归一化；rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
 
 两条边界刻意留在范围之外：可达性归 webserver 绑定配置（`host: 127.0.0.1 | 0.0.0.0`）管辖；真正远程部署的认证是延期工作，记录在 connection README——这道栅栏是混淆代理人防御，不是认证层。旧守卫的回环 socket 检查被放弃而非泛化：绑定表达可达性、`trustedHosts` 点名远程权威之后，socket 地址提供不了头部栅栏覆盖不到的任何东西。
 
@@ -26,6 +26,6 @@ Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--ho
 ## 后果
 
 - 未来任何 `/api` 方法天然在覆盖范围内；不存在会被遗忘的按路由信任决定。
-- 非回环部署必须在 `trustedHosts` 中声明服务权威，否则浏览器会被拒绝；curl 形态的自动化不受影响。
+- 非回环部署的服务权威必须获得信任，否则浏览器会被拒绝。dsh CLI 通过把本机 LAN IP 字面量推导进 connection 行（不带端口的条目——IP 字面量 Host 不可能是被重绑的域名，且绑定端口可能由操作系统分配）来保住它广告出的 `--host 0.0.0.0` LAN URL，并提供 `dsh web --trusted-host` 声明具名权威；CLI 不参与引导的组合自行声明 `trustedHosts`。curl 形态的自动化在任何地方都不受影响。
 - 客户端必须给 POST 体标注 `application/json`（我们自己的客户端一向如此；裸 fetch 测试补上了该头）。
 - 无认证 `0.0.0.0` 部署的"信任网络"假设从隐含变为成文。
diff --git a/apps/cli/README.i18n.yaml b/apps/cli/README.i18n.yaml
index abe51abc2f..3322014ad5 100644
--- a/apps/cli/README.i18n.yaml
+++ b/apps/cli/README.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-README.md: 42d2a9641cf5d497c9aae45d9f60fce4498addb9
-README.zh.md: 0a62f8bb72e2cf2dbe045d28b81768bf4df800de
+#   pnpm run verify-translation-pairing --write apps/cli/README.md
+README.md: f5e52382fb86ecd6b96b84b90b310514285f1904
+README.zh.md: b2089c67d751a25c6443a5e15b53266c728e5156
diff --git a/apps/cli/README.md b/apps/cli/README.md
index 42d2a9641c..f5e52382fb 100644
--- a/apps/cli/README.md
+++ b/apps/cli/README.md
@@ -4,7 +4,7 @@ English | [中文](README.zh.md)
 
 The `dsh` command-line entry follows the `apps/` assembly tier: `apps/*` are product assemblies over `packages/*` libraries. Plain `dsh` boots the interactive TUI coding agent, `dsh -p "task"` runs one headless turn, and `dsh web` serves the browser UI.
 
-Argv is parsed once through a [Commander](https://github.com/tj/commander.js) adapter ([`src/args.ts`](src/args.ts)): one program whose default (no subcommand) is the TUI/headless surface (`--config`, `-p`/`--prompt`, `--resume`) and whose `web` subcommand is the browser UI. `src/bin.ts` switches on the resolved mode and dynamic-imports only that mode's module. `dsh --help` lists every mode and `dsh web --help` renders the web usage, `dsh --version` prints this app's version, and an unknown option or a mistyped `--resume` fails loud (stderr, exit 1) instead of misrouting. `dsh web`'s `--host`/`--port` are unvalidated pass-through overrides: the `dsh-host-webserver` schema is the single source of both the default (the shipped `cordis.yml` value when a flag is absent) and validity, and rejects a bad value at boot.
+Argv is parsed once through a [Commander](https://github.com/tj/commander.js) adapter ([`src/args.ts`](src/args.ts)): one program whose default (no subcommand) is the TUI/headless surface (`--config`, `-p`/`--prompt`, `--resume`) and whose `web` subcommand is the browser UI. `src/bin.ts` switches on the resolved mode and dynamic-imports only that mode's module. `dsh --help` lists every mode and `dsh web --help` renders the web usage, `dsh --version` prints this app's version, and an unknown option or a mistyped `--resume` fails loud (stderr, exit 1) instead of misrouting. `dsh web`'s `--host`/`--port` are unvalidated pass-through overrides: the `dsh-host-webserver` schema is the single source of both the default (the shipped `cordis.yml` value when a flag is absent) and validity, and rejects a bad value at boot. `--trusted-host` appends named authorities for the /api browser-trust fence; an all-interfaces bind additionally derives the machine's LAN IP literals itself ([`src/app-cli-entry.ts`](src/app-cli-entry.ts)), so the printed LAN URL works without flags.
 
 The TUI surface:
 
diff --git a/apps/cli/README.zh.md b/apps/cli/README.zh.md
index 0a62f8bb72..b2089c67d7 100644
--- a/apps/cli/README.zh.md
+++ b/apps/cli/README.zh.md
@@ -4,7 +4,7 @@
 
 `dsh` 命令行入口遵循 `apps/` 组装层：`apps/*` 是位于 `packages/*` 库之上的产品组装。直接运行 `dsh` 会启动交互式 TUI 编码 agent（智能体），`dsh -p "task"` 运行一个无头轮次，`dsh web` 则提供浏览器 UI。
 
-Argv 只会通过 [Commander](https://github.com/tj/commander.js) 适配器（[`src/args.ts`](src/args.ts)）解析一次：同一个程序的默认形式（无子命令）是 TUI／无头界面（`--config`、`-p`/`--prompt`、`--resume`），`web` 子命令则是浏览器 UI。`src/bin.ts` 按解析后的 mode 分支，仅动态导入该 mode 的模块。`dsh --help` 列出所有 mode，`dsh web --help` 渲染 Web 用法，`dsh --version` 打印此应用的版本；未知选项或拼错的 `--resume` 会明确报错（stderr，退出码 1），而不会被错路由。`dsh web` 的 `--host`/`--port` 是未验证的直通覆盖：`dsh-host-webserver` schema 是默认值（标志缺失时使用已交付的 `cordis.yml` 值）和有效性的唯一真源，并在启动时拒绝错误值。
+Argv 只会通过 [Commander](https://github.com/tj/commander.js) 适配器（[`src/args.ts`](src/args.ts)）解析一次：同一个程序的默认形式（无子命令）是 TUI／无头界面（`--config`、`-p`/`--prompt`、`--resume`），`web` 子命令则是浏览器 UI。`src/bin.ts` 按解析后的 mode 分支，仅动态导入该 mode 的模块。`dsh --help` 列出所有 mode，`dsh web --help` 渲染 Web 用法，`dsh --version` 打印此应用的版本；未知选项或拼错的 `--resume` 会明确报错（stderr，退出码 1），而不会被错路由。`dsh web` 的 `--host`/`--port` 是未验证的直通覆盖：`dsh-host-webserver` schema 是默认值（标志缺失时使用已交付的 `cordis.yml` 值）和有效性的唯一真源，并在启动时拒绝错误值。`--trusted-host` 为 /api 浏览器信任栅栏追加具名权威；全接口绑定还会自行推导本机的 LAN IP 字面量（[`src/app-cli-entry.ts`](src/app-cli-entry.ts)），因此打印出的 LAN URL 无需任何标志即可使用。
 
 TUI 界面：
 
diff --git a/apps/cli/src/app-cli-entry.ts b/apps/cli/src/app-cli-entry.ts
index 344c66e2b3..1002b45660 100644
--- a/apps/cli/src/app-cli-entry.ts
+++ b/apps/cli/src/app-cli-entry.ts
@@ -9,6 +9,7 @@
 
 import { readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
+import { networkInterfaces } from 'node:os'
 import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { Context } from 'cordis'
@@ -25,6 +26,38 @@ import type {} from '@deepseek-ai/dsh-host-webserver'
 const PROFILE_DIR = '.dsh-tmp-profile'
 const PROFILE_FILE = 'config.json'
 
+/** The webserver schema's all-interfaces bind literal: gates LAN-authority derivation here and the printed LAN URL in web.ts. */
+export const ALL_INTERFACES_HOST = '0.0.0.0'
+
+/**
+ * Non-internal IPv4 interface addresses of this machine — the IP-literal
+ * authorities an all-interfaces bind is reachable by on the LAN.
+ * @returns the addresses in interface order (possibly empty).
+ */
+export function lanIPv4Addresses(): string[] {
+  return Object.values(networkInterfaces()).flat()
+    .filter((iface): iface is NonNullable<typeof iface> => iface !== undefined && iface.family === 'IPv4' && !iface.internal)
+    .map(iface => iface.address)
+}
+
+/**
+ * Authorities the /api browser-trust fence must accept for one invocation:
+ * the machine's LAN IP literals when the effective bind is all-interfaces
+ * (advertised by the printed LAN URL, so they must not answer 403), followed
+ * by the explicit extras. Derived entries are port-less IP literals — DNS
+ * rebinding needs an attacker-controlled name, so an IP-literal Host is safe
+ * on any port, and the bound port may be OS-assigned, unknowable pre-boot.
+ * @param bindHost - the effective webserver bind host (CLI flag, else the yml default).
+ * @param extra - `--trusted-host` values, in argv order.
+ * @returns the connection row's `trustedHosts` value (possibly empty).
+ */
+export function resolveTrustedHosts(bindHost: string | undefined, extra: readonly string[]): string[] {
+  return [
+    ...bindHost === ALL_INTERFACES_HOST ? lanIPv4Addresses() : [],
+    ...extra,
+  ]
+}
+
 /** One profile-json key mapped onto a yml row's config field. */
 interface ProfileMapping {
   jsonPath: string
@@ -79,6 +112,8 @@ export interface AppCLIEntryOptions {
   port?: number
   /** Parent directory for name-created Workspaces; undefined uses the gateway's cwd fallback. */
   workspaceRoot?: string
+  /** Extra authorities for the /api browser-trust fence (`host` or `host:port`), appended to the derived LAN IP literals. */
+  trustedHosts?: string[]
 }
 
 /**
@@ -152,6 +187,12 @@ export class AppCLIEntry {
     if (this.options.port !== undefined) put('webserver', 'port', this.options.port)
     if (this.options.workspaceRoot !== undefined) put('api-gateway', 'workspaceRoot', this.options.workspaceRoot)
 
+    // Source 2b: authorities for the /api browser-trust fence (rationale on
+    // resolveTrustedHosts).
+    const ymlHost = (rows.get('webserver')?.config as { host?: string } | undefined)?.host
+    const trustedHosts = resolveTrustedHosts(this.options.host ?? ymlHost, this.options.trustedHosts ?? [])
+    if (trustedHosts.length > 0) put('connection', 'trustedHosts', trustedHosts)
+
     // Source 3: the frontend dist — an assembly fact of this app, never yml
     // user config. Workspace knowledge stays here.
     put('webserver', 'distIndex', this.resolveDistIndex())
diff --git a/apps/cli/src/args.ts b/apps/cli/src/args.ts
index 9fd0f4d9bf..b929dc73f2 100644
--- a/apps/cli/src/args.ts
+++ b/apps/cli/src/args.ts
@@ -40,6 +40,8 @@ interface WebInvocation {
   port?: number
   dev: boolean
   workspaceRoot?: string
+  /** Extra authorities for the /api browser-trust fence (`host` or `host:port`); LAN IP literals are derived, not listed here. */
+  trustedHosts?: string[]
 }
 
 /** The resolved `dsh` invocation: exactly one mode. `--help`/`--version`/errors exit inside {@link parseDshArgs}. */
@@ -51,6 +53,7 @@ interface WebOptions {
   port?: string
   dev?: boolean
   workspaceRoot?: string
+  trustedHost?: string[]
 }
 
 /**
@@ -66,6 +69,7 @@ function resolveWeb(options: WebOptions): WebInvocation {
     ...options.port !== undefined && { port: Number(options.port) },
     dev: options.dev === true,
     ...options.workspaceRoot !== undefined && { workspaceRoot: options.workspaceRoot },
+    ...options.trustedHost !== undefined && { trustedHosts: options.trustedHost },
   }
 }
 
@@ -117,6 +121,7 @@ export function parseDshArgs(argv: readonly string[], version: string): DshInvoc
     .option('--port <port>', 'override the config listen port (0 requests an OS-assigned port)')
     .option('--dev', 'mount the client HMR driver and watch plugin bundles for rebuilds')
     .option('--workspace-root <path>', 'parent directory for name-created workspaces')
+    .option('--trusted-host <authority...>', 'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)')
     .action((options: WebOptions) => {
       // Commander parses the parent (default-surface) options on either side of
       // the subcommand into `program.opts()`. `web` shares none of them, so a
diff --git a/apps/cli/src/bin.ts b/apps/cli/src/bin.ts
index f9e1eefc9b..88dbece55a 100644
--- a/apps/cli/src/bin.ts
+++ b/apps/cli/src/bin.ts
@@ -30,7 +30,7 @@ const invocation = parseDshArgs(process.argv.slice(2), readVersion())
 switch (invocation.mode) {
   case 'web': {
     const { runWeb } = await import('./web.ts')
-    await runWeb(invocation.host, invocation.port, invocation.dev, invocation.workspaceRoot)
+    await runWeb(invocation.host, invocation.port, invocation.dev, invocation.workspaceRoot, invocation.trustedHosts)
     break
   }
   case 'headless': {
diff --git a/apps/cli/src/web.ts b/apps/cli/src/web.ts
index 31282c8f5f..3d7fc29ab4 100644
--- a/apps/cli/src/web.ts
+++ b/apps/cli/src/web.ts
@@ -6,17 +6,14 @@
  * gates them at boot.
  */
 
-import { networkInterfaces } from 'node:os'
 import { fileURLToPath } from 'node:url'
-import { AppCLIEntry } from './app-cli-entry.ts'
+import { ALL_INTERFACES_HOST, AppCLIEntry, lanIPv4Addresses } from './app-cli-entry.ts'
 
 const CONFIG_PATH = fileURLToPath(new URL('../cordis.yml', import.meta.url))
 
-// Display-only mirrors of the webserver schema's allowed hosts: the loopback
-// address the local URL always prints, and the all-interfaces value that gates
-// LAN-address discovery. Not a source of truth — the schema is.
+// Display-only mirror of the webserver schema's loopback host: the address the
+// local URL always prints. Not a source of truth — the schema is.
 const LOOPBACK_HOST = '127.0.0.1'
-const ALL_INTERFACES_HOST = '0.0.0.0'
 
 /**
  * Serve the browser UI from the shipped config tree. `host`/`port` are passed
@@ -25,12 +22,14 @@ const ALL_INTERFACES_HOST = '0.0.0.0'
  * @param port - the listen port (`0` requests an OS-assigned port), or `undefined` to keep the config default.
  * @param dev - mount the client HMR driver and watch plugin bundles for rebuilds.
  * @param workspaceRoot - parent directory for name-created workspaces, or `undefined` for the gateway's cwd fallback.
+ * @param trustedHosts - extra authorities for the /api browser-trust fence, or `undefined` for the derived LAN literals alone.
  */
 export async function runWeb(
   host: string | undefined,
   port: number | undefined,
   dev: boolean,
   workspaceRoot: string | undefined,
+  trustedHosts: string[] | undefined,
 ): Promise<void> {
   const entry = new AppCLIEntry({
     configPath: CONFIG_PATH,
@@ -38,6 +37,7 @@ export async function runWeb(
     ...host !== undefined && { host },
     ...port !== undefined && { port },
     ...workspaceRoot !== undefined && { workspaceRoot },
+    ...trustedHosts !== undefined && { trustedHosts },
   })
   const { ctx, port: boundPort } = await entry.run()
 
@@ -48,12 +48,9 @@ export async function runWeb(
     void Promise.resolve(ctx.fiber.dispose()).finally(() => { process.exit(code) })
   }
 
-  const lanCandidate = host === ALL_INTERFACES_HOST
-    ? Object.values(networkInterfaces()).flat()
-      .find(iface => iface !== undefined && iface.family === 'IPv4' && !iface.internal)
-    : undefined
+  const lanCandidate = host === ALL_INTERFACES_HOST ? lanIPv4Addresses()[0] : undefined
   const localUrl = `http://${LOOPBACK_HOST}:${boundPort}`
-  console.log(`dsh web: ${localUrl}${lanCandidate === undefined ? '' : ` (LAN: http://${lanCandidate.address}:${boundPort})`}`)
+  console.log(`dsh web: ${localUrl}${lanCandidate === undefined ? '' : ` (LAN: http://${lanCandidate}:${boundPort})`}`)
 
   process.on('SIGTERM', () => { shutdown(0) })
   process.on('SIGINT', () => { shutdown(130) })
diff --git a/apps/cli/tests/args.spec.ts b/apps/cli/tests/args.spec.ts
index 052e96e9a0..45830eee30 100644
--- a/apps/cli/tests/args.spec.ts
+++ b/apps/cli/tests/args.spec.ts
@@ -35,6 +35,9 @@ describe('parseDshArgs', () => {
     // at boot); the adapter only coerces the port string to a number.
     expect(parse(['web', '--host', '0.0.0.0', '--port', '8080', '--dev', '--workspace-root', '/w']))
       .toEqual({ mode: 'web', host: '0.0.0.0', port: 8080, dev: true, workspaceRoot: '/w' })
+    // --trusted-host is variadic and repeatable; authorities pass through unvalidated.
+    expect(parse(['web', '--trusted-host', 'harness.internal:3080', 'lab.internal', '--trusted-host', '10.0.0.9']))
+      .toEqual({ mode: 'web', dev: false, trustedHosts: ['harness.internal:3080', 'lab.internal', '10.0.0.9'] })
   })
 
   it('exits nonzero instead of silently starting fresh or dropping inputs', () => {
diff --git a/apps/cli/tests/trusted-hosts.spec.ts b/apps/cli/tests/trusted-hosts.spec.ts
new file mode 100644
index 0000000000..1ed0f602b8
--- /dev/null
+++ b/apps/cli/tests/trusted-hosts.spec.ts
@@ -0,0 +1,40 @@
+/** LAN-authority derivation for the /api browser-trust fence (`resolveTrustedHosts`). */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { lanIPv4Addresses, resolveTrustedHosts } from '../src/app-cli-entry.ts'
+
+vi.mock('node:os', () => ({
+  networkInterfaces: () => ({
+    lo0: [
+      { family: 'IPv4', internal: true, address: '127.0.0.1' },
+    ],
+    en0: [
+      { family: 'IPv6', internal: false, address: 'fe80::1' },
+      { family: 'IPv4', internal: false, address: '192.168.1.5' },
+    ],
+    en1: [
+      { family: 'IPv4', internal: false, address: '10.0.0.7' },
+    ],
+    utun0: undefined,
+  }),
+}))
+
+afterEach(() => { vi.restoreAllMocks() })
+
+describe('lanIPv4Addresses', () => {
+  it('returns only non-internal IPv4 addresses, in interface order', () => {
+    expect(lanIPv4Addresses()).toEqual(['192.168.1.5', '10.0.0.7'])
+  })
+})
+
+describe('resolveTrustedHosts', () => {
+  it('derives port-less LAN IP literals for an all-interfaces bind, ahead of the extras', () => {
+    expect(resolveTrustedHosts('0.0.0.0', ['harness.internal:3080']))
+      .toEqual(['192.168.1.5', '10.0.0.7', 'harness.internal:3080'])
+  })
+
+  it('derives nothing for a loopback or unresolved bind — extras alone stand', () => {
+    expect(resolveTrustedHosts('127.0.0.1', [])).toEqual([])
+    expect(resolveTrustedHosts(undefined, ['lab.internal'])).toEqual(['lab.internal'])
+  })
+})
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index d30aff1f02..6155c418e0 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -278,10 +278,11 @@ Requires: `httpServer` · `apiProxy`
 /** Plugin config: the deployment's non-loopback serving authorities. */
 export interface ConnectionConfig {
   /**
-   * Exact `host[:port]` authorities this deployment serves beyond loopback.
-   * The /api trust fence refuses any request whose Host is neither loopback
-   * nor listed here, so a non-loopback (`0.0.0.0`) deployment must declare
-   * the names it is reached by.
+   * Authorities this deployment serves beyond loopback: exact `host:port`, or
+   * port-less `host` matching any port. The /api trust fence refuses any
+   * browser request whose Host is neither loopback nor listed here, so a
+   * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
+   * by (the dsh CLI derives the machine's LAN IP literals itself).
    */
   trustedHosts?: string[]
 }
diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
index 5c5a825a27..8310adac83 100644
--- a/packages/client/connection/README.i18n.yaml
+++ b/packages/client/connection/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: a301b85d707d17d1e8159655b540556eee5c9d83
-README.zh.md: 88d7aa806167033308a9913053f621ecea07c3d8
+README.md: 94b9b3c8d4bde30cedf56e31d83efe9f5f1dd87c
+README.zh.md: 844a2ef030378c32994f7459792db98c779f24b7
diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
index a301b85d70..94b9b3c8d4 100644
--- a/packages/client/connection/README.md
+++ b/packages/client/connection/README.md
@@ -6,7 +6,7 @@ Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared a
 
 ## /api browser-trust fence
 
-The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`): the `Host` header must be a loopback authority or an exact `host[:port]` entry from the plugin's `trustedHosts` config (DNS-rebinding defense), an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. Requests without browser markers (curl, tests, native clients) pass — without a browser there is no confused deputy. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment must therefore list the authorities it is reached by in `trustedHosts`; the fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
 
 ## Keyless fixture
 
diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
index 88d7aa8061..844a2ef030 100644
--- a/packages/client/connection/README.zh.md
+++ b/packages/client/connection/README.zh.md
@@ -6,7 +6,7 @@
 
 ## /api 浏览器信任栅栏
 
-node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）：`Host` 头必须是回环地址权威，或与插件 `trustedHosts` 配置中的某个 `host[:port]` 精确匹配（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不带浏览器标头的请求（curl、测试、原生客户端）直接放行——没有浏览器就不存在"混淆代理人"。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署必须在 `trustedHosts` 中列出自己被访问时使用的权威；这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
 
 ## 无密钥 fixture
 
diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
index 37819b9fb9..11dc6d7621 100644
--- a/packages/client/connection/src/api-request-trust.ts
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -3,10 +3,11 @@
  * paths a browser opens against a local HTTP API — DNS rebinding (Host names
  * the attacker's domain while the socket reaches this server) and cross-site
  * requests fired from a malicious page — without blocking non-browser clients
- * (no browser markers → no deputy to confuse) or legitimately remote browsers
- * (their authority is declared via `trustedHosts`). Network reachability and
- * authentication stay out of scope: binding policy belongs to the webserver
- * config, and this fence is not an auth layer.
+ * (no browser markers → no deputy to confuse, and a native client forges Host
+ * freely anyway) or legitimately remote browsers (their authority is declared
+ * via `trustedHosts`, or derived by the composing app for IP-literal LAN
+ * serving). Network reachability and authentication stay out of scope: binding
+ * policy belongs to the webserver config, and this fence is not an auth layer.
  */
 
 import type { IncomingHttpHeaders } from 'node:http'
@@ -29,42 +30,64 @@ function isLoopbackHostname(hostname: string): boolean {
     && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
 }
 
-/** Hostname of a Host-header authority (port stripped, lowercased, IPv6 bracketed), or undefined when unparsable. */
-function authorityHostname(authority: string): string | undefined {
+/** Normalized URL of a Host-header authority (hostname lowercased, default port stripped, IPv6 bracketed), or undefined when unparsable. */
+function parseAuthority(authority: string): URL | undefined {
   try {
     // http: is a WHATWG "special scheme": parsing yields a non-empty hostname or throws.
-    return new URL(`http://${authority}`).hostname
+    return new URL(`http://${authority}`)
   } catch {
     return undefined
   }
 }
 
+/**
+ * Whether the request authority matches a `trustedHosts` entry. An entry with
+ * an explicit port matches that exact authority; a port-less entry matches the
+ * hostname on any port (the shape the CLI derives for IP-literal LAN serving,
+ * where the bound port may be OS-assigned). Both sides compare through WHATWG
+ * normalization, so case and a redundant `:80` never decide trust.
+ */
+function isTrustedAuthority(hostUrl: URL, trustedHosts: readonly string[]): boolean {
+  return trustedHosts.some((entry) => {
+    const entryUrl = parseAuthority(entry)
+    if (entryUrl === undefined) return false
+    return /:\d+$/.test(entry)
+      ? entryUrl.host === hostUrl.host
+      : entryUrl.hostname === hostUrl.hostname
+  })
+}
+
 /**
  * Decide whether one /api request may reach the RPC bridge.
  * @param request - node HTTP request facts (headers).
- * @param trustedHosts - exact non-loopback `host[:port]` authorities this deployment serves.
- * @returns true when the Host is ours and any browser markers are same-origin.
+ * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
+ * @returns true for requests without browser markers, and for browser requests whose Host is ours and whose markers are same-origin.
  */
 export function isTrustedApiRequest(request: ApiTrustRequest, trustedHosts: readonly string[]): boolean {
+  // Marker gate: Origin and sec-fetch-site exist only when a browser is the
+  // sender's deputy. Absent both, the sender is the principal itself (curl,
+  // tests, native shells) and could forge every header below — fencing it
+  // would add nothing and would break non-browser LAN automation.
+  const origin = header(request.headers, 'origin')
+  const secFetchSite = header(request.headers, 'sec-fetch-site')
+  if (origin === undefined && secFetchSite === undefined) return true
   // Host fence (DNS-rebinding defense): the browser fills Host from the URL it
   // believes it is talking to, so a rebound page carries the attacker's domain
   // here even though the socket lands on this server.
   const host = header(request.headers, 'host')
   if (host === undefined) return false
-  const hostname = authorityHostname(host)
-  if (hostname === undefined) return false
-  if (!isLoopbackHostname(hostname) && !trustedHosts.includes(host)) return false
+  const hostUrl = parseAuthority(host)
+  if (hostUrl === undefined) return false
+  if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) return false
   // Cross-site fence: modern browsers label the initiator relationship on
   // every fetch; an explicit cross-site marker is refused regardless of Origin.
-  if (header(request.headers, 'sec-fetch-site') === 'cross-site') return false
+  if (secFetchSite === 'cross-site') return false
   // Origin fence: when a browser attaches an Origin it must be exactly this
-  // authority. Absent Origin = non-browser client (curl, tests, native shells)
-  // — allowed, because without a browser there is no confused deputy. The
+  // authority (compared through the same normalization as the Host). The
   // literal "null" (sandboxed iframes, file: pages) is an opaque origin, refused.
-  const origin = header(request.headers, 'origin')
   if (origin === undefined) return true
   try {
-    return new URL(origin).host === host
+    return new URL(origin).host === hostUrl.host
   } catch {
     return false
   }
diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
index 77f463149e..1bc39ed3ba 100644
--- a/packages/client/connection/src/index.ts
+++ b/packages/client/connection/src/index.ts
@@ -19,10 +19,11 @@ export const inject = ['httpServer', 'apiProxy']
 /** Plugin config: the deployment's non-loopback serving authorities. */
 export interface ConnectionConfig {
   /**
-   * Exact `host[:port]` authorities this deployment serves beyond loopback.
-   * The /api trust fence refuses any request whose Host is neither loopback
-   * nor listed here, so a non-loopback (`0.0.0.0`) deployment must declare
-   * the names it is reached by.
+   * Authorities this deployment serves beyond loopback: exact `host:port`, or
+   * port-less `host` matching any port. The /api trust fence refuses any
+   * browser request whose Host is neither loopback nor listed here, so a
+   * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
+   * by (the dsh CLI derives the machine's LAN IP literals itself).
    */
   trustedHosts?: string[]
 }
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
index eab878e734..5dc2d14b1b 100644
--- a/packages/client/connection/tests/api-request-trust.spec.ts
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -8,14 +8,19 @@ function request(headers: Record<string, string | undefined>): { headers: Record
 }
 
 describe('isTrustedApiRequest', () => {
-  it('accepts loopback Hosts in every spelling, with and without ports', () => {
-    for (const host of ['localhost', 'localhost:3080', '127.0.0.1', '127.0.0.1:3080', '127.8.9.10:80', '[::1]', '[::1]:3080', 'LOCALHOST:3080']) {
-      expect(isTrustedApiRequest(request({ host }), [])).toBe(true)
+  it('accepts every request without browser markers — curl, tests, native clients, on any Host', () => {
+    // No Origin and no sec-fetch-site → the sender is the principal itself
+    // (it forges Host freely anyway); this is the LAN-serving shape a Host
+    // fence must not break.
+    for (const host of ['127.0.0.1:3080', '192.168.1.5:3080', 'harness.example', undefined]) {
+      expect(isTrustedApiRequest(request(host === undefined ? {} : { host }), [])).toBe(true)
     }
   })
 
-  it('accepts non-browser requests (no Origin, no sec-fetch-site) — curl, tests, native clients', () => {
-    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080' }), [])).toBe(true)
+  it('accepts loopback Hosts in every spelling, with and without ports, for browser requests', () => {
+    for (const host of ['localhost', 'localhost:3080', '127.0.0.1', '127.0.0.1:3080', '127.8.9.10:80', '[::1]', '[::1]:3080', 'LOCALHOST:3080']) {
+      expect(isTrustedApiRequest(request({ host, origin: `http://${host}` }), [])).toBe(true)
+    }
   })
 
   it('refuses a rebound Host: the attacker domain names the socket it did not expect', () => {
@@ -26,13 +31,22 @@ describe('isTrustedApiRequest', () => {
     }), [])).toBe(false)
   })
 
-  it('accepts a declared public authority only on exact host[:port] match', () => {
+  it('accepts a declared public authority: exact on host:port entries, any port on port-less entries', () => {
     const headers = { host: 'harness.internal:3080', origin: 'http://harness.internal:3080' }
     expect(isTrustedApiRequest(request(headers), ['harness.internal:3080'])).toBe(true)
-    expect(isTrustedApiRequest(request(headers), ['harness.internal'])).toBe(false)
+    expect(isTrustedApiRequest(request(headers), ['harness.internal'])).toBe(true)
+    expect(isTrustedApiRequest(request(headers), ['harness.internal:9999'])).toBe(false)
     expect(isTrustedApiRequest(request(headers), [])).toBe(false)
   })
 
+  it('matches Host, Origin, and trusted entries through WHATWG normalization (case, default port)', () => {
+    expect(isTrustedApiRequest(request({ host: 'Harness.INTERNAL:3080', origin: 'http://harness.internal:3080' }), ['harness.internal:3080'])).toBe(true)
+    expect(isTrustedApiRequest(request({ host: 'harness.internal', origin: 'http://harness.internal' }), ['HARNESS.internal:80'])).toBe(true)
+    // An unparsable entry never matches; it must not poison the rest of the list.
+    expect(isTrustedApiRequest(request({ host: 'harness.internal', origin: 'http://harness.internal' }), ['bad entry', 'harness.internal'])).toBe(true)
+    expect(isTrustedApiRequest(request({ host: 'harness.internal', origin: 'http://harness.internal' }), ['bad entry'])).toBe(false)
+  })
+
   it('refuses cross-origin browser markers even on a loopback Host', () => {
     // Origin present and different → cross-site request that survived preflight rules.
     expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080', origin: 'http://evil.example' }), [])).toBe(false)
@@ -42,19 +56,22 @@ describe('isTrustedApiRequest', () => {
     expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080', origin: 'null' }), [])).toBe(false)
   })
 
-  it('accepts a same-origin browser request', () => {
+  it('accepts a same-origin browser request, with or without an Origin header', () => {
     expect(isTrustedApiRequest(request({
       host: 'localhost:3080',
       origin: 'http://localhost:3080',
       'sec-fetch-site': 'same-origin',
     }), [])).toBe(true)
+    // Origin-less browser shapes (same-origin GETs) still carry sec-fetch-site.
+    expect(isTrustedApiRequest(request({ host: 'localhost:3080', 'sec-fetch-site': 'same-origin' }), [])).toBe(true)
   })
 
-  it('refuses malformed authorities', () => {
-    expect(isTrustedApiRequest(request({}), [])).toBe(false)
-    expect(isTrustedApiRequest(request({ host: '' }), [])).toBe(false)
-    expect(isTrustedApiRequest(request({ host: 'bad host' }), [])).toBe(false)
-    expect(isTrustedApiRequest(request({ host: '127.0.0.999' }), [])).toBe(false)
-    expect(isTrustedApiRequest(request({ host: '128.0.0.1' }), [])).toBe(false)
+  it('refuses malformed or untrusted authorities on browser requests', () => {
+    const markers = { 'sec-fetch-site': 'same-origin' }
+    expect(isTrustedApiRequest(request({ ...markers }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ ...markers, host: '' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ ...markers, host: 'bad host' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ ...markers, host: '127.0.0.999' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ ...markers, host: '128.0.0.1' }), [])).toBe(false)
   })
 })
diff --git a/packages/client/connection/tests/node-half.spec.ts b/packages/client/connection/tests/node-half.spec.ts
index a492a7a9c0..59c8c34ce2 100644
--- a/packages/client/connection/tests/node-half.spec.ts
+++ b/packages/client/connection/tests/node-half.spec.ts
@@ -80,6 +80,11 @@ describe('connection node half', () => {
     const loopback = fakeResponse()
     await routes[0]!.handler(fakeRequest({ host: '127.0.0.1:3080' }), loopback.response)
     expect(loopback.state.status).toBe(404)
+    // Undeclared LAN authority, no browser markers: the `--host 0.0.0.0` curl
+    // shape must reach the bridge even with an empty-by-default trust list.
+    const lan = fakeResponse()
+    await routes[0]!.handler(fakeRequest({ host: '192.168.1.5:3080' }), lan.response)
+    expect(lan.state.status).toBe(404)
     // Declared public authority, same-origin browser shape.
     const declared = fakeResponse()
     await routes[0]!.handler(fakeRequest({

From b9cbe2f029fedf77222d9f02b8cfe2b9cfc30f14 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 15:57:02 +0800
Subject: [PATCH 05/16] fix(connection): fail the load on a trustedHosts entry
 that is not a bare authority

WHATWG parsing would quietly read a hostname out of harness.internal/path or
user@harness.internal, authorizing the typo's hostname; other typos would sit
silently ignored until requests 403. Refuse every URL part beyond host[:port]
at plugin load.
---
 ...07-28-api-browser-trust-boundary.i18n.yaml |  4 ++--
 .../2026-07-28-api-browser-trust-boundary.md  |  2 +-
 ...026-07-28-api-browser-trust-boundary.zh.md |  2 +-
 docs/config-catalog.md                        |  3 ++-
 packages/client/connection/README.i18n.yaml   |  4 ++--
 packages/client/connection/README.md          |  2 +-
 packages/client/connection/README.zh.md       |  2 +-
 .../connection/src/api-request-trust.ts       | 15 ++++++++++++
 packages/client/connection/src/index.ts       |  8 +++++--
 .../tests/api-request-trust.spec.ts           | 13 +++++++++-
 .../client/connection/tests/node-half.spec.ts | 24 +++++++++++++++++++
 11 files changed, 67 insertions(+), 12 deletions(-)

diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
index 68473ee893..1e10e92f49 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
-2026-07-28-api-browser-trust-boundary.md: 45a332fcfe59fb930a85cfc595dd02c5fe12a5d7
-2026-07-28-api-browser-trust-boundary.zh.md: 731d6c81f71a2f50b716e52e278f2c53ad62a04b
+2026-07-28-api-browser-trust-boundary.md: 4dd913bb73da3b24073c020ff80fdfa83b44a812
+2026-07-28-api-browser-trust-boundary.zh.md: 0be817aca9dde68588959d2cd622639d90d9f993
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
index 45a332fcfe..4dd913bb73 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
@@ -13,7 +13,7 @@ The web GUI host serves `/api` over plain HTTP (default `127.0.0.1:3080`, `--hos
 Enforce browser trust once, at the carrier, for the entire `/api` prefix — two halves in two stacked PRs:
 
 - **Media-type fence (dsh-host-apiproxy)**: every `/api` POST must declare `application/json`, else 415 before parsing. Cross-site "simple" requests thereby stop existing: any cross-site attempt is forced into a CORS preflight this server never answers.
-- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: requests without browser markers (no `Origin`, no `sec-fetch-site`) pass on any Host — a non-browser client is the principal itself, not a deputy, and forges every header anyway, so fencing it buys nothing and breaks non-browser LAN automation. For browser requests, `Host` must be loopback or match a `trustedHosts` entry (exact on `host:port`, any port on port-less entries, WHATWG-normalized; rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. `host.pickDirectory` loses its bespoke guard and rides the same fence.
+- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: requests without browser markers (no `Origin`, no `sec-fetch-site`) pass on any Host — a non-browser client is the principal itself, not a deputy, and forges every header anyway, so fencing it buys nothing and breaks non-browser LAN automation. For browser requests, `Host` must be loopback or match a `trustedHosts` entry (exact on `host:port`, any port on port-less entries, WHATWG-normalized; rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. A `trustedHosts` entry that is not a bare authority fails the plugin load — WHATWG parsing would otherwise quietly authorize the hostname inside a typo. `host.pickDirectory` loses its bespoke guard and rides the same fence.
 
 Two boundaries stay deliberately out of scope: reachability is the webserver binding's policy (`host: 127.0.0.1 | 0.0.0.0`), and authentication for genuinely remote deployments is deferred work recorded in the connection README — the fence is a confused-deputy defense, not an auth layer. The old guard's loopback-socket check was dropped rather than generalized: with binding expressing reachability and `trustedHosts` naming remote authorities, the socket address adds nothing a header fence does not already cover.
 
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
index 731d6c81f7..0be817aca9 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
@@ -13,7 +13,7 @@ Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--ho
 在载体层对整个 `/api` 前缀一次性执行浏览器信任检查——两半各占一个栈式 PR：
 
 - **媒体类型栅栏（dsh-host-apiproxy）**：每个 `/api` POST 必须声明 `application/json`，否则在解析前以 415 拒绝。跨站"简单请求"由此不复存在：任何跨站尝试都被逼进一次本服务器从不应答的 CORS 预检。
-- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`）在任何 Host 上都放行——非浏览器客户端是委托人本人，不是代理人，且本就可以伪造任何请求头，对它设栅一无所获，反而会打断非浏览器的 LAN 自动化。对浏览器请求，`Host` 必须是回环地址，或与某个 `trustedHosts` 条目匹配（带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，均经 WHATWG 归一化；rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
+- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`）在任何 Host 上都放行——非浏览器客户端是委托人本人，不是代理人，且本就可以伪造任何请求头，对它设栅一无所获，反而会打断非浏览器的 LAN 自动化。对浏览器请求，`Host` 必须是回环地址，或与某个 `trustedHosts` 条目匹配（带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，均经 WHATWG 归一化；rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。不是纯权威的 `trustedHosts` 条目会让插件加载失败——否则 WHATWG 解析会悄悄授权笔误里的 hostname。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
 
 两条边界刻意留在范围之外：可达性归 webserver 绑定配置（`host: 127.0.0.1 | 0.0.0.0`）管辖；真正远程部署的认证是延期工作，记录在 connection README——这道栅栏是混淆代理人防御，不是认证层。旧守卫的回环 socket 检查被放弃而非泛化：绑定表达可达性、`trustedHosts` 点名远程权威之后，socket 地址提供不了头部栅栏覆盖不到的任何东西。
 
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 6155c418e0..5a7f63c85f 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -282,7 +282,8 @@ export interface ConnectionConfig {
    * port-less `host` matching any port. The /api trust fence refuses any
    * browser request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
-   * by (the dsh CLI derives the machine's LAN IP literals itself).
+   * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
+   * that is not a bare authority fails the plugin load.
    */
   trustedHosts?: string[]
 }
diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
index 8310adac83..f0775848d3 100644
--- a/packages/client/connection/README.i18n.yaml
+++ b/packages/client/connection/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: 94b9b3c8d4bde30cedf56e31d83efe9f5f1dd87c
-README.zh.md: 844a2ef030378c32994f7459792db98c779f24b7
+README.md: 591e8361c1d28fab909bfe4a4f176fa1887edd93
+README.zh.md: bd772b2ab0f36abc8dbce35d30f55b40e53d0756
diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
index 94b9b3c8d4..591e8361c1 100644
--- a/packages/client/connection/README.md
+++ b/packages/client/connection/README.md
@@ -6,7 +6,7 @@ Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared a
 
 ## /api browser-trust fence
 
-The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare `host[:port]` authority fails the plugin load loudly — WHATWG parsing would otherwise quietly authorize the hostname inside a typo like `harness.internal/path`. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
 
 ## Keyless fixture
 
diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
index 844a2ef030..bd772b2ab0 100644
--- a/packages/client/connection/README.zh.md
+++ b/packages/client/connection/README.zh.md
@@ -6,7 +6,7 @@
 
 ## /api 浏览器信任栅栏
 
-node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯 `host[:port]` 权威的 `trustedHosts` 条目会让插件加载大声失败——否则 WHATWG 解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
 
 ## 无密钥 fixture
 
diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
index 11dc6d7621..2a8b8d7273 100644
--- a/packages/client/connection/src/api-request-trust.ts
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -40,6 +40,21 @@ function parseAuthority(authority: string): URL | undefined {
   }
 }
 
+/**
+ * Assert one configured `trustedHosts` entry is a bare authority (`host` or
+ * `host:port`) and nothing else. WHATWG parsing would quietly read a hostname
+ * out of `harness.internal/path` or `user@harness.internal` — a typo must fail
+ * the load loudly instead of authorizing its hostname or being ignored until
+ * requests 403. The delimiter test refuses every URL part beyond the authority
+ * (path, backslash path, query, fragment, userinfo); IPv6 brackets use none of
+ * them.
+ * @param entry - the configured value, verbatim.
+ */
+export function assertTrustedAuthority(entry: string): void {
+  if (parseAuthority(entry) !== undefined && !/[/\\?#@]/.test(entry)) return
+  throw new Error(`client-connection: trustedHosts entry ${JSON.stringify(entry)} is not a bare host[:port] authority`)
+}
+
 /**
  * Whether the request authority matches a `trustedHosts` entry. An entry with
  * an explicit port matches that exact authority; a port-less entry matches the
diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
index 1bc39ed3ba..f37a64fb21 100644
--- a/packages/client/connection/src/index.ts
+++ b/packages/client/connection/src/index.ts
@@ -6,7 +6,7 @@ import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { toFetchHandler } from '@deepseek-ai/dsh-host-apiproxy'
 import { API_PATH } from './api-path.ts'
 import { bridge } from './http-bridge.ts'
-import { isTrustedApiRequest } from './api-request-trust.ts'
+import { assertTrustedAuthority, isTrustedApiRequest } from './api-request-trust.ts'
 
 export { API_PATH } from './api-path.ts'
 
@@ -23,7 +23,8 @@ export interface ConnectionConfig {
    * port-less `host` matching any port. The /api trust fence refuses any
    * browser request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
-   * by (the dsh CLI derives the machine's LAN IP literals itself).
+   * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
+   * that is not a bare authority fails the plugin load.
    */
   trustedHosts?: string[]
 }
@@ -42,6 +43,9 @@ export const Config: z<ConnectionConfig> = z.object({
 export function apply(ctx: Context, config?: ConnectionConfig): void {
   // The Loader resolves schema defaults; hand-built test contexts may pass none.
   const trustedHosts = config?.trustedHosts ?? []
+  // Config boundary: a malformed entry fails the load loudly here rather than
+  // silently authorizing its hostname prefix at request time.
+  for (const entry of trustedHosts) assertTrustedAuthority(entry)
   const apiHandler = toFetchHandler(ctx.apiProxy)
   const route: WebRoute = {
     kind: 'prefix',
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
index 5dc2d14b1b..99df0d86eb 100644
--- a/packages/client/connection/tests/api-request-trust.spec.ts
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -1,7 +1,7 @@
 /** Behavior of the /api browser-trust fence (rebinding + cross-site defense). */
 
 import { describe, expect, it } from 'vitest'
-import { isTrustedApiRequest } from '../src/api-request-trust.ts'
+import { assertTrustedAuthority, isTrustedApiRequest } from '../src/api-request-trust.ts'
 
 function request(headers: Record<string, string | undefined>): { headers: Record<string, string | undefined> } {
   return { headers }
@@ -66,6 +66,17 @@ describe('isTrustedApiRequest', () => {
     expect(isTrustedApiRequest(request({ host: 'localhost:3080', 'sec-fetch-site': 'same-origin' }), [])).toBe(true)
   })
 
+  it('assertTrustedAuthority accepts bare authorities and throws on anything more', () => {
+    for (const entry of ['harness.internal', 'harness.internal:3080', 'HARNESS.internal:80', '10.0.0.9', '[::1]:3080']) {
+      expect(() => { assertTrustedAuthority(entry) }).not.toThrow()
+    }
+    // WHATWG parsing would quietly read a hostname out of each of these; the
+    // config boundary must refuse them instead of authorizing the prefix.
+    for (const entry of ['harness.internal/path', 'harness.internal/', 'user@harness.internal', 'harness.internal?x', 'harness.internal#f', 'harness.internal\\path', 'bad entry', '']) {
+      expect(() => { assertTrustedAuthority(entry) }).toThrow(/not a bare host\[:port\] authority/)
+    }
+  })
+
   it('refuses malformed or untrusted authorities on browser requests', () => {
     const markers = { 'sec-fetch-site': 'same-origin' }
     expect(isTrustedApiRequest(request({ ...markers }), [])).toBe(false)
diff --git a/packages/client/connection/tests/node-half.spec.ts b/packages/client/connection/tests/node-half.spec.ts
index 59c8c34ce2..5404f1c798 100644
--- a/packages/client/connection/tests/node-half.spec.ts
+++ b/packages/client/connection/tests/node-half.spec.ts
@@ -54,6 +54,30 @@ async function mounted(config?: { trustedHosts?: string[] }): Promise<{ routes:
 }
 
 describe('connection node half', () => {
+  it('fails the load on a trustedHosts entry that is not a bare authority', async () => {
+    const routes: WebRoute[] = []
+    const ctx = new Context()
+    ctx.provide('httpServer', fakeHttpServer(routes) as HttpServerService)
+    ctx.provide('apiProxy', {} as unknown as ApiProxy)
+    // The apply throw also escapes cordis as a late rejection — the shape the
+    // boot's installFailLoud is contracted to catch. Capture it so the run
+    // stays clean, same pattern as the webserver bind-failure test.
+    const rejections: unknown[] = []
+    const onUnhandled = (err: unknown): void => { rejections.push(err) }
+    process.on('unhandledRejection', onUnhandled)
+    try {
+      const fiber = ctx.plugin({ inject: [...inject], apply }, { trustedHosts: ['harness.internal/path'] })
+      await expect(fiber.await()).rejects.toThrow(/not a bare host\[:port\] authority/)
+      expect(routes).toHaveLength(0)
+      for (let i = 0; i < 100 && rejections.length === 0; i++) {
+        await new Promise(resolve => setTimeout(resolve, 10))
+      }
+      expect(rejections.map(String).join('\n')).toContain('not a bare host[:port] authority')
+    } finally {
+      process.off('unhandledRejection', onUnhandled)
+    }
+  })
+
   it('registers the /api prefix route and removes it with the fiber', async () => {
     const { routes, dispose } = await mounted()
     expect(routes).toHaveLength(1)

From 34518cb012d3d9a16ec851b4a215db7100f4457a Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 16:19:31 +0800
Subject: [PATCH 06/16] fix(connection): judge an entry's explicit port from
 the parsed URL, not the raw string
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WHATWG trimming strips stray whitespace before parsing, so 'host:port ' passed
the load assert while the raw-string port regex read it as port-less —
broadening an exact-port grant to every port on that hostname. The explicit-
port judgment now reads URL parses under both special schemes (:80/:443 stay
explicit), and the load assert refuses whitespace outright.
---
 .../connection/src/api-request-trust.ts       | 21 +++++++++++++++----
 .../tests/api-request-trust.spec.ts           | 12 +++++++++++
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
index 2a8b8d7273..ad2519d90b 100644
--- a/packages/client/connection/src/api-request-trust.ts
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -45,16 +45,29 @@ function parseAuthority(authority: string): URL | undefined {
  * `host:port`) and nothing else. WHATWG parsing would quietly read a hostname
  * out of `harness.internal/path` or `user@harness.internal` — a typo must fail
  * the load loudly instead of authorizing its hostname or being ignored until
- * requests 403. The delimiter test refuses every URL part beyond the authority
- * (path, backslash path, query, fragment, userinfo); IPv6 brackets use none of
+ * requests 403. The character test refuses every URL part beyond the authority
+ * (path, backslash path, query, fragment, userinfo) and all whitespace, which
+ * WHATWG trimming would otherwise strip silently; IPv6 brackets use none of
  * them.
  * @param entry - the configured value, verbatim.
  */
 export function assertTrustedAuthority(entry: string): void {
-  if (parseAuthority(entry) !== undefined && !/[/\\?#@]/.test(entry)) return
+  if (parseAuthority(entry) !== undefined && !/[/\\?#@\s]/.test(entry)) return
   throw new Error(`client-connection: trustedHosts entry ${JSON.stringify(entry)} is not a bare host[:port] authority`)
 }
 
+/**
+ * Whether the parsed authority carries an explicit port: judged from URL
+ * parses under both special schemes (their default ports differ, so `:80` and
+ * `:443` still count as explicit), never from the raw string, where WHATWG
+ * trimming of stray whitespace would misread `host:port ` as port-less and
+ * broaden an exact-port grant to every port.
+ */
+function hasExplicitPort(entry: string, entryUrl: URL): boolean {
+  // An authority that parsed under http cannot fail under https.
+  return entryUrl.port !== '' || new URL(`https://${entry}`).port !== ''
+}
+
 /**
  * Whether the request authority matches a `trustedHosts` entry. An entry with
  * an explicit port matches that exact authority; a port-less entry matches the
@@ -66,7 +79,7 @@ function isTrustedAuthority(hostUrl: URL, trustedHosts: readonly string[]): bool
   return trustedHosts.some((entry) => {
     const entryUrl = parseAuthority(entry)
     if (entryUrl === undefined) return false
-    return /:\d+$/.test(entry)
+    return hasExplicitPort(entry, entryUrl)
       ? entryUrl.host === hostUrl.host
       : entryUrl.hostname === hostUrl.hostname
   })
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
index 99df0d86eb..e3f1c91caf 100644
--- a/packages/client/connection/tests/api-request-trust.spec.ts
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -75,6 +75,18 @@ describe('isTrustedApiRequest', () => {
     for (const entry of ['harness.internal/path', 'harness.internal/', 'user@harness.internal', 'harness.internal?x', 'harness.internal#f', 'harness.internal\\path', 'bad entry', '']) {
       expect(() => { assertTrustedAuthority(entry) }).toThrow(/not a bare host\[:port\] authority/)
     }
+    // WHATWG trimming would silently strip these; the entry must fail instead.
+    for (const entry of ['harness.internal:3080 ', ' harness.internal', 'harness.internal:30\t80']) {
+      expect(() => { assertTrustedAuthority(entry) }).toThrow(/not a bare host\[:port\] authority/)
+    }
+  })
+
+  it('never lets stray whitespace broaden an exact-port entry to every port', () => {
+    // Defense in depth below the load-time assert: the explicit-port judgment
+    // reads the parsed URL, so a trimmed `host:port ` entry stays exact.
+    const trusted = ['harness.internal:3080 ']
+    expect(isTrustedApiRequest(request({ host: 'harness.internal:9999', origin: 'http://harness.internal:9999' }), trusted)).toBe(false)
+    expect(isTrustedApiRequest(request({ host: 'harness.internal:3080', origin: 'http://harness.internal:3080' }), trusted)).toBe(true)
   })
 
   it('refuses malformed or untrusted authorities on browser requests', () => {

From 7ff8da56dfb8e6ad0130e9dcbdb55f034c3ff530 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 16:49:52 +0800
Subject: [PATCH 07/16] fix(connection): require trustedHosts entries in
 canonical authority form

A dangling colon (harness.internal:) or zero-padded port parses cleanly while
WHATWG silently rewrites it, turning an intended exact-port grant into an
any-port grant. Replace the character blacklist with a round-trip check: an
entry must read back from parsing exactly as written (case aside), refusing
the whole rewrite class at load.
---
 docs/config-catalog.md                        |  2 +-
 packages/client/connection/README.i18n.yaml   |  4 +-
 packages/client/connection/README.md          |  2 +-
 packages/client/connection/README.zh.md       |  2 +-
 .../connection/src/api-request-trust.ts       | 41 +++++++++++--------
 packages/client/connection/src/index.ts       |  2 +-
 .../tests/api-request-trust.spec.ts           |  6 +++
 7 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 5a7f63c85f..878de38a19 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -283,7 +283,7 @@ export interface ConnectionConfig {
    * browser request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
    * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
-   * that is not a bare authority fails the plugin load.
+   * that is not a bare, canonical authority fails the plugin load.
    */
   trustedHosts?: string[]
 }
diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
index f0775848d3..c390223071 100644
--- a/packages/client/connection/README.i18n.yaml
+++ b/packages/client/connection/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: 591e8361c1d28fab909bfe4a4f176fa1887edd93
-README.zh.md: bd772b2ab0f36abc8dbce35d30f55b40e53d0756
+README.md: 7e437e8fd81d1d57ead5ead64d2049111ad163dc
+README.zh.md: 3615d5ea1be44e6da8e41fa17f645eb414d1ef3e
diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
index 591e8361c1..7e437e8fd8 100644
--- a/packages/client/connection/README.md
+++ b/packages/client/connection/README.md
@@ -6,7 +6,7 @@ Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared a
 
 ## /api browser-trust fence
 
-The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare `host[:port]` authority fails the plugin load loudly — WHATWG parsing would otherwise quietly authorize the hostname inside a typo like `harness.internal/path`. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare, canonical `host[:port]` authority — one WHATWG parsing reads back exactly as written — fails the plugin load loudly: parsing would otherwise quietly authorize the hostname inside `harness.internal/path`, or broaden a dangling-colon or zero-padded port to an any-port grant. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
 
 ## Keyless fixture
 
diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
index bd772b2ab0..3615d5ea1b 100644
--- a/packages/client/connection/README.zh.md
+++ b/packages/client/connection/README.zh.md
@@ -6,7 +6,7 @@
 
 ## /api 浏览器信任栅栏
 
-node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯 `host[:port]` 权威的 `trustedHosts` 条目会让插件加载大声失败——否则 WHATWG 解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载大声失败：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
 
 ## 无密钥 fixture
 
diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
index ad2519d90b..57a8cb179c 100644
--- a/packages/client/connection/src/api-request-trust.ts
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -42,30 +42,35 @@ function parseAuthority(authority: string): URL | undefined {
 
 /**
  * Assert one configured `trustedHosts` entry is a bare authority (`host` or
- * `host:port`) and nothing else. WHATWG parsing would quietly read a hostname
- * out of `harness.internal/path` or `user@harness.internal` — a typo must fail
- * the load loudly instead of authorizing its hostname or being ignored until
- * requests 403. The character test refuses every URL part beyond the authority
- * (path, backslash path, query, fragment, userinfo) and all whitespace, which
- * WHATWG trimming would otherwise strip silently; IPv6 brackets use none of
- * them.
+ * `host:port`) in canonical form: it must survive WHATWG parsing unchanged
+ * (case aside). Anything parsing would silently rewrite is refused as a typo
+ * that must fail the load loudly instead of being ignored until requests 403
+ * or quietly changing the grant: URL parts beyond the authority
+ * (`harness.internal/path`, `user@harness.internal` — which would authorize
+ * the embedded hostname), stripped whitespace, a dangling colon or
+ * zero-padded port (which would broaden an intended exact-port grant to every
+ * port), and non-canonical host spellings (`0x7f.0.0.1`, percent-encoding,
+ * unbracketed IPv6; IDN hosts are declared in punycode, the form the wire
+ * carries).
  * @param entry - the configured value, verbatim.
  */
 export function assertTrustedAuthority(entry: string): void {
-  if (parseAuthority(entry) !== undefined && !/[/\\?#@\s]/.test(entry)) return
+  const entryUrl = parseAuthority(entry)
+  if (entryUrl !== undefined && canonicalAuthority(entry, entryUrl) === entry.toLowerCase()) return
   throw new Error(`client-connection: trustedHosts entry ${JSON.stringify(entry)} is not a bare host[:port] authority`)
 }
 
 /**
- * Whether the parsed authority carries an explicit port: judged from URL
- * parses under both special schemes (their default ports differ, so `:80` and
- * `:443` still count as explicit), never from the raw string, where WHATWG
- * trimming of stray whitespace would misread `host:port ` as port-less and
- * broaden an exact-port grant to every port.
+ * Canonical form of a parsed authority: `hostname` when no port was written,
+ * else `hostname:port`. The port is judged from URL parses under both special
+ * schemes (their default ports differ, so `:80` and `:443` still count as
+ * explicit), never from the raw string, where WHATWG trimming would misread
+ * shapes like `host:port ` as port-less.
  */
-function hasExplicitPort(entry: string, entryUrl: URL): boolean {
+function canonicalAuthority(entry: string, entryUrl: URL): string {
   // An authority that parsed under http cannot fail under https.
-  return entryUrl.port !== '' || new URL(`https://${entry}`).port !== ''
+  const port = entryUrl.port !== '' ? entryUrl.port : new URL(`https://${entry}`).port
+  return port === '' ? entryUrl.hostname : `${entryUrl.hostname}:${port}`
 }
 
 /**
@@ -79,9 +84,9 @@ function isTrustedAuthority(hostUrl: URL, trustedHosts: readonly string[]): bool
   return trustedHosts.some((entry) => {
     const entryUrl = parseAuthority(entry)
     if (entryUrl === undefined) return false
-    return hasExplicitPort(entry, entryUrl)
-      ? entryUrl.host === hostUrl.host
-      : entryUrl.hostname === hostUrl.hostname
+    return canonicalAuthority(entry, entryUrl) === entryUrl.hostname
+      ? entryUrl.hostname === hostUrl.hostname
+      : entryUrl.host === hostUrl.host
   })
 }
 
diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
index f37a64fb21..a649afda1a 100644
--- a/packages/client/connection/src/index.ts
+++ b/packages/client/connection/src/index.ts
@@ -24,7 +24,7 @@ export interface ConnectionConfig {
    * browser request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
    * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
-   * that is not a bare authority fails the plugin load.
+   * that is not a bare, canonical authority fails the plugin load.
    */
   trustedHosts?: string[]
 }
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
index e3f1c91caf..2c608cc988 100644
--- a/packages/client/connection/tests/api-request-trust.spec.ts
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -79,6 +79,12 @@ describe('isTrustedApiRequest', () => {
     for (const entry of ['harness.internal:3080 ', ' harness.internal', 'harness.internal:30\t80']) {
       expect(() => { assertTrustedAuthority(entry) }).toThrow(/not a bare host\[:port\] authority/)
     }
+    // WHATWG parsing would silently rewrite these — a dangling colon or
+    // zero-padded port would broaden an intended exact-port grant to every
+    // port, and non-canonical host spellings would not read back as written.
+    for (const entry of ['harness.internal:', '[::1]:', 'harness.internal:0080', '0x7f.0.0.1', '[0:0:0:0:0:0:0:1]']) {
+      expect(() => { assertTrustedAuthority(entry) }).toThrow(/not a bare host\[:port\] authority/)
+    }
   })
 
   it('never lets stray whitespace broaden an exact-port entry to every port', () => {

From 772653464d546121c90c5d4fc77337d9716a513f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 17:02:39 +0800
Subject: [PATCH 08/16] =?UTF-8?q?fix(connection):=20hold=20markerless=20re?=
 =?UTF-8?q?quests=20to=20the=20Host=20fence=20=E2=80=94=20plain-HTTP=20bro?=
 =?UTF-8?q?wser=20reads=20carry=20no=20markers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fetch-Metadata and Origin are only attached to trustworthy destinations, so
over plain HTTP a rebound page's same-origin GET (EventSource, images,
navigations) arrives with no browser markers and a readable response. Remove
the marker shortcut; non-browser clients pass the same fence via loopback,
the CLI-derived LAN IP literals, or a declared authority.
---
 ...07-28-api-browser-trust-boundary.i18n.yaml |  4 +-
 .../2026-07-28-api-browser-trust-boundary.md  |  4 +-
 ...026-07-28-api-browser-trust-boundary.zh.md |  4 +-
 docs/config-catalog.md                        |  2 +-
 packages/client/connection/README.i18n.yaml   |  4 +-
 packages/client/connection/README.md          |  2 +-
 packages/client/connection/README.zh.md       |  2 +-
 .../connection/src/api-request-trust.ts       | 40 ++++++++++---------
 packages/client/connection/src/index.ts       |  2 +-
 .../tests/api-request-trust.spec.ts           | 16 ++++----
 .../client/connection/tests/node-half.spec.ts |  6 +--
 11 files changed, 45 insertions(+), 41 deletions(-)

diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
index 1e10e92f49..c15af141bd 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
-2026-07-28-api-browser-trust-boundary.md: 4dd913bb73da3b24073c020ff80fdfa83b44a812
-2026-07-28-api-browser-trust-boundary.zh.md: 0be817aca9dde68588959d2cd622639d90d9f993
+2026-07-28-api-browser-trust-boundary.md: e56d0fc2a7bd551899605491f3a0522b62b961b0
+2026-07-28-api-browser-trust-boundary.zh.md: 2958f7e49bfd4a258c63fc96c2e8aee0f98183ee
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
index 4dd913bb73..e56d0fc2a7 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md
@@ -13,7 +13,7 @@ The web GUI host serves `/api` over plain HTTP (default `127.0.0.1:3080`, `--hos
 Enforce browser trust once, at the carrier, for the entire `/api` prefix — two halves in two stacked PRs:
 
 - **Media-type fence (dsh-host-apiproxy)**: every `/api` POST must declare `application/json`, else 415 before parsing. Cross-site "simple" requests thereby stop existing: any cross-site attempt is forced into a CORS preflight this server never answers.
-- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: requests without browser markers (no `Origin`, no `sec-fetch-site`) pass on any Host — a non-browser client is the principal itself, not a deputy, and forges every header anyway, so fencing it buys nothing and breaks non-browser LAN automation. For browser requests, `Host` must be loopback or match a `trustedHosts` entry (exact on `host:port`, any port on port-less entries, WHATWG-normalized; rebinding defense); an attached `Origin` must equal that authority; `sec-fetch-site: cross-site` is refused outright. A `trustedHosts` entry that is not a bare authority fails the plugin load — WHATWG parsing would otherwise quietly authorize the hostname inside a typo. `host.pickDirectory` loses its bespoke guard and rides the same fence.
+- **Authority fence (dsh-client-connection, `src/api-request-trust.ts`)**: every request must present a `Host` that is loopback or matches a `trustedHosts` entry (exact on `host:port`, any port on port-less entries, WHATWG-normalized; rebinding defense). Deliberately no shortcut for unmarked requests: over plain HTTP a browser attaches neither `Origin` nor Fetch-Metadata to reads (EventSource, images, navigations — those headers go only to trustworthy destinations), so an unmarked request may be a rebound browser read whose response the page can read, and Host is the one header rebinding cannot forge; non-browser clients pass via loopback, the derived LAN IP literals, or a declared authority. An attached `Origin` must equal the Host authority; `sec-fetch-site: cross-site` is refused outright. A `trustedHosts` entry that is not a bare, canonical authority fails the plugin load — WHATWG parsing would otherwise quietly authorize the hostname inside a typo or broaden an exact-port grant. `host.pickDirectory` loses its bespoke guard and rides the same fence.
 
 Two boundaries stay deliberately out of scope: reachability is the webserver binding's policy (`host: 127.0.0.1 | 0.0.0.0`), and authentication for genuinely remote deployments is deferred work recorded in the connection README — the fence is a confused-deputy defense, not an auth layer. The old guard's loopback-socket check was dropped rather than generalized: with binding expressing reachability and `trustedHosts` naming remote authorities, the socket address adds nothing a header fence does not already cover.
 
@@ -26,6 +26,6 @@ Two boundaries stay deliberately out of scope: reachability is the webserver bin
 ## Consequences
 
 - Any future `/api` method is covered by construction; there is no per-route trust decision left to forget.
-- Non-loopback deployments must have their serving authorities trusted or browsers are refused. The dsh CLI keeps its advertised `--host 0.0.0.0` LAN URL working by deriving the machine's LAN IP literals into the connection row (port-less entries — an IP-literal Host cannot be a rebound name, and the bound port may be OS-assigned) and offers `dsh web --trusted-host` for named authorities; compositions the CLI does not boot declare `trustedHosts` themselves. Plain curl-shape automation is unaffected everywhere.
+- Non-loopback deployments must have their serving authorities trusted or requests are refused. The dsh CLI keeps its advertised `--host 0.0.0.0` LAN URL working by deriving the machine's LAN IP literals into the connection row (port-less entries — an IP-literal Host cannot be a rebound name, and the bound port may be OS-assigned) and offers `dsh web --trusted-host` for named authorities; compositions the CLI does not boot declare `trustedHosts` themselves. Non-browser automation rides the same fence: loopback, a derived LAN IP, or a declared authority passes; an undeclared DNS alias is refused.
 - Clients must label POST bodies `application/json` (ours always did; raw-fetch tests gained the header).
 - The trusted-network assumption of an unauthenticated `0.0.0.0` deployment is now documented instead of implicit.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
index 0be817aca9..2958f7e49b 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
+++ b/.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md
@@ -13,7 +13,7 @@ Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--ho
 在载体层对整个 `/api` 前缀一次性执行浏览器信任检查——两半各占一个栈式 PR：
 
 - **媒体类型栅栏（dsh-host-apiproxy）**：每个 `/api` POST 必须声明 `application/json`，否则在解析前以 415 拒绝。跨站"简单请求"由此不复存在：任何跨站尝试都被逼进一次本服务器从不应答的 CORS 预检。
-- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`）在任何 Host 上都放行——非浏览器客户端是委托人本人，不是代理人，且本就可以伪造任何请求头，对它设栅一无所获，反而会打断非浏览器的 LAN 自动化。对浏览器请求，`Host` 必须是回环地址，或与某个 `trustedHosts` 条目匹配（带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，均经 WHATWG 归一化；rebinding 防御）；若带 `Origin` 则必须与该权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。不是纯权威的 `trustedHosts` 条目会让插件加载失败——否则 WHATWG 解析会悄悄授权笔误里的 hostname。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
+- **权威栅栏（dsh-client-connection，`src/api-request-trust.ts`）**：每个请求的 `Host` 都必须是回环地址，或与某个 `trustedHosts` 条目匹配（带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，均经 WHATWG 归一化；rebinding 防御）。刻意不为无标记请求开捷径：明文 HTTP 下浏览器的读取（EventSource、图片、导航——这些头只发给可信目标）既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求可能是被重绑页面发起且响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；非浏览器客户端经由回环地址、推导的 LAN IP 字面量或已声明的权威通过。若带 `Origin` 则必须与 Host 权威完全一致；`sec-fetch-site: cross-site` 一律拒绝。不是纯的、规范形权威的 `trustedHosts` 条目会让插件加载失败——否则 WHATWG 解析会悄悄授权笔误里的 hostname，或放大精确端口授权。`host.pickDirectory` 失去专属守卫，与其他请求同栅而行。
 
 两条边界刻意留在范围之外：可达性归 webserver 绑定配置（`host: 127.0.0.1 | 0.0.0.0`）管辖；真正远程部署的认证是延期工作，记录在 connection README——这道栅栏是混淆代理人防御，不是认证层。旧守卫的回环 socket 检查被放弃而非泛化：绑定表达可达性、`trustedHosts` 点名远程权威之后，socket 地址提供不了头部栅栏覆盖不到的任何东西。
 
@@ -26,6 +26,6 @@ Web GUI 宿主以纯 HTTP 提供 `/api`（默认 `127.0.0.1:3080`，支持 `--ho
 ## 后果
 
 - 未来任何 `/api` 方法天然在覆盖范围内；不存在会被遗忘的按路由信任决定。
-- 非回环部署的服务权威必须获得信任，否则浏览器会被拒绝。dsh CLI 通过把本机 LAN IP 字面量推导进 connection 行（不带端口的条目——IP 字面量 Host 不可能是被重绑的域名，且绑定端口可能由操作系统分配）来保住它广告出的 `--host 0.0.0.0` LAN URL，并提供 `dsh web --trusted-host` 声明具名权威；CLI 不参与引导的组合自行声明 `trustedHosts`。curl 形态的自动化在任何地方都不受影响。
+- 非回环部署的服务权威必须获得信任，否则请求会被拒绝。dsh CLI 通过把本机 LAN IP 字面量推导进 connection 行（不带端口的条目——IP 字面量 Host 不可能是被重绑的域名，且绑定端口可能由操作系统分配）来保住它广告出的 `--host 0.0.0.0` LAN URL，并提供 `dsh web --trusted-host` 声明具名权威；CLI 不参与引导的组合自行声明 `trustedHosts`。非浏览器自动化走同一道栅栏：回环地址、推导的 LAN IP 或已声明的权威可通过；未声明的 DNS 别名会被拒绝。
 - 客户端必须给 POST 体标注 `application/json`（我们自己的客户端一向如此；裸 fetch 测试补上了该头）。
 - 无认证 `0.0.0.0` 部署的"信任网络"假设从隐含变为成文。
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 878de38a19..43c9b5c8bf 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -280,7 +280,7 @@ export interface ConnectionConfig {
   /**
    * Authorities this deployment serves beyond loopback: exact `host:port`, or
    * port-less `host` matching any port. The /api trust fence refuses any
-   * browser request whose Host is neither loopback nor listed here, so a
+   * request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
    * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
    * that is not a bare, canonical authority fails the plugin load.
diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
index c390223071..6b8558f9be 100644
--- a/packages/client/connection/README.i18n.yaml
+++ b/packages/client/connection/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: 7e437e8fd81d1d57ead5ead64d2049111ad163dc
-README.zh.md: 3615d5ea1be44e6da8e41fa17f645eb414d1ef3e
+README.md: 173a9b9998e17d201b2d31d73ea74a94b319dae6
+README.zh.md: ca5da643db443956c25399f07c8b460900942ad4
diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
index 7e437e8fd8..173a9b9998 100644
--- a/packages/client/connection/README.md
+++ b/packages/client/connection/README.md
@@ -6,7 +6,7 @@ Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared a
 
 ## /api browser-trust fence
 
-The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Requests without browser markers (no `Origin`, no `sec-fetch-site` — curl, tests, native clients) pass on any Host: without a browser there is no confused deputy, and such a sender forges every header anyway. For browser requests, the `Host` header must be a loopback authority or match a `trustedHosts` entry — exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense); an attached `Origin` must equal that authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare, canonical `host[:port]` authority — one WHATWG parsing reads back exactly as written — fails the plugin load loudly: parsing would otherwise quietly authorize the hostname inside `harness.internal/path`, or broaden a dangling-colon or zero-padded port to an any-port grant. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+The node half guards every request under `/api` before bridging (`src/api-request-trust.ts`). Every request — browser-marked or not — must present a `Host` that is a loopback authority or matches a `trustedHosts` entry: exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense). There is deliberately no shortcut for requests without browser markers: over plain HTTP a browser attaches neither `Origin` nor Fetch-Metadata to reads (EventSource, images, navigations — those headers go only to trustworthy destinations), so an unmarked request may still be a rebound browser read with a readable response, and Host is the one header rebinding cannot forge; non-browser clients pass the same fence via loopback, the CLI-derived LAN IP literals, or a declared authority. When markers are present, an attached `Origin` must equal the Host authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare, canonical `host[:port]` authority — one WHATWG parsing reads back exactly as written — fails the plugin load loudly: parsing would otherwise quietly authorize the hostname inside `harness.internal/path`, or broaden a dangling-colon or zero-padded port to an any-port grant. Failures answer plain 403 before any RPC dispatch. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is deliberately not an authentication layer — reachability policy stays with the webserver binding, and auth remains deferred work. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
 
 ## Keyless fixture
 
diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
index 3615d5ea1b..ca5da643db 100644
--- a/packages/client/connection/README.zh.md
+++ b/packages/client/connection/README.zh.md
@@ -6,7 +6,7 @@
 
 ## /api 浏览器信任栅栏
 
-node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。不带浏览器标记的请求（无 `Origin`、无 `sec-fetch-site`——curl、测试、原生客户端）在任何 Host 上都放行：没有浏览器就不存在"混淆代理人"，且这类发送方本就可以伪造任何请求头。对浏览器请求，`Host` 头必须是回环地址权威，或与某个 `trustedHosts` 条目匹配——带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）；若带有 `Origin` 则必须与该权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载大声失败：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接前守卫 `/api` 下的每个请求（`src/api-request-trust.ts`）。每个请求——无论是否带浏览器标记——`Host` 都必须是回环地址权威，或与某个 `trustedHosts` 条目匹配：带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）。刻意不为无浏览器标记的请求开捷径：明文 HTTP 下浏览器的读取（EventSource、图片、导航——这些头只发给可信目标）既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求仍可能是被重绑页面发起的、响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；非浏览器客户端经由回环地址、CLI 推导的 LAN IP 字面量或已声明的权威通过同一道栅栏。当标记存在时，`Origin` 必须与 Host 权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载大声失败：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。失败在任何 RPC 分发之前以纯 403 应答。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏刻意不承担认证职责——可达性策略归 webserver 绑定配置，认证仍是延期工作。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
 
 ## 无密钥 fixture
 
diff --git a/packages/client/connection/src/api-request-trust.ts b/packages/client/connection/src/api-request-trust.ts
index 57a8cb179c..8c1bddd631 100644
--- a/packages/client/connection/src/api-request-trust.ts
+++ b/packages/client/connection/src/api-request-trust.ts
@@ -2,12 +2,15 @@
  * Browser-trust fence for every /api request. Defends the two confused-deputy
  * paths a browser opens against a local HTTP API — DNS rebinding (Host names
  * the attacker's domain while the socket reaches this server) and cross-site
- * requests fired from a malicious page — without blocking non-browser clients
- * (no browser markers → no deputy to confuse, and a native client forges Host
- * freely anyway) or legitimately remote browsers (their authority is declared
- * via `trustedHosts`, or derived by the composing app for IP-literal LAN
- * serving). Network reachability and authentication stay out of scope: binding
- * policy belongs to the webserver config, and this fence is not an auth layer.
+ * requests fired from a malicious page. The Host fence binds every request,
+ * browser-looking or not: over plain HTTP a browser attaches neither Origin
+ * nor Fetch-Metadata to reads (EventSource, images, navigations — those
+ * headers go only to trustworthy destinations), so an unmarked request may
+ * still be a rebound browser read and Host is the one header rebinding cannot
+ * forge. Non-browser and remote clients pass the same fence via loopback, the
+ * CLI-derived LAN IP literals, or a declared `trustedHosts` authority.
+ * Network reachability and authentication stay out of scope: binding policy
+ * belongs to the webserver config, and this fence is not an auth layer.
  */
 
 import type { IncomingHttpHeaders } from 'node:http'
@@ -94,19 +97,16 @@ function isTrustedAuthority(hostUrl: URL, trustedHosts: readonly string[]): bool
  * Decide whether one /api request may reach the RPC bridge.
  * @param request - node HTTP request facts (headers).
  * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
- * @returns true for requests without browser markers, and for browser requests whose Host is ours and whose markers are same-origin.
+ * @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
  */
 export function isTrustedApiRequest(request: ApiTrustRequest, trustedHosts: readonly string[]): boolean {
-  // Marker gate: Origin and sec-fetch-site exist only when a browser is the
-  // sender's deputy. Absent both, the sender is the principal itself (curl,
-  // tests, native shells) and could forge every header below — fencing it
-  // would add nothing and would break non-browser LAN automation.
-  const origin = header(request.headers, 'origin')
-  const secFetchSite = header(request.headers, 'sec-fetch-site')
-  if (origin === undefined && secFetchSite === undefined) return true
-  // Host fence (DNS-rebinding defense): the browser fills Host from the URL it
-  // believes it is talking to, so a rebound page carries the attacker's domain
-  // here even though the socket lands on this server.
+  // Host fence (DNS-rebinding defense), applied to every request: the browser
+  // fills Host from the URL it believes it is talking to, so a rebound page
+  // carries the attacker's domain here even though the socket lands on this
+  // server. There is no marker shortcut — a browser read over plain HTTP
+  // (EventSource, images, navigations) arrives with neither Origin nor
+  // Fetch-Metadata, indistinguishable from curl, and its response is readable
+  // by the rebound page.
   const host = header(request.headers, 'host')
   if (host === undefined) return false
   const hostUrl = parseAuthority(host)
@@ -114,10 +114,12 @@ export function isTrustedApiRequest(request: ApiTrustRequest, trustedHosts: read
   if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) return false
   // Cross-site fence: modern browsers label the initiator relationship on
   // every fetch; an explicit cross-site marker is refused regardless of Origin.
-  if (secFetchSite === 'cross-site') return false
+  if (header(request.headers, 'sec-fetch-site') === 'cross-site') return false
   // Origin fence: when a browser attaches an Origin it must be exactly this
-  // authority (compared through the same normalization as the Host). The
+  // authority (compared through the same normalization as the Host). Absent
+  // Origin is fine — the Host fence above already bound the request. The
   // literal "null" (sandboxed iframes, file: pages) is an opaque origin, refused.
+  const origin = header(request.headers, 'origin')
   if (origin === undefined) return true
   try {
     return new URL(origin).host === hostUrl.host
diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
index a649afda1a..ce55089bdb 100644
--- a/packages/client/connection/src/index.ts
+++ b/packages/client/connection/src/index.ts
@@ -21,7 +21,7 @@ export interface ConnectionConfig {
   /**
    * Authorities this deployment serves beyond loopback: exact `host:port`, or
    * port-less `host` matching any port. The /api trust fence refuses any
-   * browser request whose Host is neither loopback nor listed here, so a
+   * request whose Host is neither loopback nor listed here, so a
    * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
    * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
    * that is not a bare, canonical authority fails the plugin load.
diff --git a/packages/client/connection/tests/api-request-trust.spec.ts b/packages/client/connection/tests/api-request-trust.spec.ts
index 2c608cc988..f145230a8b 100644
--- a/packages/client/connection/tests/api-request-trust.spec.ts
+++ b/packages/client/connection/tests/api-request-trust.spec.ts
@@ -8,13 +8,15 @@ function request(headers: Record<string, string | undefined>): { headers: Record
 }
 
 describe('isTrustedApiRequest', () => {
-  it('accepts every request without browser markers — curl, tests, native clients, on any Host', () => {
-    // No Origin and no sec-fetch-site → the sender is the principal itself
-    // (it forges Host freely anyway); this is the LAN-serving shape a Host
-    // fence must not break.
-    for (const host of ['127.0.0.1:3080', '192.168.1.5:3080', 'harness.example', undefined]) {
-      expect(isTrustedApiRequest(request(host === undefined ? {} : { host }), [])).toBe(true)
-    }
+  it('holds markerless requests to the same Host fence — a plain-HTTP browser read carries no markers', () => {
+    // Over plain HTTP a browser attaches neither Origin nor Fetch-Metadata to
+    // reads (EventSource, images, navigations), so a rebound-origin GET is
+    // markerless and its response readable: no marker shortcut may exist.
+    expect(isTrustedApiRequest(request({ host: '127.0.0.1:3080' }), [])).toBe(true)
+    expect(isTrustedApiRequest(request({ host: '192.168.1.5:3080' }), ['192.168.1.5'])).toBe(true)
+    expect(isTrustedApiRequest(request({ host: '192.168.1.5:3080' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({ host: 'harness.example' }), [])).toBe(false)
+    expect(isTrustedApiRequest(request({}), [])).toBe(false)
   })
 
   it('accepts loopback Hosts in every spelling, with and without ports, for browser requests', () => {
diff --git a/packages/client/connection/tests/node-half.spec.ts b/packages/client/connection/tests/node-half.spec.ts
index 5404f1c798..2c7fd0b281 100644
--- a/packages/client/connection/tests/node-half.spec.ts
+++ b/packages/client/connection/tests/node-half.spec.ts
@@ -98,14 +98,14 @@ describe('connection node half', () => {
   })
 
   it('passes loopback and declared-authority requests through to the bridge', async () => {
-    const { routes, dispose } = await mounted({ trustedHosts: ['harness.example:3080'] })
+    const { routes, dispose } = await mounted({ trustedHosts: ['harness.example:3080', '192.168.1.5'] })
     // Loopback, no browser markers (curl shape): the fence passes; the carrier
     // answers 404 for a GET unary path — proof the bridge ran.
     const loopback = fakeResponse()
     await routes[0]!.handler(fakeRequest({ host: '127.0.0.1:3080' }), loopback.response)
     expect(loopback.state.status).toBe(404)
-    // Undeclared LAN authority, no browser markers: the `--host 0.0.0.0` curl
-    // shape must reach the bridge even with an empty-by-default trust list.
+    // LAN authority declared as a port-less IP literal — the shape the CLI
+    // derives for `--host 0.0.0.0` — passes markerless curl on any port.
     const lan = fakeResponse()
     await routes[0]!.handler(fakeRequest({ host: '192.168.1.5:3080' }), lan.response)
     expect(lan.state.status).toBe(404)

From f43cfb24065506b9c74603088c84fc4b667ea728 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 17:47:56 +0800
Subject: [PATCH 09/16] =?UTF-8?q?fix(cli):=20sample=20LAN=20addresses=20on?=
 =?UTF-8?q?ce=20=E2=80=94=20trust=20and=20the=20printed=20LAN=20URL=20shar?=
 =?UTF-8?q?e=20the=20snapshot?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

web.ts re-sampled interfaces after boot, so an address change during
entry.run() could advertise a LAN URL absent from the trustedHosts snapshot
composePatches captured, answering 403 on arrival. resolveLanTrust now
returns the single sample and AppCLIEntry exposes it for display.
---
 apps/cli/src/app-cli-entry.ts        | 42 ++++++++++++++++++----------
 apps/cli/src/web.ts                  |  6 ++--
 apps/cli/tests/trusted-hosts.spec.ts | 31 ++++++++------------
 3 files changed, 43 insertions(+), 36 deletions(-)

diff --git a/apps/cli/src/app-cli-entry.ts b/apps/cli/src/app-cli-entry.ts
index 1002b45660..acc4482018 100644
--- a/apps/cli/src/app-cli-entry.ts
+++ b/apps/cli/src/app-cli-entry.ts
@@ -34,28 +34,31 @@ export const ALL_INTERFACES_HOST = '0.0.0.0'
  * authorities an all-interfaces bind is reachable by on the LAN.
  * @returns the addresses in interface order (possibly empty).
  */
-export function lanIPv4Addresses(): string[] {
+function lanIPv4Addresses(): string[] {
   return Object.values(networkInterfaces()).flat()
     .filter((iface): iface is NonNullable<typeof iface> => iface !== undefined && iface.family === 'IPv4' && !iface.internal)
     .map(iface => iface.address)
 }
 
 /**
- * Authorities the /api browser-trust fence must accept for one invocation:
- * the machine's LAN IP literals when the effective bind is all-interfaces
- * (advertised by the printed LAN URL, so they must not answer 403), followed
- * by the explicit extras. Derived entries are port-less IP literals — DNS
- * rebinding needs an attacker-controlled name, so an IP-literal Host is safe
- * on any port, and the bound port may be OS-assigned, unknowable pre-boot.
+ * One LAN-trust resolution for one invocation, sampled exactly once: the
+ * machine's LAN IP literals when the effective bind is all-interfaces, and
+ * the `trustedHosts` value built from them plus the explicit extras. The
+ * single sample is deliberate — display must advertise only addresses the
+ * fence was configured with, so both read this snapshot. Derived entries are
+ * port-less IP literals: DNS rebinding needs an attacker-controlled name, so
+ * an IP-literal Host is safe on any port, and the bound port may be
+ * OS-assigned, unknowable pre-boot.
  * @param bindHost - the effective webserver bind host (CLI flag, else the yml default).
  * @param extra - `--trusted-host` values, in argv order.
- * @returns the connection row's `trustedHosts` value (possibly empty).
+ * @returns the sampled LAN addresses and the connection row's `trustedHosts` value (each possibly empty).
  */
-export function resolveTrustedHosts(bindHost: string | undefined, extra: readonly string[]): string[] {
-  return [
-    ...bindHost === ALL_INTERFACES_HOST ? lanIPv4Addresses() : [],
-    ...extra,
-  ]
+export function resolveLanTrust(
+  bindHost: string | undefined,
+  extra: readonly string[],
+): { lanAddresses: string[]; trustedHosts: string[] } {
+  const lanAddresses = bindHost === ALL_INTERFACES_HOST ? lanIPv4Addresses() : []
+  return { lanAddresses, trustedHosts: [...lanAddresses, ...extra] }
 }
 
 /** One profile-json key mapped onto a yml row's config field. */
@@ -126,6 +129,14 @@ export class AppCLIEntry {
   /** The root context, set by {@link run}. */
   ctx!: Context
 
+  /**
+   * LAN IPv4 addresses sampled once at patch composition — the exact snapshot
+   * the /api trust fence was configured with. Display reads this instead of
+   * re-sampling, so the advertised LAN URL can never name an address the
+   * fence rejects. Empty unless the effective bind is all-interfaces.
+   */
+  lanAddresses: readonly string[] = []
+
   private patches: PatchOptions[] = []
 
   constructor(private readonly options: AppCLIEntryOptions) {}
@@ -188,9 +199,10 @@ export class AppCLIEntry {
     if (this.options.workspaceRoot !== undefined) put('api-gateway', 'workspaceRoot', this.options.workspaceRoot)
 
     // Source 2b: authorities for the /api browser-trust fence (rationale on
-    // resolveTrustedHosts).
+    // resolveLanTrust).
     const ymlHost = (rows.get('webserver')?.config as { host?: string } | undefined)?.host
-    const trustedHosts = resolveTrustedHosts(this.options.host ?? ymlHost, this.options.trustedHosts ?? [])
+    const { lanAddresses, trustedHosts } = resolveLanTrust(this.options.host ?? ymlHost, this.options.trustedHosts ?? [])
+    this.lanAddresses = lanAddresses
     if (trustedHosts.length > 0) put('connection', 'trustedHosts', trustedHosts)
 
     // Source 3: the frontend dist — an assembly fact of this app, never yml
diff --git a/apps/cli/src/web.ts b/apps/cli/src/web.ts
index 3d7fc29ab4..69e79ab5d9 100644
--- a/apps/cli/src/web.ts
+++ b/apps/cli/src/web.ts
@@ -7,7 +7,7 @@
  */
 
 import { fileURLToPath } from 'node:url'
-import { ALL_INTERFACES_HOST, AppCLIEntry, lanIPv4Addresses } from './app-cli-entry.ts'
+import { AppCLIEntry } from './app-cli-entry.ts'
 
 const CONFIG_PATH = fileURLToPath(new URL('../cordis.yml', import.meta.url))
 
@@ -48,7 +48,9 @@ export async function runWeb(
     void Promise.resolve(ctx.fiber.dispose()).finally(() => { process.exit(code) })
   }
 
-  const lanCandidate = host === ALL_INTERFACES_HOST ? lanIPv4Addresses()[0] : undefined
+  // The entry's boot-time snapshot, not a fresh sample: the printed LAN URL
+  // must name an address the /api trust fence was configured with.
+  const lanCandidate = entry.lanAddresses[0]
   const localUrl = `http://${LOOPBACK_HOST}:${boundPort}`
   console.log(`dsh web: ${localUrl}${lanCandidate === undefined ? '' : ` (LAN: http://${lanCandidate}:${boundPort})`}`)
 
diff --git a/apps/cli/tests/trusted-hosts.spec.ts b/apps/cli/tests/trusted-hosts.spec.ts
index 1ed0f602b8..571a9f76b7 100644
--- a/apps/cli/tests/trusted-hosts.spec.ts
+++ b/apps/cli/tests/trusted-hosts.spec.ts
@@ -1,7 +1,7 @@
-/** LAN-authority derivation for the /api browser-trust fence (`resolveTrustedHosts`). */
+/** Single-sample LAN-trust resolution for the /api browser-trust fence (`resolveLanTrust`). */
 
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { lanIPv4Addresses, resolveTrustedHosts } from '../src/app-cli-entry.ts'
+import { describe, expect, it, vi } from 'vitest'
+import { resolveLanTrust } from '../src/app-cli-entry.ts'
 
 vi.mock('node:os', () => ({
   networkInterfaces: () => ({
@@ -19,22 +19,15 @@ vi.mock('node:os', () => ({
   }),
 }))
 
-afterEach(() => { vi.restoreAllMocks() })
+describe('resolveLanTrust', () => {
+  it('samples non-internal IPv4 addresses once for an all-interfaces bind: trust and display share them', () => {
+    const { lanAddresses, trustedHosts } = resolveLanTrust('0.0.0.0', ['harness.internal:3080'])
+    expect(lanAddresses).toEqual(['192.168.1.5', '10.0.0.7'])
+    expect(trustedHosts).toEqual(['192.168.1.5', '10.0.0.7', 'harness.internal:3080'])
+  })
 
-describe('lanIPv4Addresses', () => {
-  it('returns only non-internal IPv4 addresses, in interface order', () => {
-    expect(lanIPv4Addresses()).toEqual(['192.168.1.5', '10.0.0.7'])
-  })
-})
-
-describe('resolveTrustedHosts', () => {
-  it('derives port-less LAN IP literals for an all-interfaces bind, ahead of the extras', () => {
-    expect(resolveTrustedHosts('0.0.0.0', ['harness.internal:3080']))
-      .toEqual(['192.168.1.5', '10.0.0.7', 'harness.internal:3080'])
-  })
-
-  it('derives nothing for a loopback or unresolved bind — extras alone stand', () => {
-    expect(resolveTrustedHosts('127.0.0.1', [])).toEqual([])
-    expect(resolveTrustedHosts(undefined, ['lab.internal'])).toEqual(['lab.internal'])
+  it('derives nothing for a loopback or unresolved bind — extras alone stand, no LAN URL to print', () => {
+    expect(resolveLanTrust('127.0.0.1', [])).toEqual({ lanAddresses: [], trustedHosts: [] })
+    expect(resolveLanTrust(undefined, ['lab.internal'])).toEqual({ lanAddresses: [], trustedHosts: ['lab.internal'] })
   })
 })

From 3c8cd3cb9dbb5ba3441ef116c96798ff8d93ff86 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 21:52:05 +0800
Subject: [PATCH 10/16] doc(packages): keep the groups table inside its word
 ceiling after the master merge

master's session-projection row landed the table at 874 words against the
870 ceiling this PR set; tighten the host/client rows this PR added instead
of raising the ceiling.
---
 packages/README.i18n.yaml | 4 ++--
 packages/README.md        | 4 ++--
 packages/README.zh.md     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/README.i18n.yaml b/packages/README.i18n.yaml
index 49dd912706..ba5ab61b06 100644
--- a/packages/README.i18n.yaml
+++ b/packages/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: 127ca49000e8b4b47c65aaacec4ecc8c5b76fa7c
-README.zh.md: b1037f602eaa4a8385938926b3a3be5a88d7ae12
+README.md: 7a86e0f034264d4059e75775016d8d5d84600d8d
+README.zh.md: bfcba626bea2a70f5c2aa508bb2a5b8c09bb61dc
diff --git a/packages/README.md b/packages/README.md
index 127ca49000..7a86e0f034 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -44,8 +44,8 @@ Packages live at `packages/<group>/<pkg>/`; groups are containers, while names r
 | [`sdk/`](sdk/README.md) | Project SDK tooling | Product — stable surface |
 | [`acp/`](acp/README.md) | Automation-only Agent Client Protocol server | Product — stable surface |
 | [`ui/`](ui/README.md) | TUI and JSON-RPC integrations, approval/interaction seams, ask-user tool | Product — stable surface |
-| [`host/`](host/README.md) | Web-GUI host half: shared API gateway + HTTP route server | Product — stable surface |
-| [`client/`](client/README.md) | Web-GUI browser half: shell, wire consumer, object services, slot system, `ui-*` feature plugins | Product — stable surface |
+| [`host/`](host/README.md) | Web-GUI host half: API gateway + HTTP route server | Product — stable surface |
+| [`client/`](client/README.md) | Web-GUI browser half: shell, wire, object services, slots, `ui-*` plugins | Product — stable surface |
 | [`examples/`](examples/README.md) | Demo bundles (agent-spine + TUI/CLI/ACP/JSON-RPC bins) leaves load | Support — example infra |
 | [`support/`](support/README.md) | Support infrastructure (testkits, invariants, replay, Loader smokes) | Support — lower compatibility expectations |
 | [`util/`](util/README.md) | Low-level zero-dependency utilities shared across groups (`Branded<B>`, Harness home/path helpers, timeout, retention) | Support — small, stable, harness-dep-free |
diff --git a/packages/README.zh.md b/packages/README.zh.md
index b1037f602e..bfcba626be 100644
--- a/packages/README.zh.md
+++ b/packages/README.zh.md
@@ -44,8 +44,8 @@
 | [`sdk/`](sdk/README.md) | 项目 SDK 工具 | 产品：稳定表面 |
 | [`acp/`](acp/README.md) | 仅面向自动化的 Agent Client Protocol 服务器 | 产品：稳定表面 |
 | [`ui/`](ui/README.md) | TUI 与 JSON-RPC 集成、批准／交互 seam、用户问答工具 | 产品：稳定表面 |
-| [`host/`](host/README.md) | web GUI 宿主半侧：共享 API 网关 + HTTP 路由服务器 | 产品：稳定表面 |
-| [`client/`](client/README.md) | web GUI 浏览器半侧：shell、协议消费层、对象服务、slot 系统、`ui-*` 特性插件 | 产品：稳定表面 |
+| [`host/`](host/README.md) | web GUI 宿主半侧：API 网关 + HTTP 路由服务器 | 产品：稳定表面 |
+| [`client/`](client/README.md) | web GUI 浏览器半侧：shell、协议层、对象服务、slot、`ui-*` 插件 | 产品：稳定表面 |
 | [`examples/`](examples/README.md) | 演示组合包（agent-spine + TUI/CLI/ACP/JSON-RPC bin），由叶节点加载 | 支持：示例基础设施 |
 | [`support/`](support/README.md) | 支持基础设施（testkit、不变式、回放、Loader 冒烟测试） | 支持：兼容性预期较低 |
 | [`util/`](util/README.md) | 组间共享的低层零依赖工具（`Branded<B>`、Harness home／路径辅助函数、超时、保留策略） | 支持：小型、稳定、无 harness 依赖 |

From 012b5eb466e5c21ab0e70923edcbca9b0a0d97ce Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 28 Jul 2026 21:54:02 +0800
Subject: [PATCH 11/16] fix(cli): stop exporting the internal all-interfaces
 bind literal

knip (unused exports) flags ALL_INTERFACES_HOST: both consumers live in
apps/cli source, so the constant needs no export surface.
---
 apps/cli/src/app-cli-entry.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/cli/src/app-cli-entry.ts b/apps/cli/src/app-cli-entry.ts
index acc4482018..668d8f7f02 100644
--- a/apps/cli/src/app-cli-entry.ts
+++ b/apps/cli/src/app-cli-entry.ts
@@ -27,7 +27,7 @@ const PROFILE_DIR = '.dsh-tmp-profile'
 const PROFILE_FILE = 'config.json'
 
 /** The webserver schema's all-interfaces bind literal: gates LAN-authority derivation here and the printed LAN URL in web.ts. */
-export const ALL_INTERFACES_HOST = '0.0.0.0'
+const ALL_INTERFACES_HOST = '0.0.0.0'
 
 /**
  * Non-internal IPv4 interface addresses of this machine — the IP-literal

From 31cb340c367abf5f33dfefb3787c6eeb2aaf749b Mon Sep 17 00:00:00 2001
From: Turtle <turtle1999@deepseek.com>
Date: Wed, 29 Jul 2026 10:00:29 +0800
Subject: [PATCH 12/16] feat(tui)!: consolidate terminal UI improvements

---
 packages/bash/tool-bash/README.i18n.yaml      |   6 +-
 packages/bash/tool-bash/README.md             |   4 +-
 packages/bash/tool-bash/README.zh.md          |   4 +-
 packages/bash/tool-bash/src/index.ts          |   4 +-
 packages/bash/tool-bash/src/render.ts         |  31 +-
 packages/bash/tool-bash/tests/tools.spec.ts   |  30 +-
 packages/ui/tui/AGENTS.md                     |   5 +
 packages/ui/tui/README.i18n.yaml              |   4 +-
 packages/ui/tui/README.md                     |  23 +-
 packages/ui/tui/README.zh.md                  |  25 +-
 packages/ui/tui/src/chat/resume.ts            |  82 ++-
 packages/ui/tui/src/chat/timing.ts            |   2 +-
 packages/ui/tui/src/components/dialogs.ts     | 175 +++++--
 packages/ui/tui/src/components/theme.ts       | 232 +++++++--
 packages/ui/tui/src/components/transcript.ts  | 211 ++++++--
 .../ui/tui/src/components/xml-tool-output.ts  |  40 +-
 packages/ui/tui/src/config.ts                 |  14 +-
 packages/ui/tui/src/extension/types.ts        |   4 +-
 packages/ui/tui/src/index.ts                  | 199 ++++---
 packages/ui/tui/src/runtime.ts                |  22 +-
 packages/ui/tui/tests/harness.ts              |   3 +
 .../advanced-cards-collapsed.expected.txt     |  25 +-
 .../advanced-cards-expanded.expected.txt      |  37 +-
 .../snapshots/banner-gradient.expected.txt    |  16 +-
 .../snapshots/code-mode-pending.expected.txt  |  18 +-
 .../conversation-streaming.expected.txt       |  25 +-
 .../cordis-tools-pending.expected.txt         |  18 +-
 .../snapshots/disposed-terminal.expected.txt  | 104 ++--
 .../dynamic-workflow-pending.expected.txt     |  18 +-
 .../snapshots/errors-and-help.expected.txt    | 102 ++--
 .../snapshots/file-autocomplete.expected.txt  |  20 +-
 .../model-selector-filtered.expected.txt      |  52 ++
 .../snapshots/model-selector.expected.txt     |  69 +--
 .../snapshots/model-switching.expected.txt    |  20 +-
 ...question-dialog-single-option.expected.txt |  22 +-
 .../question-dialog-validation.expected.txt   |  14 +-
 .../snapshots/question-dialog.expected.txt    |  14 +-
 ...esume-sessions-all-workspaces.expected.txt |  57 ++
 .../snapshots/resume-sessions.expected.txt    |  17 +-
 .../snapshots/retry-cancelled.expected.txt    |  20 +-
 .../snapshots/retry-exhausted.expected.txt    |  20 +-
 .../snapshots/retry-recovered.expected.txt    |  20 +-
 .../snapshots/retry-scheduled.expected.txt    |  20 +-
 .../snapshots/session-reference.expected.txt  |  16 +-
 .../session-title-autocomplete.expected.txt   |  20 +-
 .../shell-prompt-multiline.expected.txt       |  10 +-
 .../status-diagnostics-narrow.expected.txt    |  48 +-
 .../snapshots/status-diagnostics.expected.txt |  50 +-
 .../step-timing-completed.expected.txt        |  22 +-
 ...rface-after-compaction-narrow.expected.txt |  39 +-
 ...surface-after-compaction-wide.expected.txt |  40 +-
 .../surface-before-compaction.expected.txt    |  25 +-
 .../snapshots/todo-plan-cleared.expected.txt  |  22 +-
 .../snapshots/untrusted-controls.expected.txt |  35 +-
 packages/ui/tui/tests/tui.snapshot.ts         |  66 ++-
 packages/ui/tui/tests/tui.spec.ts             | 485 +++++++++++++++---
 packages/ui/tui/tests/xml-tool-output.spec.ts |  45 +-
 57 files changed, 1875 insertions(+), 896 deletions(-)
 create mode 100644 packages/ui/tui/AGENTS.md
 create mode 100644 packages/ui/tui/tests/snapshots/model-selector-filtered.expected.txt
 create mode 100644 packages/ui/tui/tests/snapshots/resume-sessions-all-workspaces.expected.txt

diff --git a/packages/bash/tool-bash/README.i18n.yaml b/packages/bash/tool-bash/README.i18n.yaml
index a529b56b56..676c935cbd 100644
--- a/packages/bash/tool-bash/README.i18n.yaml
+++ b/packages/bash/tool-bash/README.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-README.md: 965ae25a5e29a4f767adfcb73e4a77f1060e4b46
-README.zh.md: 60be5c5ca5624719f5ca651a78b6ba56f3f3df06
+#   pnpm run verify-translation-pairing --write packages/bash/tool-bash/README.md
+README.md: deb6b899c81cb8c335b4c1cffdde4797e0a8be92
+README.zh.md: c2514308fb9f234e6d191a6b1a821ac3d195378b
diff --git a/packages/bash/tool-bash/README.md b/packages/bash/tool-bash/README.md
index 965ae25a5e..deb6b899c8 100644
--- a/packages/bash/tool-bash/README.md
+++ b/packages/bash/tool-bash/README.md
@@ -57,7 +57,7 @@ When `run_in_background` is true, this plugin preflights `ctx.tasks.start()` bef
 
 ## UI presentation
 
-The tool owns its `presentCall`/`presentResult` render intent. A foreground call is a terminal card carrying command, description, cwd, raw output, and parsed exit status. A background start is a generic execute card because it returns only a task id; the generic `task_*` tools own their own cards. These presenters are pure and replay-safe.
+The tool owns its `presentCall`/`presentResult` render intent. A foreground call is a terminal card carrying command, description, cwd, output, and parsed exit status. Because the card shows the exit as its own pill, the `[exit code: N]` / `[killed by signal: …]` marker the parse consumes leaves the output; every other marker (truncation, timeout, sandbox) stays in it. A background start is a generic execute card because it returns only a task id; the generic `task_*` tools own their own cards. These presenters are pure and replay-safe.
 
 ## The tool builds its request from named args only
 
@@ -153,6 +153,6 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 ## Known Limitations and Deferred Work
 
-- **Replay exit pills parse from result text** — output whose final line happens to be exactly `[exit code: N]` / `[killed by signal: …]` shows a wrong pill on session replay; a display-only known residual.
+- **Replay exit pills parse from result text** — output whose final line happens to be exactly `[exit code: N]` / `[killed by signal: …]` shows a wrong pill on session replay and loses that line from the card body, because the parse treats it as the marker it consumes; a display-only known residual.
 - **The `bash` tool opts out of `timeout-policy` budgets** — it keeps the executor-owned `BASH_TIMEOUT` path, per [the tool-call timeout-policy Agent Note](../../../.agents/notes/implemented/architecture/2026-07-07-tool-call-timeout-policy.md).
 - **Background processes have no executor timeout** — callers must use `task_kill`, or rely on owner/service disposal, when work no longer matters.
diff --git a/packages/bash/tool-bash/README.zh.md b/packages/bash/tool-bash/README.zh.md
index 60be5c5ca5..c2514308fb 100644
--- a/packages/bash/tool-bash/README.zh.md
+++ b/packages/bash/tool-bash/README.zh.md
@@ -57,7 +57,7 @@ overlay 根据当前 `ToolExecution` 计算，并通过专用的 `BashExecReques
 
 ## UI 展示
 
-工具持有自己的 `presentCall`/`presentResult` 渲染意图。前台调用是终端卡片，包含命令、说明、cwd、原始输出和解析后的退出状态。后台启动只返回 task id，因此使用通用执行卡片；通用 `task_*` 工具持有各自的卡片。这些 presenter 是纯函数，可安全回放。
+工具持有自己的 `presentCall`/`presentResult` 渲染意图。前台调用是终端卡片，包含命令、说明、cwd、输出和解析后的退出状态。由于卡片以独立的 pill 展示退出状态，解析所消耗的 `[exit code: N]` / `[killed by signal: …]` 标记会从输出中移除；其他所有标记（截断、超时、沙箱）都保留在输出中。后台启动只返回 task id，因此使用通用执行卡片；通用 `task_*` 工具持有各自的卡片。这些 presenter 是纯函数，可安全回放。
 
 ## 工具仅使用具名参数构建请求
 
@@ -153,6 +153,6 @@ renderer 先输出依数据而定的 stdout 尾部，再输出可选的 `[stderr
 
 ## 已知限制与延期工作
 
-- **回放退出状态 pill 从结果文本解析**：如果输出最后一行恰好精确为 `[exit code: N]` / `[killed by signal: …]`，会话回放将显示错误的 pill；这是仅影响展示的已知残留问题。
+- **回放退出状态 pill 从结果文本解析**：如果输出最后一行恰好精确为 `[exit code: N]` / `[killed by signal: …]`，会话回放将显示错误的 pill，并且该行会从卡片正文中丢失，因为解析会把它当作自己消耗的标记；这是仅影响展示的已知残留问题。
 - **`bash` 工具不采用 `timeout-policy` 预算**：根据[工具调用 timeout-policy Agent Note](../../../.agents/notes/implemented/architecture/2026-07-07-tool-call-timeout-policy.md)，它保留由执行器持有的 `BASH_TIMEOUT` 路径。
 - **后台进程没有执行器超时**：工作不再需要时，调用方必须使用 `task_kill`，或依赖持有者／服务的 dispose。
diff --git a/packages/bash/tool-bash/src/index.ts b/packages/bash/tool-bash/src/index.ts
index b403c4414e..f8cece2862 100644
--- a/packages/bash/tool-bash/src/index.ts
+++ b/packages/bash/tool-bash/src/index.ts
@@ -296,7 +296,9 @@ function presentBashResult(args: unknown, result: ToolResult): ToolResultView |
   if (isBackground || result.isError) {
     return { card: 'generic', content: [{ type: 'text', text: `\`\`\`console\n${raw.replace(/\n+$/, '')}\n\`\`\`` }] }
   }
-  return { card: 'terminal', output: raw, ...parseExitStatus(raw) }
+  // The exit marker becomes the card's exit pill, so it leaves the output body.
+  const { body, ...exit } = parseExitStatus(raw)
+  return { card: 'terminal', output: body, ...exit }
 }
 
 /**
diff --git a/packages/bash/tool-bash/src/render.ts b/packages/bash/tool-bash/src/render.ts
index 77a88e28f3..eabe681c25 100644
--- a/packages/bash/tool-bash/src/render.ts
+++ b/packages/bash/tool-bash/src/render.ts
@@ -95,10 +95,23 @@ export function renderProcessRead(
 }
 
 /**
- * Recover the structured exit status from a rendered {@link renderResult}
- * string — the inverse of the status markers it appends. A killed marker
- * yields `signal`; otherwise a non-zero marker yields `exitCode`; absent both
- * means a clean exit 0.
+ * The exit status recovered from a rendered result, with the output body that
+ * status was split off from.
+ */
+export type ParsedExitStatus =
+  & { body: string }
+  & ({ exitCode: number } | { signal: string })
+
+/**
+ * Split a rendered {@link renderResult} string into its output body and the
+ * structured exit status — the inverse of the status markers it appends. A
+ * killed marker yields `signal`; otherwise a non-zero marker yields `exitCode`;
+ * absent both means a clean exit 0.
+ *
+ * The consumed marker is removed from `body` because a terminal presentation
+ * shows the exit status as its own pill: leaving the marker in the output would
+ * render the exit twice. Other markers (timeout, sandbox denial) carry facts no
+ * pill shows, so they stay in the body.
  *
  * Replay only retains the rendered content text, not the original
  * `BashRunResult`, so terminal presentation must recover the exit pill here.
@@ -106,12 +119,12 @@ export function renderProcessRead(
  * that merely ends with marker-like text from matching unless the final line
  * is indistinguishable from a real marker.
  * @param text - rendered model-facing bash result.
- * @returns the recovered terminal exit code or signal.
+ * @returns the marker-free body plus the recovered terminal exit code or signal.
  */
-export function parseExitStatus(text: string): { exitCode: number } | { signal: string } {
+export function parseExitStatus(text: string): ParsedExitStatus {
   const signal = /\n\[killed by signal: ([^\]\n]+)\]$/.exec(text)
-  if (signal?.[1] !== undefined) return { signal: signal[1] }
+  if (signal?.[1] !== undefined) return { body: text.slice(0, signal.index), signal: signal[1] }
   const exit = /\n\[exit code: (\d+)\]$/.exec(text)
-  if (exit?.[1] !== undefined) return { exitCode: Number(exit[1]) }
-  return { exitCode: 0 }
+  if (exit?.[1] !== undefined) return { body: text.slice(0, exit.index), exitCode: Number(exit[1]) }
+  return { body: text, exitCode: 0 }
 }
diff --git a/packages/bash/tool-bash/tests/tools.spec.ts b/packages/bash/tool-bash/tests/tools.spec.ts
index 15222ee647..a52b3f16f1 100644
--- a/packages/bash/tool-bash/tests/tools.spec.ts
+++ b/packages/bash/tool-bash/tests/tools.spec.ts
@@ -911,22 +911,32 @@ describe('tool-owned UI presentation (presentCall / presentResult)', () => {
   it('bash presentResult: a terminal result carries RAW output (newlines intact) + parsed exit code', async () => {
     const ctx = await setup()
     const present = ctx.tools.get('bash')!.presentResult!(
-      { command: 'echo hi', description: 'echo' },
-      { content: [{ type: 'text', text: 'hi\n[exit code: 0]\n\n' }], isError: false },
+      { command: 'printf "hi\\n\\n"', description: 'echo' },
+      // A clean run renders no exit marker at all, so the body is the raw bytes.
+      { content: [{ type: 'text', text: 'hi\n\n' }], isError: false },
     )
     // A terminal result keeps the RAW bytes (newlines intact) a terminal renderer
-    // needs; the bridge derives the fenced fallback. exitCode is parsed back from
-    // the [exit code: N] marker.
-    expect(present).toEqual({ card: 'terminal', output: 'hi\n[exit code: 0]\n\n', exitCode: 0 })
+    // needs; the bridge derives the fenced fallback.
+    expect(present).toEqual({ card: 'terminal', output: 'hi\n\n', exitCode: 0 })
   })
 
   it('bash presentResult: a non-zero exit and a signal kill parse into exitCode / signal', async () => {
     const ctx = await setup()
     const args = { command: 'x', description: 'x' }
     const nonzero = ctx.tools.get('bash')!.presentResult!(args, { content: [{ type: 'text', text: 'oops\n[exit code: 3]' }], isError: false })
-    expect(nonzero).toEqual({ card: 'terminal', output: 'oops\n[exit code: 3]', exitCode: 3 })
+    expect(nonzero).toEqual({ card: 'terminal', output: 'oops', exitCode: 3 })
     const killed = ctx.tools.get('bash')!.presentResult!(args, { content: [{ type: 'text', text: 'gone\n[killed by signal: SIGKILL]' }], isError: false })
-    expect(killed).toEqual({ card: 'terminal', output: 'gone\n[killed by signal: SIGKILL]', signal: 'SIGKILL' })
+    expect(killed).toEqual({ card: 'terminal', output: 'gone', signal: 'SIGKILL' })
+  })
+
+  it('bash presentResult: markers a pill CANNOT show (timeout, sandbox denial) stay in the terminal output', async () => {
+    const ctx = await setup()
+    const args = { command: 'x', description: 'x' }
+    const timedOut = ctx.tools.get('bash')!.presentResult!(
+      args,
+      { content: [{ type: 'text', text: 'slow\n[timed out after 100ms]\n[exit code: 143]' }], isError: false },
+    )
+    expect(timedOut).toEqual({ card: 'terminal', output: 'slow\n[timed out after 100ms]', exitCode: 143 })
   })
 
   it('bash presentResult exit parse is the inverse of renderResult markers (round-trip)', async () => {
@@ -952,8 +962,11 @@ describe('tool-owned UI presentation (presentCall / presentResult)', () => {
       const rendered = renderResult(c.result)
       const out = present.presentResult!({ command: 'x', description: 'x' }, { content: [{ type: 'text', text: rendered }], isError: false })
       // Drop card + output; the remaining fields are the parsed exit.
-      const { card: _c, output: _o, ...exit } = out as { card: string; output?: string; exitCode?: number; signal?: string }
+      const { card: _c, output, ...exit } = out as { card: string; output?: string; exitCode?: number; signal?: string }
       expect(exit).toEqual(c.expect)
+      // Whatever the parse consumed is gone from the body, so a card with an exit
+      // pill never shows the same status twice.
+      expect(output).not.toMatch(/\[exit code: \d+\]|\[killed by signal: /)
     }
   })
 
@@ -964,6 +977,7 @@ describe('tool-owned UI presentation (presentCall / presentResult)', () => {
     // newline; parsing requires the leading newline emitted for real markers, so this stays exit 0.
     const out = ctx.tools.get('bash')!.presentResult!(args, { content: [{ type: 'text', text: '[exit code: 5]' }], isError: false })
     expect(out).toEqual({ card: 'terminal', output: '[exit code: 5]', exitCode: 0 })
+    // Unparsed marker-like text is real output, so it is NOT stripped from the body.
     // Same for a fake signal marker with no leading newline.
     const sig = ctx.tools.get('bash')!.presentResult!(args, { content: [{ type: 'text', text: '[killed by signal: SIGKILL]' }], isError: false })
     expect(sig).toEqual({ card: 'terminal', output: '[killed by signal: SIGKILL]', exitCode: 0 })
diff --git a/packages/ui/tui/AGENTS.md b/packages/ui/tui/AGENTS.md
new file mode 100644
index 0000000000..2e73212a58
--- /dev/null
+++ b/packages/ui/tui/AGENTS.md
@@ -0,0 +1,5 @@
+# AGENTS.md — TUI package
+
+These rules supplement the package conventions in [packages/AGENTS.md](../../AGENTS.md).
+
+- **Present TUI designs in tmux, not in the session transcript.** When tmux is available, run the assembled TUI in a pane of the same window the session runs in and point the user at it; print a rendering into the transcript only as a fallback.
diff --git a/packages/ui/tui/README.i18n.yaml b/packages/ui/tui/README.i18n.yaml
index 4e0757170d..8ab63910fa 100644
--- a/packages/ui/tui/README.i18n.yaml
+++ b/packages/ui/tui/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/ui/tui/README.md
-README.md: 5aafd6f5207320bf273c96a04f2d606577ca2da0
-README.zh.md: 1901faeb26c65126bc5475a991fedecd39a88ba5
+README.md: 0b358520b863f0b9ee7a128cf4807f582fc46d8d
+README.zh.md: 7e89197bd82d16dfbabeb715e953275e2f6dd68b
diff --git a/packages/ui/tui/README.md b/packages/ui/tui/README.md
index 5aafd6f520..0b358520b8 100644
--- a/packages/ui/tui/README.md
+++ b/packages/ui/tui/README.md
@@ -22,9 +22,9 @@ Typing `@` at a token boundary searches files and directories under the session
 
 When optional `ctx.sessionReferences` is mounted, the same `@` menu also offers metadata-only session candidates, inserts `@[label](dsh-session:<payload>)`, and prepares the selected snapshots before dispatch. Session references remain structured because the model has no filesystem-like tool for retrieving session snapshots later. Preparation disables duplicate submission and restores the editor input on failure. The TUI chooses `agent.steer()` or `agent.followup()` from the status after that asynchronous preparation, so idle follow-ups still dispatch `agent/prompt-submit` while in-turn steering joins at a checkpoint without that hook.
 
-While the agent is running, ordinary editor submissions call `agent.steer()`; otherwise they call `agent.followup()`. A slash at the start of the submitted line enters `ctx.commands` instead: known commands execute directly, unknown commands produce a warning, and neither path automatically reaches the model. A command producer may explicitly schedule agent work; [`dsh-plan-mode`](../../plan/plan-mode/README.md#model-and-human-surfaces) uses that contract for `/plan [message]`. The TUI registers `/help`, `/model`, `/clear`, `/reasoning`, `/tools`, `/redraw`, `/reload`, `/resume`, `/status`, and `/exit` as agent-scoped definitions; every other effective command joins autocomplete and `/help` dynamically, as do `/skill:` completions. A status line above the editor reports the turn phase the TUI derives from session events — waiting for the first token, thinking, responding, or executing tools — with the elapsed time in that phase and the running step total, refreshed each second, and ends with the `Enter sends steering, Esc cancels` hint; while steering messages wait to reach the model it inserts a `N queued ·` badge before the hint that clears as each drains. Ctrl+C or Escape cancels a running turn. Tool cards collapse long bodies into a configurable head/tail preview; Ctrl+O toggles every card between its preview and full output. Ctrl+R toggles reasoning, Ctrl+L redraws, and Ctrl+D exits while idle.
+While the agent is running, ordinary editor submissions call `agent.steer()`; otherwise they call `agent.followup()`. A slash at the start of the submitted line enters `ctx.commands` instead: known commands execute directly, unknown commands produce a warning, and neither path automatically reaches the model. A command producer may explicitly schedule agent work; [`dsh-plan-mode`](../../plan/plan-mode/README.md#model-and-human-surfaces) uses that contract for `/plan [message]`. The TUI registers `/help`, `/model`, `/clear`, `/palette`, `/reload`, `/resume`, `/status`, and `/exit` as agent-scoped definitions; every other effective command joins autocomplete and `/help` dynamically, as do `/skill:` completions. A status line above the editor reports the turn phase the TUI derives from session events — waiting for the first token, thinking, responding, or executing tools — with the elapsed time in that phase and the running step total, refreshed each second, and ends with the `Enter sends steering, Esc cancels` hint; while steering messages wait to reach the model it inserts a `N queued ·` badge before the hint that clears as each drains. Ctrl+C or Escape cancels a running turn. Tool and injected-context cards collapse long bodies into a configurable head/tail preview; Ctrl+O cycles tool cards through collapsed preview, full output, and hidden — the hidden phase drops tool cards from the transcript entirely while context cards stay at their preview, since injected instructions are not tool traffic. An injected-context card renders its message as prose with the producer's outer reminder frame stripped, so neither the fold nor the frame stripping depends on the payload's syntax. Ctrl+R toggles reasoning, Ctrl+L redraws, and Ctrl+D exits while idle.
 
-`/model` opens the advisory `ctx.llm` catalog as a keyboard selector: Up/Down moves, Shift+Tab cycles the focused model's adapter-advertised reasoning efforts in display order, Enter selects the model and effort, and Escape closes it. When an adapter does not advertise a default effort, the cycle also includes `provider default`, which clears an explicit selection; models without selectable effort metadata ignore Shift+Tab. The selector renders the exact advertised effort list—including `off` when present—and does not synthesize, clamp, or transfer an effort between models. `/model <model>` still selects an unambiguous model id directly, while `/model <provider>/<model>` selects an exact target and uses its adapter default when one exists. The configured target or latest logged request header initializes the selector, and an unlisted current model remains visible because catalogs are advisory. Selection is local to this TUI session. Prompt assembly snapshots the target for one step, replaces `{{provider}}` and `{{model}}`, and applies the same provider/model/reasoning-effort target through `agent/request`; a switch during assembly therefore starts with a later step. The request header durably records targets that reach the model, while an unused selection remains process-local.
+`/model` opens the advisory `ctx.llm` catalog as a keyboard selector: a filter box above the list narrows rows by a case-insensitive substring over each row's `provider/model` label, model name, and description, keeping the highlighted row selected when it survives the filter; Up/Down moves, Shift+Tab cycles the focused model's adapter-advertised reasoning efforts in display order, Enter selects the model and effort, and Escape clears a non-empty filter before a second Escape closes it. When an adapter does not advertise a default effort, the cycle also includes `provider default`, which clears an explicit selection; models without selectable effort metadata ignore Shift+Tab. The selector renders the exact advertised effort list—including `off` when present—and does not synthesize, clamp, or transfer an effort between models. `/model <model>` still selects an unambiguous model id directly, while `/model <provider>/<model>` selects an exact target and uses its adapter default when one exists. The configured target or latest logged request header initializes the selector, and an unlisted current model remains visible because catalogs are advisory. Selection is local to this TUI session. Prompt assembly snapshots the target for one step, replaces `{{provider}}` and `{{model}}`, and applies the same provider/model/reasoning-effort target through `agent/request`; a switch during assembly therefore starts with a later step. The request header durably records targets that reach the model, while an unused selection remains process-local.
 
 `/reload` (EXPERIMENTAL, dev-only) re-reads every file-backed loader config tree and applies the diff to the running app — the HMR watcher's config path, invoked manually; it needs the cordis Loader in the context and degrades to a warning without one, runs only while the agent is idle, and refuses re-entry while a reload is in flight. Module-source hot reload remains watcher-owned. When a `skills` service is mounted, `/skill:<name> [instructions]` loads that skill's instructions into the conversation as a user turn; autocomplete lists the model-invocable skills, and any skill (including a model-disabled one) is loadable by its exact name.
 
@@ -32,9 +32,15 @@ The footer sums the session's reported usage as `↑<uncached input> ↓<output>
 
 `/status` adds a point-in-time diagnostics card to the transcript and remains available while the agent runs. It reports the session id, title, working directory, selected provider/model, selected reasoning effort or default behavior, reasoning-block visibility, agent state, event/turn/step/tool-call counts, exact input/output/cache token buckets, KV-cache hit rate, token-meter context use and capacity, creation time, and latest event time. Missing titles, models, cache input, or context capacity are labeled instead of inferred. The card is terminal-only and does not duplicate the compact footer.
 
-`/resume` opens a full-viewport keyboard selector over the current workspace instead of a centered dialog. Its focused search field starts immediately after the search glyph and emits pi-tui's cursor marker, so terminal IME composition remains anchored inside the field. Candidates are sorted by last logged activity and searchable by log-backed title or session id; each row reports current/live/persisted state, last turn outcome, recent provider/model, and durable goal phase when present. Up/Down and Page Up/Page Down navigate, Enter resumes, Escape clears a non-empty search before a second Escape cancels, and Ctrl+C cancels directly. The current session, a session already live in this runtime, an unreadable log, a mismatched cwd, or a session whose logged provider has no current adapter remains visible but disabled. Selection repeats those checks and requires the current agent to be idle before flushing the current session. The TUI then stops the terminal UI and calls the optional host-owned `TuiRuntime.handoffResume`; where `process.execve` is available, the shipped `dsh` host disposes the app and replaces its process. Resume restores the same `SessionId`, transcript, title, todos, and durable goal; goal activation remains disarmed and the TUI asks for human confirmation or `/goal resume`.
+`/resume` opens a full-viewport keyboard selector instead of a centered dialog. Two scopes cover the same candidate set: the current workspace, which it opens on, and all workspaces, which Tab toggles to. The scope line under the search field names the active scope and the count the other holds, and each row in the all-workspaces scope also reports its own workspace. Toggling clears the search and selection so the highlighted row always belongs to the visible list.
 
-`resumeCommand` remains the deployment-owned fallback: exiting prints it only after the current session is durable, and a host without in-place handoff shows the selected session's command. `{session}` expands to the session id. TUI code never executes the template or arbitrary shell text.
+Its focused search field starts immediately after the search glyph and emits pi-tui's cursor marker, so terminal IME composition remains anchored inside the field. Candidates are sorted by last logged activity and searchable by log-backed title or session id, and by workspace label in the all-workspaces scope; each row reports current/live/persisted state, last turn outcome, recent provider/model, and durable goal phase when present. Up/Down and Page Up/Page Down navigate, Enter resumes, Escape clears a non-empty search before a second Escape cancels, and Ctrl+C cancels directly. The current session, a session already live in this runtime, an unreadable log, a session with no recorded workspace to run in, or a session whose logged provider has no current adapter remains visible but disabled; a workspace other than the current one is a scope rather than a disabled reason, because resume enters that directory.
+
+Selection repeats those checks and requires the current agent to be idle before flushing the current session. The TUI then stops the terminal UI and calls the optional host-owned `TuiRuntime.handoffResume` with the selected id and the workspace re-read at preflight: process cwd, not the restored session header, is what filesystem and shell tools resolve against, so the host must enter that directory. Where `process.execve` is available, the shipped `dsh` host chdirs into it before disposing the app and replacing its process, and rejects an unreachable directory while the terminal can still be restored. Resume restores the same `SessionId`, transcript, title, todos, and durable goal; goal activation remains disarmed and the TUI asks for human confirmation or `/goal resume`.
+
+The exit line is launcher-owned, not configurable. A launcher provides `TUI_GOODBYE_MESSAGE_KEY` on the boot context — for the shipped `dsh`, the command that resumes this session — and exiting prints it verbatim after the terminal is released; absent, exiting prints nothing. Only the launcher knows how it was invoked, so only it can name a command that works. The TUI escapes terminal controls before rendering and never executes the text. A launcher that also supplies `MAIN_SESSION_ID_KEY` fixes which session the mounted app binds to, so resume survives any config-level patch.
+
+A launcher can seed a fresh session's first turn by providing `INITIAL_SKILL_KEY` (the skill name) on the boot context; the TUI auto-invokes it exactly as a typed `/skill:<name>`, once the chat is live. The shipped `dsh migrate`/`dsh upgrade` set it and only for a fresh session, so a resumed session never re-invokes the skill; an unknown name is reported as a notice.
 
 ## Config
 
@@ -57,7 +63,6 @@ The footer sums the session's reported usage as `↑<uncached input> ↓<output>
 | `showHardwareCursor` | `false` | Show the hardware cursor at pi-tui's IME marker |
 | `color` | `true` | Apply the built-in ANSI palette (see [Color](#color)) |
 | `title` | `DeepSeek Harness` | Product suffix for the terminal window title. |
-| `resumeCommand` | — | Shell command template for the exit hint and hosts without in-place handoff, with `{session}` expanded to the session id |
 
 ```yaml
 - id: terminal
@@ -74,7 +79,11 @@ Startup fails before mounting when either process stream is not a TTY. The compo
 
 ## Color
 
-The palette uses the standard 16-color ANSI foregrounds and SGR attributes, which every terminal remaps to its active color scheme, so it stays readable on light and dark backgrounds alike. Body text keeps the terminal's default foreground rather than a fixed shade. Grouped regions (user prompts, assistant replies, tool cards) are separated by a bold, underlined role header in the role color and blank-line spacing rather than a filled block or a per-line prefix, so a mouse drag-select copies the message text without any leading bar or indent; a tool card's status (pending, error, success) shows in its colored, underlined title glyph and title. The question panel emphasizes its active row with bold accent text, while selectors use reverse video. These treatments are foreground-only, so they never collide with the terminal background. Set `color: false` to strip all styling.
+Every SGR code the TUI emits lives in one table, `paletteSpec` in `components/theme.ts`, which `createPalette` derives its wrappers from and `/palette` prints; no component writes an escape of its own. The table holds only the standard 16-color ANSI foregrounds and SGR attributes, which every terminal remaps to its active color scheme, so the TUI stays readable on light and dark backgrounds alike — the startup banner's brand gradient is the one deliberate exception. Body text keeps the terminal's default foreground rather than a fixed shade.
+
+There is one role per visual meaning: `dim` is the single recessed tone and `accent` the single emphasis color, while `success` and `error` double as a diff's added and removed lines. Colors and attributes are separately typed, so `bold(accent(x))` compiles and `accent(error(x))` does not — SGR has no color stack, so nesting one color inside another silently drops the outer color at the inner one's close. Attributes occupy independent SGR groups and compose with any color in either order. Run `/palette` to see every role as your terminal renders it, with its SGR pair.
+
+Grouped regions (user prompts, assistant replies, tool cards) are separated by a bold, underlined role header in the role color and blank-line spacing rather than a filled block or a per-line prefix, so a mouse drag-select copies the message text without any leading bar or indent; a tool card's status (pending, error, success) shows in its colored, underlined title glyph and title. Inside a tool card, the whole body — presenter title, a terminal `$` command and cwd, and the tool's own output — renders in one dim tone, so only the status-colored header carries color and the body reads as one recessed block instead of a run of competing shades; an injected-context card's prose is the same tone as its header. A diff card's `+`/`-` lines and a `[signal …]` marker stay colored, because there the color is the meaning rather than emphasis. The question panel emphasizes its active row with bold accent text, while selectors use reverse video. These treatments are foreground-only, so they never collide with the terminal background. Set `color: false` to strip all styling.
 
 ## Model Experience
 
@@ -156,7 +165,7 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 ## Known Limitations and Deferred Work
 
-- **Resume has no cross-process session lock** — the selector rejects sessions known to be live in its own runtime, but another process can resume the same persisted id before or during handoff. Deployments that can run concurrent hosts must coordinate ownership outside the TUI.
+- **Resume has no cross-process session lock** — the selector rejects sessions known to be live in its own runtime, but another process can resume the same persisted id before or during handoff. The all-workspaces scope makes this reachable in one step, since a session another host is driving in a different directory is now selectable. Deployments that can run concurrent hosts must coordinate ownership outside the TUI.
 - **One configured session owns the transcript and editor** — questions from other agents can still use the shared overlay provider, but session rendering and prompt input remain bound to `sessionId`.
 - **Tool cards are text terminal presentations** — terminal, diff, and generic cards use tool-owned titles/content, but session content currently has no image block for inline image rendering.
 - **Non-TTY operation is intentionally unsupported** — app bundles that need automation must compose a one-shot or server front door (`dsh-cli-demo`, `dsh-acp`) rather than expecting an internal fallback.
diff --git a/packages/ui/tui/README.zh.md b/packages/ui/tui/README.zh.md
index 1901faeb26..7e89197bd8 100644
--- a/packages/ui/tui/README.zh.md
+++ b/packages/ui/tui/README.zh.md
@@ -22,9 +22,9 @@ TUI 从活跃会话表层重建已恢复历史，渲染 Markdown 响应与 reaso
 
 挂载可选的 `ctx.sessionReferences` 后，同一个 `@` 菜单还会提供仅含元数据的会话候选项，插入 `@[label](dsh-session:<payload>)`，并在分派前准备所选快照。会话引用保持结构化，因为模型没有类似文件系统的工具可在稍后检索会话快照。准备期间会禁止重复提交，并在失败时恢复编辑器输入。TUI 会在异步准备后根据状态选择 `agent.steer()` 或 `agent.followup()`，因此空闲 followup 仍会分派 `agent/prompt-submit`，而轮次中的 steering 会在检查点加入且不触发该 hook。
 
-Agent 运行时，普通编辑器提交会调用 `agent.steer()`；其他时候调用 `agent.followup()`。提交行以斜杠开头时会改为进入 `ctx.commands`：已知命令直接执行，未知命令产生警告，两条路径都不会自动到达模型。命令生产方可以显式调度 agent 工作；[`dsh-plan-mode`](../../plan/plan-mode/README.md#model-and-human-surfaces) 使用该契约实现 `/plan [message]`。TUI 将 `/help`、`/model`、`/clear`、`/reasoning`、`/tools`、`/redraw`、`/reload`、`/resume`、`/status` 和 `/exit` 注册为 agent 作用域定义；其他所有有效命令都会动态加入自动补全与 `/help`，`/skill:` 补全也相同。编辑器上方的状态行会报告 TUI 从会话事件派生的轮次阶段，包括等待首个 token、思考、响应或执行工具；它显示该阶段已经过时间和运行中的步骤总数，每秒刷新，并以 `Enter sends steering, Esc cancels` 提示结尾。Steering 消息等待到达模型期间，会在提示前插入 `N queued ·` 徽标，每条消息排空后随即清除。Ctrl+C 或 Escape 会取消运行中的轮次。工具卡片把长主体折叠为可配置的头尾预览；Ctrl+O 在预览与完整输出之间切换所有卡片。Ctrl+R 切换 reasoning，Ctrl+L 重绘，Ctrl+D 在空闲时退出。
+Agent 运行时，普通编辑器提交会调用 `agent.steer()`；其他时候调用 `agent.followup()`。提交行以斜杠开头时会改为进入 `ctx.commands`：已知命令直接执行，未知命令产生警告，两条路径都不会自动到达模型。命令生产方可以显式调度 agent 工作；[`dsh-plan-mode`](../../plan/plan-mode/README.md#model-and-human-surfaces) 使用该契约实现 `/plan [message]`。TUI 将 `/help`、`/model`、`/clear`、`/palette`、`/reload`、`/resume`、`/status` 和 `/exit` 注册为 agent 作用域定义；其他所有有效命令都会动态加入自动补全与 `/help`，`/skill:` 补全也相同。编辑器上方的状态行会报告 TUI 从会话事件派生的轮次阶段，包括等待首个 token、思考、响应或执行工具；它显示该阶段已经过时间和运行中的步骤总数，每秒刷新，并以 `Enter sends steering, Esc cancels` 提示结尾。Steering 消息等待到达模型期间，会在提示前插入 `N queued ·` 徽标，每条消息排空后随即清除。Ctrl+C 或 Escape 会取消运行中的轮次。工具卡片与注入上下文卡片都把长主体折叠为可配置的头尾预览；Ctrl+O 让工具卡片在折叠预览、完整输出、隐藏三种状态间循环——隐藏阶段把工具卡片从 transcript 中完全去掉，而上下文卡片保持预览，因为注入的指令不属于工具流量。注入上下文卡片把消息渲染为文本，并去掉生产方的外层提醒外框，因此折叠与去外框都不依赖载荷的语法。Ctrl+R 切换 reasoning，Ctrl+L 重绘，Ctrl+D 在空闲时退出。
 
-`/model` 将建议性的 `ctx.llm` catalog 打开为键盘选择器：Up/Down 移动，Shift+Tab 按显示顺序循环切换适配器为焦点模型公布的推理强度，Enter 选择模型和推理强度，Escape 关闭。适配器未公布默认推理强度时，循环还会包含 `provider default`，该项会清除显式选择；没有可选推理强度元数据的模型会忽略 Shift+Tab。选择器会原样呈现公布的推理强度列表（包括存在时的 `off`），不会合成、自动调整或在模型之间转移推理强度。`/model <model>` 仍可直接选择无歧义的模型 id，`/model <provider>/<model>` 则选择精确目标，并在存在时使用其适配器默认值。已配置目标或最新记录的请求 header 会初始化选择器；由于 catalog 仅提供建议，未列出的当前模型仍会显示。选择仅对本 TUI 会话有效。提示词组装会为一个步骤建立目标快照，替换 `{{provider}}` 和 `{{model}}`，并通过 `agent/request` 应用同一个提供方／模型／推理强度目标；因此组装期间的切换会从后续步骤开始生效。请求 header 会持久记录真正到达模型的目标，未使用的选择则只存在于进程本地。
+`/model` 将建议性的 `ctx.llm` catalog 打开为键盘选择器：列表上方设有一个过滤框，按对每行 `provider/model` 标签、模型名称和描述的大小写不敏感子串匹配来缩小行集，并在高亮行仍通过过滤时保持其选中状态；Up/Down 移动，Shift+Tab 按显示顺序循环切换适配器为焦点模型公布的推理强度，Enter 选择模型和推理强度，Escape 会先清除非空过滤内容，再次按下才关闭选择器。适配器未公布默认推理强度时，循环还会包含 `provider default`，该项会清除显式选择；没有可选推理强度元数据的模型会忽略 Shift+Tab。选择器会原样呈现公布的推理强度列表（包括存在时的 `off`），不会合成、自动调整或在模型之间转移推理强度。`/model <model>` 仍可直接选择无歧义的模型 id，`/model <provider>/<model>` 则选择精确目标，并在存在时使用其适配器默认值。已配置目标或最新记录的请求 header 会初始化选择器；由于 catalog 仅提供建议，未列出的当前模型仍会显示。选择仅对本 TUI 会话有效。提示词组装会为一个步骤建立目标快照，替换 `{{provider}}` 和 `{{model}}`，并通过 `agent/request` 应用同一个提供方／模型／推理强度目标；因此组装期间的切换会从后续步骤开始生效。请求 header 会持久记录真正到达模型的目标，未使用的选择则只存在于进程本地。
 
 `/reload`（实验性，仅开发环境）会重新读取所有基于文件的 loader 配置树，并把 diff 应用到运行中 app：它手动调用 HMR（热模块替换）watcher 的配置路径；上下文中必须有 cordis Loader，否则退化为警告。它只在 agent 空闲时运行，并拒绝 reload 进行期间的再次进入。模块源代码热重载仍由 watcher 持有。挂载 `skills` 服务后，`/skill:<name> [instructions]` 会把该 skill 的指令作为一个 user 轮次加载到会话中；自动补全列出模型可调用的 skill，任何 skill（包括模型禁用的 skill）都可通过精确名称加载。
 
@@ -32,9 +32,15 @@ Footer 将会话报告的用量汇总为 `↑<uncached input> ↓<output>`；任
 
 `/status` 会向 transcript 添加一张时间点诊断卡片，并在 agent 运行时保持可用。它报告会话 id、标题、工作目录、所选提供方／模型、所选推理强度或默认行为、reasoning 块可见性、agent 状态、事件／轮次／步骤／工具调用计数、精确输入／输出／缓存 token bucket、KV-cache 命中率、token-meter 上下文用量与容量、创建时间和最新事件时间。缺失标题、模型、缓存输入或上下文容量时会明确标记，而非推断。该卡片只存在于终端，不会重复紧凑 footer。
 
-`/resume` 会针对当前工作区打开全 viewport 键盘选择器，而非居中对话框。获得焦点的搜索字段紧跟搜索 glyph 开始，并发出 pi-tui 的 cursor marker，使终端 IME 组合保持锚定在字段内。候选项按最近记录的活动排序，可按日志支持的标题或会话 id 搜索；每行报告 current/live/persisted 状态、上一轮次结果、近期提供方／模型，以及存在时的持久目标阶段。Up/Down 与 Page Up/Page Down 导航，Enter 恢复，Escape 会先清除非空搜索，再次按下才取消，Ctrl+C 则直接取消。当前会话、已在本运行时中活跃的会话、不可读日志、cwd 不匹配或日志所记提供方没有当前适配器的会话仍会显示，但不可选择。选择时会重复这些检查，并要求当前 agent 空闲，随后 flush 当前会话。TUI 接着停止终端 UI，并调用由宿主持有的可选 `TuiRuntime.handoffResume`；存在 `process.execve` 时，发布的 `dsh` 宿主会对 app 执行 dispose（资源释放）并替换自身进程。恢复操作保留相同的 `SessionId`、transcript、标题、todo 和持久目标；目标激活仍保持解除，TUI 会要求用户确认或执行 `/goal resume`。
+`/resume` 会打开全 viewport 键盘选择器，而非居中对话框。两个作用域覆盖同一候选项集合：打开时所处的当前工作区，以及按 Tab 切换到的所有工作区。搜索字段下方的作用域行会给出当前作用域的名称以及另一个作用域包含的数量，且在所有工作区作用域中每行还会报告自身所属的工作区。切换会清除搜索与选择，使高亮行始终属于可见列表。
 
-`resumeCommand` 仍是部署持有的回退行为：只有当前会话已持久化后，退出才会打印它；不支持原地 handoff 的宿主会显示所选会话的命令。`{session}` 展开为会话 id。TUI 代码绝不会执行模板或任意 shell 文本。
+获得焦点的搜索字段紧跟搜索 glyph 开始，并发出 pi-tui 的 cursor marker，使终端 IME 组合保持锚定在字段内。候选项按最近记录的活动排序，可按日志支持的标题或会话 id 搜索，在所有工作区作用域中还可按工作区标签搜索；每行报告 current/live/persisted 状态、上一轮次结果、近期提供方／模型，以及存在时的持久目标阶段。Up/Down 与 Page Up/Page Down 导航，Enter 恢复，Escape 会先清除非空搜索，再次按下才取消，Ctrl+C 则直接取消。当前会话、已在本运行时中活跃的会话、不可读日志、没有可运行的已记录工作区的会话，或日志所记提供方没有当前适配器的会话仍会显示，但不可选择；不同于当前工作区的工作区属于作用域而非禁用原因，因为恢复会进入该目录。
+
+选择时会重复这些检查，并要求当前 agent 空闲，随后 flush 当前会话。TUI 接着停止终端 UI，并以所选 id 和在预检时重新读取的工作区调用由宿主持有的可选 `TuiRuntime.handoffResume`：文件系统与 shell 工具解析所依据的是进程 cwd，而非恢复出的会话头部，因此宿主必须进入该目录。存在 `process.execve` 时，发布的 `dsh` 宿主会先 chdir 进入该目录，再对 app 执行 dispose 并替换自身进程，并在终端仍可恢复时拒绝不可达的目录。恢复操作保留相同的 `SessionId`、transcript、标题、todo 和持久目标；目标激活仍保持解除，TUI 会要求用户确认或执行 `/goal resume`。
+
+退出时打印的行由启动器拥有，不可通过配置指定。启动器在启动上下文上提供 `TUI_GOODBYE_MESSAGE_KEY`（对于随附的 `dsh`，即恢复本会话的命令），释放终端后退出会原样打印它；未提供时退出不打印任何内容。只有启动器知道自己是如何被调用的，因此只有它能给出可用的命令。TUI 在渲染前会转义终端控制字符，且绝不执行该文本。若启动器同时提供 `MAIN_SESSION_ID_KEY`，则会固定已挂载应用绑定的会话，因此恢复功能不受配置层修补影响。
+
+启动器可通过在启动上下文上提供 `INITIAL_SKILL_KEY`（skill 名称）来播种全新会话的首轮；聊天就绪后，TUI 会像用户手动键入 `/skill:<name>` 一样自动调用它。随附的 `dsh migrate`/`dsh upgrade` 会设置该键，且仅对全新会话设置，因此恢复的会话绝不会重复调用该 skill；未知名称会以通知形式报告。
 
 ## 配置
 
@@ -57,7 +63,6 @@ Footer 将会话报告的用量汇总为 `↑<uncached input> ↓<output>`；任
 | `showHardwareCursor` | `false` | 在 pi-tui 的 IME marker 处显示硬件 cursor |
 | `color` | `true` | 应用内置 ANSI palette（参见[颜色](#color)） |
 | `title` | `DeepSeek Harness` | 终端窗口标题的产品后缀。 |
-| `resumeCommand` | 未设置 | 供退出提示和不支持原地 handoff 的宿主使用的 shell 命令模板，其中 `{session}` 会展开为会话 id |
 
 ```yaml
 - id: terminal
@@ -70,11 +75,15 @@ Footer 将会话报告的用量汇总为 `↑<uncached input> ↓<output>`；任
     fileSearchExcludedDirectories: ['.git', 'node_modules', 'dist']
 ```
 
-任一进程流不是 TTY 时，启动会在挂载前失败。组合 app 必须先挂载 TUI，再挂载由配置创建的 agent，使入口能够观察 `agent-loop/config-start-failed`；完全匹配会话的失败会在全屏模式启动前写出并以状态 1 退出，而不是留下空白终端。dispose 会停止接收扩展请求，卸载 `ctx.tui` 提供方及其依赖插件，中止运行中的命令，移除 TUI 定义，停止 loader，拒绝待处理问题，排空终端输入，恢复终端状态，注销事件 listener 和用户交互提供方，并且绝不会在 HMR 期间退出替换进程。
+任一进程流不是 TTY 时，启动会在挂载前失败。组合 app 必须先挂载 TUI，再挂载由配置创建的 agent，使入口能够观察 `agent-loop/config-start-failed`；完全匹配会话的失败会在全屏模式启动前写出并以状态 1 退出，而不是留下空白终端。dispose（资源释放）会停止接收扩展请求，卸载 `ctx.tui` 提供方及其依赖插件，中止运行中的命令，移除 TUI 定义，停止 loader，拒绝待处理问题，排空终端输入，恢复终端状态，注销事件 listener 和用户交互提供方，并且绝不会在 HMR 期间退出替换进程。
 
 ## 颜色
 
-Palette 使用标准 16 色 ANSI 前景色和 SGR 属性，每个终端都会将其重新映射到当前配色方案，因此浅色与深色背景下都保持可读。正文使用终端默认前景色，而非固定色调。成组区域（用户提示词、assistant 回复、工具卡片）通过以角色色渲染的粗体带下划线角色标题和空行分隔，而非填充背景块或逐行前缀，因此用鼠标框选复制时不会带上任何左侧竖条或缩进；工具卡片的状态（进行中、错误、成功）由其彩色带下划线的标题字形与标题体现。问题面板使用粗体强调色文本突出活跃行，选择器则使用反色。所有效果都只作用于前景色，因此不会与终端背景冲突。设置 `color: false` 可移除所有样式。
+TUI 发出的所有 SGR 代码都集中在一个表中，即 `components/theme.ts` 内的 `paletteSpec`；`createPalette` 从该表派生包装层，`/palette` 则打印该表，任何组件都不会自行写入转义序列。该表仅包含标准 16 色 ANSI 前景色和 SGR 属性；每个终端都会将它们重新映射到当前配色方案，因此 TUI 在浅色与深色背景下都保持可读——启动 banner 的品牌渐变是唯一一个有意保留的例外。正文使用终端默认前景色，而非固定色调。
+
+每种视觉语义只对应一个角色：`dim` 是唯一的弱化色调，`accent` 是唯一的强调色，`success` 和 `error` 还分别充当 diff 的新增行与删除行。颜色和属性分属不同类型，因此 `bold(accent(x))` 可以通过编译，`accent(error(x))` 则不行——SGR 没有颜色栈；在一种颜色内嵌套另一种颜色时，内层颜色闭合时会静默丢弃外层颜色。各属性占用彼此独立的 SGR 组，可以按任一顺序与任何颜色组合。运行 `/palette` 可查看每个角色在你的终端上的实际渲染效果及其 SGR 码对。
+
+成组区域（用户提示词、assistant 回复、工具卡片）通过以角色色渲染的粗体带下划线角色标题和空行分隔，而非填充背景块或逐行前缀，因此用鼠标框选复制时不会带上任何左侧竖条或缩进；工具卡片的状态（进行中、错误、成功）由其彩色带下划线的标题字形与标题体现。在工具卡片内部，整个正文——presenter 标题、终端 `$` 命令与 cwd，以及工具自身的输出——统一以同一种暗色渲染，因此只有带状态色的表头携带颜色，正文读作一个整体弱化的区块，而不是一串互相竞争的色调；注入上下文卡片的正文与其表头也是同一种色调。diff 卡片的 `+`/`-` 行与 `[signal …]` 标记保留颜色，因为那里的颜色本身就是语义，而非强调。问题面板使用粗体强调色文本突出活跃行，选择器则使用反色。所有效果都只作用于前景色，因此不会与终端背景冲突。设置 `color: false` 可移除所有样式。
 
 ## 模型体验
 
@@ -156,7 +165,7 @@ Paths prefixed with @ are files explicitly referenced by the user. Use the read
 
 ## 已知限制与延期工作
 
-- **恢复功能没有跨进程会话锁**：选择器会拒绝本运行时中已知处于活跃状态的会话，但另一个进程可以在 handoff 之前或期间恢复同一持久 id。能够运行并发宿主的部署必须在 TUI 外协调所有权。
+- **恢复功能没有跨进程会话锁**：选择器会拒绝本运行时中已知处于活跃状态的会话，但另一个进程可以在 handoff 之前或期间恢复同一持久 id。所有工作区作用域让这一情形一步即可触及，因为另一个宿主正在其他目录驱动的会话现在也可被选中。能够运行并发宿主的部署必须在 TUI 外协调所有权。
 - **一个已配置会话持有 transcript 和编辑器**：其他 agent 的问题仍可使用共享 overlay 提供方，但会话渲染与提示词输入仍绑定到 `sessionId`。
 - **工具卡片是文本终端展示**：终端、diff 与通用卡片使用工具持有的标题／内容，但会话内容目前没有用于内联图像渲染的图像块。
 - **有意不支持非 TTY 运行**：需要自动化的 app bundle 必须组合单次执行或服务器入口（`dsh-cli-demo`、`dsh-acp`），而不能依赖内部回退。
diff --git a/packages/ui/tui/src/chat/resume.ts b/packages/ui/tui/src/chat/resume.ts
index 2f0fdd423c..9521bd7368 100644
--- a/packages/ui/tui/src/chat/resume.ts
+++ b/packages/ui/tui/src/chat/resume.ts
@@ -1,26 +1,23 @@
 /**
  * Session-resume sub-controller for the interactive chat channel: the
  * `/resume` selector, per-candidate summary reads that tolerate a corrupt
- * neighbor, the pre-handoff preflight, the terminal handoff itself, and the
- * durable resume-hint command printed on exit.
+ * neighbor, the pre-handoff preflight, and the terminal handoff itself.
  * @module @deepseek-ai/dsh-tui/chat/resume
  */
 
 import type { TUI } from '@earendil-works/pi-tui'
 import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
 import { errorChain } from '@deepseek-ai/dsh-llm'
-import { SessionId, type SessionHeader } from '@deepseek-ai/dsh-session'
+import type { SessionId } from '@deepseek-ai/dsh-session'
 import type {
   SessionLogSnapshot,
   SessionQueryService,
   SessionRecord,
 } from '@deepseek-ai/dsh-session-query'
-import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 import type { HintEditor } from './helpers.ts'
 import { formatCwd } from './helpers.ts'
 import type { TuiOverlaySession } from '../extension/types.ts'
 import type { TuiRuntime } from '../runtime.ts'
-import type { Config } from '../config.ts'
 import {
   ResumePicker,
   summarizeResumeCandidate,
@@ -31,9 +28,7 @@ import type { ChannelNotice, ChatChannelDeps } from './channel.ts'
 /** Collaborators the resume controller needs from the chat channel. */
 export interface ResumeControllerDeps extends ChatChannelDeps, ChannelNotice {
   readonly agent: Agent
-  readonly config: Config
   readonly runtime: TuiRuntime
-  readonly persistence: SessionPersistence | undefined
   readonly sessionQuery: SessionQueryService | undefined
   readonly ui: TUI
   readonly editor: HintEditor
@@ -43,47 +38,27 @@ export interface ResumeControllerDeps extends ChatChannelDeps, ChannelNotice {
 
 /** Session-resume controller for one chat channel. */
 export interface ResumeController {
-  /** Open the current-workspace searchable session selector. */
+  /** Open the searchable session selector, scoped to this workspace until the user widens it. */
   showResume(): void
-  /**
-   * The resume command for the current session — the configured template with
-   * every `{session}` filled — but only once the session is durably persisted;
-   * `undefined` otherwise.
-   */
-  currentResumeCommand(): Promise<string | undefined>
 }
 
 /**
  * Build the session-resume controller for one chat channel.
  * @param deps - channel collaborators, terminal handles, and optional services.
- * @returns the controller wired to the `/resume` command and exit hint.
+ * @returns the controller wired to the `/resume` command.
  */
 export function createResumeController(deps: ResumeControllerDeps): ResumeController {
   const {
-    ctx, agent, config, runtime, resolved, palette, overlayManager,
-    persistence, sessionQuery, ui, editor,
+    ctx, agent, runtime, resolved, palette, overlayManager,
+    sessionQuery, ui, editor,
   } = deps
   let resumeOverlay: TuiOverlaySession | undefined
   let resumeInFlight = false
   let resumeScan = 0
 
-  /**
-   * Persisted sessions for this workspace, newest first. Empty when no
-   * persistence backend is mounted or a listing failure would otherwise block
-   * exit or crash `/resume`; the resume hint is best-effort convenience.
-   */
-  const listWorkspaceSessions = async (): Promise<SessionHeader[]> => {
-    if (persistence === undefined) return []
-    let all: readonly SessionHeader[]
-    try {
-      all = await persistence.list()
-    } catch {
-      // A listing failure must never block terminal exit or crash `/resume`.
-      return []
-    }
-    return all
-      .filter(header => header.cwd === agent.session.header.cwd)
-  }
+  /** Label any session's own workspace the way the prompt labels the current one. */
+  const workspaceLabel = (cwd: string | undefined): string =>
+    runtime.formatCwd?.(cwd) ?? formatCwd(cwd)
 
   /** Build one display candidate without letting a corrupt neighbor abort the selector. */
   const readResumeCandidate = async (
@@ -109,6 +84,7 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
         agent.session.id,
         agent.session.header.cwd,
         providers,
+        workspaceLabel,
       )
     } catch (error: unknown) {
       return {
@@ -116,13 +92,18 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
         title: 'Unreadable session',
         lastActivityAt: record.header.createdAt,
         lastTurn: 'log unavailable',
+        currentWorkspace: record.header.cwd === agent.session.header.cwd,
+        workspaceLabel: workspaceLabel(record.header.cwd),
         disabledReason: `session cannot be loaded: ${errorChain(error)}`,
       }
     }
   }
 
-  /** Re-read every mutable precondition immediately before terminal handoff. */
-  const preflightResume = async (sessionId: SessionId): Promise<ResumeCandidate> => {
+  /**
+   * Re-read every mutable precondition immediately before terminal handoff and
+   * resolve the exact identity and workspace the host will re-exec into.
+   */
+  const preflightResume = async (sessionId: SessionId): Promise<{ id: SessionId; cwd: string }> => {
     /* v8 ignore next -- only showResume can call this closure, after proving the optional service exists */
     if (sessionQuery === undefined) throw new Error('Resume is unavailable: session query is not mounted.')
     const initialStatus = deps.agentStatus()
@@ -134,9 +115,12 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
       new Set(ctx.llm.listProviders().map(provider => provider.id)),
     )
     if (candidate.disabledReason !== undefined) throw new Error(candidate.disabledReason)
+    const cwd = candidate.record.header.cwd
+    /* v8 ignore next -- summarizeResumeCandidate disables a cwd-less record, so the check above already rejected it */
+    if (cwd === undefined) throw new Error(`Session "${sessionId}" has no recorded workspace to resume in.`)
     const finalStatus = deps.agentStatus()
     if (finalStatus !== 'idle') throw new Error(`Resume requires an idle agent (status: ${finalStatus}).`)
-    return candidate
+    return { id: candidate.record.header.id, cwd }
   }
 
   const handoffResume = async (candidate: ResumeCandidate, overlay: TuiOverlaySession): Promise<void> => {
@@ -147,13 +131,9 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
       const checked = await preflightResume(candidate.record.header.id)
       const hostHandoff = runtime.handoffResume
       if (hostHandoff === undefined) {
-        const template = config.resumeCommand
-        const fallback = template?.replaceAll('{session}', checked.record.header.id)
         await overlay.close()
         resumeOverlay = undefined
-        deps.appendNotice(fallback === undefined
-          ? 'Session is resumable, but this host cannot hand it off in place.'
-          : `This host cannot hand off in place. Exit and run: ${fallback}`, 'warning')
+        deps.appendNotice('Session is resumable, but this host cannot hand it off in place.', 'warning')
         return
       }
       /* v8 ignore next -- shutdown during preflight invalidates an awaited service read or reaches this guard */
@@ -169,7 +149,10 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
       if (deps.isDisposed()) return
       ui.stop()
       terminalReleased = true
-      await hostHandoff(checked.record.header.id)
+      // The host re-execs into the session's own workspace: process cwd, not the
+      // restored session header, is what the filesystem and shell tools resolve
+      // against.
+      await hostHandoff(checked.id, checked.cwd)
       throw new Error('resume host returned without replacing the process')
     } catch (error: unknown) {
       if (!deps.isDisposed()) {
@@ -189,12 +172,6 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
   }
 
   return {
-    currentResumeCommand: async (): Promise<string | undefined> => {
-      if (config.resumeCommand === undefined) return undefined
-      const sessions = await listWorkspaceSessions()
-      if (!sessions.some(header => header.id === agent.session.id)) return undefined
-      return config.resumeCommand.replaceAll('{session}', agent.session.id)
-    },
     showResume(): void {
       if (agent.status !== 'idle') {
         deps.appendNotice('Resume requires the current turn to finish or be cancelled first.', 'warning')
@@ -208,9 +185,10 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
       void resumeOverlay?.close()
       void sessionQuery.listSessions().then(async (records) => {
         if (deps.isDisposed() || scan !== resumeScan) return
-        const workspace = records.filter(record => record.header.cwd === agent.session.header.cwd)
+        // Every workspace in the store is summarized; the picker owns the
+        // current-workspace/all-workspaces scope split over the whole set.
         const providers = new Set(ctx.llm.listProviders().map(provider => provider.id))
-        const candidates = await Promise.all(workspace.map(record => readResumeCandidate(record, providers)))
+        const candidates = await Promise.all(records.map(record => readResumeCandidate(record, providers)))
         candidates.sort((a, b) => b.lastActivityAt - a.lastActivityAt
           || a.record.header.id.localeCompare(b.record.header.id))
         if (deps.isDisposed() || scan !== resumeScan) return
@@ -218,7 +196,7 @@ export function createResumeController(deps: ResumeControllerDeps): ResumeContro
           create: host => new ResumePicker(
             candidates,
             resolved.maxResumeOptions,
-            runtime.formatCwd?.(agent.session.header.cwd) ?? formatCwd(agent.session.header.cwd),
+            workspaceLabel(agent.session.header.cwd),
             () => host.viewport.rows,
             palette,
             (candidate) => { void handoffResume(candidate, session) },
diff --git a/packages/ui/tui/src/chat/timing.ts b/packages/ui/tui/src/chat/timing.ts
index 13477adfa0..0aff3bc736 100644
--- a/packages/ui/tui/src/chat/timing.ts
+++ b/packages/ui/tui/src/chat/timing.ts
@@ -290,7 +290,7 @@ export function fadeGlyph(
     return `\x1b[38;2;${r};${g};${b}m${glyph}\x1b[39m`
   }
   if (!visible) return ' '
-  return colorEnabled ? palette.muted(glyph) : glyph
+  return colorEnabled ? palette.dim(glyph) : glyph
 }
 
 /**
diff --git a/packages/ui/tui/src/components/dialogs.ts b/packages/ui/tui/src/components/dialogs.ts
index 370be088b1..5e9237574a 100644
--- a/packages/ui/tui/src/components/dialogs.ts
+++ b/packages/ui/tui/src/components/dialogs.ts
@@ -205,7 +205,7 @@ export class StatusCardComponent implements Component {
       if (groupIndex > 0) body.push('')
       for (const [label, value] of group) {
         const plainLabel = truncateToWidth(`${label}:`, labelWidth, '')
-        const prefix = ` ${this.palette.muted(plainLabel.padEnd(labelWidth))}  `
+        const prefix = ` ${this.palette.dim(plainLabel.padEnd(labelWidth))}  `
         const continuation = ' '.repeat(1 + labelWidth + 2)
         const valueWidth = Math.max(1, innerWidth - visibleWidth(prefix))
         const wrapped = wrapTextWithAnsi(value, valueWidth)
@@ -281,9 +281,10 @@ export function renderDialog(
   return lines
 }
 
-/** Keyboard model selector rendered as a bordered overlay, with per-model reasoning-effort cycling. */
+/** Keyboard model selector rendered as a bordered overlay, with a filter box and per-model reasoning-effort cycling. */
 export class ModelDialog implements Component {
-  private readonly list: SelectList
+  private list: SelectList
+  private readonly filter = new Input()
   private readonly items: Map<string, SelectItem>
   private readonly choices: Map<string, ModelChoice>
   private readonly efforts: Map<string, ReasoningEffortId | undefined>
@@ -292,10 +293,10 @@ export class ModelDialog implements Component {
   constructor(
     choices: readonly ModelChoice[],
     current: AgentLlmTarget | undefined,
-    maxVisible: number,
+    private readonly maxVisible: number,
     private readonly palette: Palette,
-    done: (selection: ModelDialogSelection) => void,
-    cancel: () => void,
+    private readonly done: (selection: ModelDialogSelection) => void,
+    private readonly cancel: () => void,
   ) {
     this.items = new Map()
     this.choices = new Map()
@@ -317,18 +318,38 @@ export class ModelDialog implements Component {
         description: this.describeChoice(choice, isCurrent),
       })
     }
-    this.list = new SelectList([...this.items.values()], maxVisible, dialogSelectTheme(palette))
-    const currentIndex = current === undefined
-      ? 0
-      : choices.findIndex(choice => choice.provider === current.provider && choice.model === current.model)
-    this.list.setSelectedIndex(currentIndex)
-    this.list.onSelect = (item) => {
-      const selected = choices.find(choice => targetLabel(choice) === item.value)
-      /* v8 ignore next -- SelectList only returns values built from `choices`. */
-      if (selected === undefined) return
-      done({ choice: selected, reasoningEffort: this.efforts.get(item.value) })
-    }
-    this.list.onCancel = cancel
+    this.list = this.buildList(this.currentValue)
+  }
+
+  /** Build a SelectList over the currently filtered items, selecting `selectValue` when present. */
+  private buildList(selectValue: string | undefined): SelectList {
+    const items = this.filteredItems()
+    const list = new SelectList(items, this.maxVisible, dialogSelectTheme(this.palette))
+    const index = selectValue === undefined ? 0 : items.findIndex(item => item.value === selectValue)
+    list.setSelectedIndex(Math.max(0, index))
+    list.onSelect = (item) => { this.confirm(item) }
+    list.onCancel = this.cancel
+    return list
+  }
+
+  /** Items matching the filter box, as a case-insensitive substring over the label, model name, and description. */
+  private filteredItems(): SelectItem[] {
+    const query = this.filter.getValue().trim().toLocaleLowerCase()
+    if (query === '') return [...this.items.values()]
+    return [...this.items.values()].filter((item) => {
+      const choice = this.choices.get(item.value)
+      /* v8 ignore next -- items and choices share the same keys. */
+      if (choice === undefined) return false
+      return [item.value, choice.modelName, choice.description ?? '']
+        .some(field => field.toLocaleLowerCase().includes(query))
+    })
+  }
+
+  private confirm(item: SelectItem): void {
+    const selected = this.choices.get(item.value)
+    /* v8 ignore next -- SelectList only returns values built from `choices`. */
+    if (selected === undefined) return
+    this.done({ choice: selected, reasoningEffort: this.efforts.get(item.value) })
   }
 
   private describeChoice(choice: ModelChoice, isCurrent: boolean): string {
@@ -362,24 +383,50 @@ export class ModelDialog implements Component {
   }
 
   invalidate(): void {
+    this.filter.invalidate()
     this.list.invalidate()
   }
 
   handleInput(data: string): void {
     if (matchesKey(data, Key.shift(Key.tab))) {
       this.cycleReasoningEffort()
-    } else {
+    } else if (matchesKey(data, Key.escape)) {
+      if (this.filter.getValue() === '') this.cancel()
+      else {
+        this.filter.setValue('')
+        this.list = this.buildList(undefined)
+      }
+    } else if (
+      matchesKey(data, Key.up)
+      || matchesKey(data, Key.down)
+      || matchesKey(data, Key.enter)
+    ) {
       this.list.handleInput(data)
+    } else {
+      const previous = this.filter.getValue()
+      this.filter.focused = true
+      this.filter.handleInput(data)
+      if (this.filter.getValue() !== previous) {
+        const selected = this.list.getSelectedItem()
+        this.list = this.buildList(selected?.value)
+      }
     }
     this.invalidate()
   }
 
   render(width: number): string[] {
     const innerWidth = Math.max(1, width - 4)
+    this.filter.focused = true
+    const results = this.filteredItems()
+    const filterContent = truncateToWidth(this.filter.render(innerWidth).join(''), innerWidth, '')
     return renderDialog('Select model', [
-      ...this.list.render(innerWidth),
+      filterContent,
       '',
-      this.palette.dim('↑/↓ navigate • Shift+Tab reasoning • Enter select • Esc cancel'),
+      ...results.length === 0
+        ? [this.palette.dim('  No models match the filter')]
+        : this.list.render(innerWidth),
+      '',
+      this.palette.dim('type to filter • ↑/↓ move • Shift+Tab reasoning • Enter select • Esc'),
     ], width, this.palette)
   }
 }
@@ -396,6 +443,10 @@ export interface ResumeCandidate {
   title: string
   lastActivityAt: number
   lastTurn: string
+  /** Whether the session's workspace is the one the current session runs in, which selects the picker scope that lists it. */
+  currentWorkspace: boolean
+  /** The session's own workspace as a prompt-style label; the all-workspaces scope shows it per row. */
+  workspaceLabel: string
   route?: ResumeRoute
   goalPhase?: GoalPhase
   disabledReason?: string
@@ -429,12 +480,15 @@ function resumeRoute(snapshot: SessionLogSnapshot): ResumeRoute | undefined {
 
 /**
  * Build one resume selector row from a record and its log snapshot, deriving the
- * title, route, goal phase, and any reason the session cannot be resumed here.
+ * title, route, goal phase, workspace scope, and any reason the session cannot
+ * be resumed here. A workspace other than the current one is a scope, not a
+ * disabled reason: resuming it hands the process off into that directory.
  * @param record - The session record.
  * @param snapshot - The session's log snapshot.
  * @param currentId - The current session id.
- * @param cwd - The current workspace directory.
+ * @param cwd - The CURRENT session's workspace, which decides the picker scope this row falls in.
  * @param availableProviders - Providers registered in this runtime.
+ * @param formatWorkspace - Renders THIS record's own cwd as its prompt-style label.
  * @returns The summarized resume candidate.
  */
 export function summarizeResumeCandidate(
@@ -443,6 +497,7 @@ export function summarizeResumeCandidate(
   currentId: SessionId,
   cwd: string | undefined,
   availableProviders: ReadonlySet<string>,
+  formatWorkspace: (cwd: string | undefined) => string,
 ): ResumeCandidate {
   const title = foldSessionTitle(snapshot.events)?.title ?? 'Untitled session'
   const route = resumeRoute(snapshot)
@@ -450,7 +505,7 @@ export function summarizeResumeCandidate(
   let disabledReason: string | undefined
   if (record.header.id === currentId) disabledReason = 'current session'
   else if (record.live) disabledReason = 'session is already live in this runtime'
-  else if (record.header.cwd !== cwd) disabledReason = 'different workspace'
+  else if (record.header.cwd === undefined) disabledReason = 'session has no recorded workspace'
   else if (route !== undefined && !availableProviders.has(route.provider)) {
     disabledReason = `session is complete, but route is currently unavailable (${route.provider}/${route.model})`
   }
@@ -459,6 +514,8 @@ export function summarizeResumeCandidate(
     title,
     lastActivityAt: snapshot.events.at(-1)?.time ?? snapshot.session.createdAt,
     lastTurn: resumeTurnLabel(snapshot),
+    currentWorkspace: record.header.cwd === cwd,
+    workspaceLabel: formatWorkspace(record.header.cwd),
     ...route === undefined ? {} : { route },
     /* v8 ignore next -- goal-bearing resume records are covered by the goal/session integration surface. */
     ...foldedGoal === undefined ? {} : { goalPhase: foldedGoal.phase },
@@ -466,12 +523,23 @@ export function summarizeResumeCandidate(
   }
 }
 
-/** Full-viewport keyboard selector over detached, preflighted resume summaries. */
+/** Which workspaces the resume picker currently lists. */
+export type ResumeScope = 'workspace' | 'all'
+
+/**
+ * Full-viewport keyboard selector over detached, preflighted resume summaries.
+ *
+ * Two scopes over one candidate set: `workspace` (the default) lists only the
+ * current session's workspace, `all` lists every workspace and labels each row
+ * with its own. Tab toggles between them; the search query and selection reset
+ * on a scope change so the highlighted row always belongs to the visible list.
+ */
 export class ResumePicker implements Component, Focusable {
   private readonly search = new Input()
   private pasteBuffer: string | undefined
   private selectedIndex = 0
   private error = ''
+  private scope: ResumeScope = 'workspace'
   focused = false
 
   constructor(
@@ -488,15 +556,29 @@ export class ResumePicker implements Component, Focusable {
     this.search.invalidate()
   }
 
+  /** Candidates in the active scope, before the search query narrows them. */
+  private scoped(): ResumeCandidate[] {
+    return this.scope === 'all'
+      ? [...this.candidates]
+      : this.candidates.filter(candidate => candidate.currentWorkspace)
+  }
+
   private filtered(): ResumeCandidate[] {
     const query = this.search.getValue().trim().toLocaleLowerCase()
-    if (query === '') return [...this.candidates]
-    return this.candidates.filter(candidate => candidate.title.toLocaleLowerCase().includes(query)
-      || candidate.record.header.id.toLocaleLowerCase().includes(query))
+    const scoped = this.scoped()
+    if (query === '') return scoped
+    // The workspace label only distinguishes rows once it is on screen, so it
+    // joins the searchable text exactly in the scope that shows it.
+    return scoped.filter(candidate => candidate.title.toLocaleLowerCase().includes(query)
+      || candidate.record.header.id.toLocaleLowerCase().includes(query)
+      || (this.scope === 'all' && candidate.workspaceLabel.toLocaleLowerCase().includes(query)))
   }
 
   private visibleCandidateCount(): number {
-    const candidateBudget = Math.max(1, Math.floor((Math.max(1, this.viewportRows()) - 13) / 4))
+    // The all-workspaces scope adds a per-row workspace line, so a row costs
+    // one more terminal row there than in the single-workspace scope.
+    const rowHeight = this.scope === 'all' ? 5 : 4
+    const candidateBudget = Math.max(1, Math.floor((Math.max(1, this.viewportRows()) - 13) / rowHeight))
     return Math.min(this.maxVisible, candidateBudget)
   }
 
@@ -553,6 +635,11 @@ export class ResumePicker implements Component, Focusable {
         Math.max(0, filtered.length - 1),
         this.selectedIndex + this.visibleCandidateCount(),
       )
+    } else if (matchesKey(data, Key.tab)) {
+      this.scope = this.scope === 'workspace' ? 'all' : 'workspace'
+      this.search.setValue('')
+      this.selectedIndex = 0
+      this.error = ''
     } else if (matchesKey(data, Key.enter)) {
       const selected = filtered[this.selectedIndex]
       if (selected === undefined) this.error = 'No session matches this search.'
@@ -570,6 +657,21 @@ export class ResumePicker implements Component, Focusable {
     this.invalidate()
   }
 
+  /**
+   * The scope line under the search box: the active scope with the current
+   * workspace it means, and the inactive scope with the count Tab would reveal.
+   */
+  private renderScopeLine(): string {
+    const inWorkspace = this.candidates.filter(candidate => candidate.currentWorkspace).length
+    const active = this.scope === 'workspace'
+      ? `this workspace ${displayText(this.workspaceLabel)}`
+      : `all workspaces (${this.candidates.length})`
+    const other = this.scope === 'workspace'
+      ? `all workspaces (${this.candidates.length})`
+      : `this workspace (${inWorkspace})`
+    return `${this.palette.accent(active)}${this.palette.dim(`  ⇥ ${other}`)}`
+  }
+
   render(width: number): string[] {
     this.search.focused = this.focused
     const height = Math.max(1, this.viewportRows())
@@ -594,7 +696,7 @@ export class ResumePicker implements Component, Focusable {
       `${indent}${this.palette.dim('│')} ${clippedSearch}${' '.repeat(Math.max(0, searchInnerWidth - visibleWidth(clippedSearch)))} ${this.palette.dim('│')}`,
       `${indent}${this.palette.dim(`╰${'─'.repeat(Math.max(0, contentWidth - 2))}╯`)}`,
       '',
-      `${indent}${this.palette.muted(displayText(this.workspaceLabel))}`,
+      `${indent}${this.renderScopeLine()}`,
       '',
     )
 
@@ -620,8 +722,13 @@ export class ResumePicker implements Component, Focusable {
       const route = candidate.route === undefined ? 'route unavailable' : `${candidate.route.provider}/${candidate.route.model}`
       /* v8 ignore next -- only goal-bearing resume records add this integration-owned suffix. */
       const goal = candidate.goalPhase === undefined ? '' : ` · goal ${candidate.goalPhase}`
-      push(this.palette.muted(`  ${new Date(candidate.lastActivityAt).toISOString()} · ${candidate.lastTurn} · ${route}${goal}`))
+      push(this.palette.dim(`  ${new Date(candidate.lastActivityAt).toISOString()} · ${candidate.lastTurn} · ${route}${goal}`))
       push(this.palette.dim(`  ${status} · ${displayText(candidate.record.header.id)}`))
+      // Only the all-workspaces scope mixes directories, so the per-row
+      // workspace is redundant in the scope that already names one.
+      if (this.scope === 'all') {
+        push(this.palette.dim(`  workspace ${displayText(candidate.workspaceLabel)}`))
+      }
       if (candidate.disabledReason !== undefined) {
         push(this.palette.warning(`  unavailable: ${displayText(candidate.disabledReason)}`))
       }
@@ -632,7 +739,7 @@ export class ResumePicker implements Component, Focusable {
       push(this.palette.error(displayText(this.error)))
     }
 
-    const footer = `${indent}${this.palette.dim('Type to search  •  ↑/↓ navigate  •  Enter resume  •  Esc clear/cancel')}`
+    const footer = `${indent}${this.palette.dim('Type to search  •  ↑/↓ navigate  •  Tab scope  •  Enter resume  •  Esc clear/cancel')}`
     while (lines.length < height - 2) lines.push('')
     lines.push(footer, '')
     return lines.slice(0, height)
@@ -720,7 +827,7 @@ export class QuestionDialog implements Component, Focusable {
     const innerWidth = Math.max(1, width - 4)
     const header = `Question ${this.position}/${this.total} (${this.unanswered} unanswered)${this.question.header === undefined ? '' : ` · ${displayText(this.question.header)}`}`
     const lines = [
-      this.palette.muted(header),
+      this.palette.dim(header),
       ...wrapTextWithAnsi(this.palette.text(displayText(this.question.question)), innerWidth),
     ]
     const push = (line: string): void => { lines.push(line) }
@@ -764,7 +871,7 @@ export class QuestionDialog implements Component, Focusable {
           : left
         const description = option.description === undefined
           ? ''
-          : `${' '.repeat(Math.max(1, descriptionColumn - visibleWidth(left)))}${this.palette.muted(displayText(option.description))}`
+          : `${' '.repeat(Math.max(1, descriptionColumn - visibleWidth(left)))}${this.palette.dim(displayText(option.description))}`
         push(`${leftStyled}${description}`)
       }
       if (options.length > this.maxVisible) push(this.palette.dim(`${this.selectedIndex + 1}/${options.length}`))
diff --git a/packages/ui/tui/src/components/theme.ts b/packages/ui/tui/src/components/theme.ts
index 1ea75b437f..269a7c28e8 100644
--- a/packages/ui/tui/src/components/theme.ts
+++ b/packages/ui/tui/src/components/theme.ts
@@ -11,67 +11,149 @@ import type {
   TerminalColorScheme,
 } from '@earendil-works/pi-tui'
 
-/** Theme-agnostic role colors and SGR attribute wrappers. */
+/**
+ * Text carrying exactly one palette color. Branded so the compiler rejects
+ * wrapping it in a second color: SGR has no color stack, so an inner span's
+ * close reverts to the default foreground rather than the outer color, which
+ * silently drops the outer color for the remainder of the line.
+ */
+export type Colored = string & { readonly __coloredBy: unique symbol }
+
+/**
+ * Text a color may still be applied to: a bare string, or one already carrying
+ * SGR attributes. Attributes (bold, italic, underline, strike, reverse) occupy
+ * independent SGR groups from the foreground color, so they compose in either
+ * order without either side clobbering the other.
+ */
+export type Colorable = string & { readonly __coloredBy?: undefined }
+
+/** Applies one color role; rejects input that already carries a color. */
+export type ColorRole = (text: Colorable) => Colored
+
+/** Applies one SGR attribute; accepts colored or uncolored text and preserves its color. */
+export type AttributeRole = <T extends string>(text: T) => T
+
+/**
+ * Theme-agnostic role colors and SGR attribute wrappers.
+ *
+ * One role per visual meaning: `dim` is the single recessed tone, `accent` the
+ * single emphasis color, and `success`/`error` double as a diff's added/removed
+ * pair. Roles that resolved to the same escape were merged rather than kept as
+ * aliases, so a reader cannot pick a name that silently renders as another.
+ *
+ * Colors and attributes are separately typed: `bold(accent(x))` and
+ * `accent(bold(x))` both compile, while `accent(error(x))` does not.
+ */
 export interface Palette {
-  accent: (text: string) => string
-  accent2: (text: string) => string
-  text: (text: string) => string
-  muted: (text: string) => string
-  dim: (text: string) => string
-  success: (text: string) => string
-  warning: (text: string) => string
-  error: (text: string) => string
-  code: (text: string) => string
-  added: (text: string) => string
-  removed: (text: string) => string
-  bold: (text: string) => string
-  italic: (text: string) => string
-  underline: (text: string) => string
-  strike: (text: string) => string
+  accent: ColorRole
+  /** The terminal's own default foreground; still a color, so it does not stack. */
+  text: ColorRole
+  /** The one recessed tone, below `text`: tool-card bodies, chrome, reasoning, footers. */
+  dim: ColorRole
+  success: ColorRole
+  warning: ColorRole
+  error: ColorRole
+  code: ColorRole
+  bold: AttributeRole
+  italic: AttributeRole
+  underline: AttributeRole
+  strike: AttributeRole
   /** Reverse video for the active selection; swaps the theme's own fg/bg so it reads on any scheme. */
-  selected: (text: string) => string
+  selected: AttributeRole
 }
 
-function ansi(open: string, close: string, enabled: boolean): (text: string) => string {
-  return enabled ? text => `\x1b[${open}m${text}\x1b[${close}m` : text => text
+/** Names of the palette's color roles, in the order `/palette` prints them. */
+export const COLOR_ROLES = ['text', 'dim', 'accent', 'code', 'success', 'warning', 'error'] as const
+
+/** Names of the palette's attribute roles, in the order `/palette` prints them. */
+export const ATTRIBUTE_ROLES = ['bold', 'italic', 'underline', 'strike', 'selected'] as const
+
+/** One role's SGR parameters and the reason it carries them. */
+export interface RoleSpec {
+  /** SGR parameters that open the span, without the `ESC [` prefix or `m` suffix. */
+  readonly open: string
+  /** SGR parameters that close it; MUST reset every group `open` sets. */
+  readonly close: string
+  /** What the role means, shown by `/palette`. */
+  readonly purpose: string
 }
 
 /**
- * Theme-agnostic palette built from the standard 16-color ANSI set plus SGR
- * attributes, which every terminal remaps to its active color scheme. Body
- * `text` stays the terminal's default foreground so it reads on light and dark
- * backgrounds alike; grouping uses foreground-only bold, underlined role
- * headers and reverse video rather than fixed background fills or per-line
- * prefixes, so a transcript drag-select copies message text without stray
- * glyphs.
+ * Every SGR code the TUI is allowed to emit, keyed by role. This table is the
+ * single source: {@link createPalette} derives the wrappers from it and
+ * `/palette` prints it, so a role cannot exist in one and not the other, and no
+ * component hand-writes an escape.
+ *
+ * Only the standard 16-color set and SGR attributes appear here. Terminals remap
+ * those to the user's active theme, so the TUI stays legible on any background;
+ * a fixed 24-bit color would not. The brand gradient is the one deliberate
+ * exception ({@link gradientText}).
+ *
+ * @param scheme - Active terminal color scheme; only `code` differs between them.
+ * @returns The SGR spec for every color and attribute role.
+ */
+export function paletteSpec(scheme: TerminalColorScheme): {
+  readonly colors: Readonly<Record<typeof COLOR_ROLES[number], RoleSpec>>
+  readonly attributes: Readonly<Record<typeof ATTRIBUTE_ROLES[number], RoleSpec>>
+} {
+  return {
+    colors: {
+      // The terminal's own foreground, emitted as no escape at all: ordinary body
+      // text must inherit whatever the user's theme uses.
+      text: { open: '', close: '', purpose: 'Body text, the terminal default foreground' },
+      // SGR 2 over an explicit default foreground, closing both groups it sets.
+      // The attribute fades relative to whatever the terminal's own foreground is,
+      // which is the only way to land *below* `text` on both schemes: ANSI 90
+      // (bright black) is a fixed hue that many light themes render heavier than
+      // their default foreground, which made every "dim" surface the most
+      // prominent text on screen.
+      dim: { open: '2;39', close: '22;39', purpose: 'The one recessed tone: tool bodies, chrome, footers' },
+      accent: { open: '95', close: '39', purpose: 'The one emphasis color: role headers, prompt, borders' },
+      // ANSI 36 (cyan) is difficult to read on a light background — use ANSI 34
+      // (blue) which is legible on both light and dark schemes.
+      code: scheme === 'light'
+        ? { open: '34', close: '39', purpose: 'Inline code and code blocks in prose' }
+        : { open: '36', close: '39', purpose: 'Inline code and code blocks in prose' },
+      success: { open: '32', close: '39', purpose: 'Succeeded calls, and a diff\'s added lines' },
+      warning: { open: '33', close: '39', purpose: 'Pending calls and warnings' },
+      error: { open: '31', close: '39', purpose: 'Failures, signals, and a diff\'s removed lines' },
+    },
+    attributes: {
+      bold: { open: '1', close: '22', purpose: 'Emphasis; composes with any color' },
+      italic: { open: '3', close: '23', purpose: 'Reasoning text' },
+      underline: { open: '4', close: '24', purpose: 'Role-header banding' },
+      strike: { open: '9', close: '29', purpose: 'Struck-through Markdown' },
+      selected: { open: '7', close: '27', purpose: 'Reverse video for the active selection' },
+    },
+  }
+}
+
+/**
+ * Wrap text in an SGR pair, or pass it through when color is disabled.
+ * An empty `open` emits nothing, so the `text` role costs no escape.
+ */
+function ansi(spec: RoleSpec, enabled: boolean): (text: string) => string {
+  if (!enabled || spec.open === '') return text => text
+  return text => `\x1b[${spec.open}m${text}\x1b[${spec.close}m`
+}
+
+/**
+ * Theme-agnostic palette derived from {@link paletteSpec}. Body `text` stays the
+ * terminal's default foreground so it reads on light and dark backgrounds alike;
+ * grouping uses foreground-only bold, underlined role headers and reverse video
+ * rather than fixed background fills or per-line prefixes, so a transcript
+ * drag-select copies message text without stray glyphs.
  *
  * @param enabled - Whether ANSI is emitted at all.
- * @param scheme - Active terminal color scheme; adjusts dim and code roles.
+ * @param scheme - Active terminal color scheme; adjusts the code role.
  * @returns The role palette for the given scheme.
  */
 export function createPalette(enabled: boolean, scheme: TerminalColorScheme = 'dark'): Palette {
-  return {
-    accent: ansi('94', '39', enabled),
-    accent2: ansi('95', '39', enabled),
-    text: text => text,
-    muted: ansi('90', '39', enabled),
-    // SGR 2 (dim) lightens text on a light background — substitute ANSI 90
-    // (bright black / gray) which renders as a readable muted tone on any scheme.
-    dim: scheme === 'light' ? ansi('90', '39', enabled) : ansi('2', '22', enabled),
-    success: ansi('32', '39', enabled),
-    warning: ansi('33', '39', enabled),
-    error: ansi('31', '39', enabled),
-    // ANSI 36 (cyan) is difficult to read on a light background — use
-    // ANSI 34 (blue) which is legible on both light and dark schemes.
-    code: scheme === 'light' ? ansi('34', '39', enabled) : ansi('36', '39', enabled),
-    added: ansi('32', '39', enabled),
-    removed: ansi('31', '39', enabled),
-    bold: ansi('1', '22', enabled),
-    italic: ansi('3', '23', enabled),
-    underline: ansi('4', '24', enabled),
-    strike: ansi('9', '29', enabled),
-    selected: ansi('7', '27', enabled),
-  }
+  const spec = paletteSpec(scheme)
+  const roles = {} as Record<string, unknown>
+  for (const name of COLOR_ROLES) roles[name] = ansi(spec.colors[name], enabled)
+  for (const name of ATTRIBUTE_ROLES) roles[name] = ansi(spec.attributes[name], enabled)
+  return roles as unknown as Palette
 }
 
 /**
@@ -145,8 +227,8 @@ export function markdownTheme(palette: Palette): MarkdownTheme {
     // pi-tui presents both fence rows through this callback. Keep the opening
     // language label, but hide Markdown syntax and the otherwise-empty close.
     codeBlockBorder: text => palette.dim(text.slice(3)),
-    quote: text => palette.muted(text),
-    quoteBorder: text => palette.accent2(text),
+    quote: text => palette.dim(text),
+    quoteBorder: text => palette.accent(text),
     hr: text => palette.dim(text),
     listBullet: text => palette.accent(text),
     bold: text => palette.bold(text),
@@ -165,7 +247,7 @@ export function selectTheme(palette: Palette): SelectListTheme {
   return {
     selectedPrefix: palette.accent,
     selectedText: palette.accent,
-    description: palette.muted,
+    description: palette.dim,
     scrollInfo: palette.dim,
     noMatch: palette.warning,
   }
@@ -182,3 +264,49 @@ export function dialogSelectTheme(palette: Palette): SelectListTheme {
     selectedText: text => palette.selected(palette.accent(text)),
   }
 }
+
+/** Sample text every `/palette` row renders, long enough to judge a tone against its neighbours. */
+const PALETTE_SAMPLE = 'The quick brown fox 0123'
+
+/**
+ * Render every palette role as a labelled sample row, each painted by the role
+ * it names, so a reader compares the actual tones their terminal produces rather
+ * than reading SGR numbers. Colors print first and attributes second because the
+ * two groups compose in that order; every row shows its SGR pair so a mismatch
+ * between the table and the screen is visible.
+ *
+ * @param palette - Active role palette, used to paint each sample.
+ * @param scheme - Active color scheme, reported in the heading and selecting the spec.
+ * @param colorEnabled - Whether ANSI is emitted; reported so an unstyled listing is not confusing.
+ * @returns The rendered rows, without a trailing blank.
+ */
+export function renderPalette(
+  palette: Palette,
+  scheme: TerminalColorScheme,
+  colorEnabled: boolean,
+): string[] {
+  const spec = paletteSpec(scheme)
+  const width = Math.max(...[...COLOR_ROLES, ...ATTRIBUTE_ROLES].map(name => name.length))
+  // Two rows per role: the painted sample beside its name and SGR pair, then the
+  // purpose indented under it. Splitting the purpose onto its own row keeps every
+  // sample on one visual line at the narrow widths a side-by-side pane gives.
+  const head = (name: string, role: RoleSpec, sample: string): string => {
+    const pair = role.open === '' ? 'no escape' : `ESC[${role.open}m ESC[${role.close}m`
+    return `  ${sample}  ${palette.dim(`${name.padEnd(width)} ${pair}`)}`
+  }
+  const purpose = (role: RoleSpec): string => `  ${palette.dim(`    ${role.purpose}`)}`
+  const rows = [
+    palette.bold(palette.accent('Palette')),
+    palette.dim(`${scheme} scheme · color ${colorEnabled ? 'on' : 'off'}`),
+    '',
+    palette.dim('Colors — exactly one per span; they never nest inside each other.'),
+  ]
+  for (const name of COLOR_ROLES) {
+    rows.push(head(name, spec.colors[name], palette[name](PALETTE_SAMPLE)), purpose(spec.colors[name]))
+  }
+  rows.push('', palette.dim('Attributes — compose with any color, in either order.'))
+  for (const name of ATTRIBUTE_ROLES) {
+    rows.push(head(name, spec.attributes[name], palette[name](PALETTE_SAMPLE)), purpose(spec.attributes[name]))
+  }
+  return rows
+}
diff --git a/packages/ui/tui/src/components/transcript.ts b/packages/ui/tui/src/components/transcript.ts
index 1e79d94ce8..58d3d6a178 100644
--- a/packages/ui/tui/src/components/transcript.ts
+++ b/packages/ui/tui/src/components/transcript.ts
@@ -25,7 +25,7 @@ import type {
   ToolResultView,
 } from '@deepseek-ai/dsh-tools'
 import type { FileDiff } from '@deepseek-ai/dsh-tools'
-import { renderUnknownXml } from './xml-tool-output.ts'
+import { preview, renderUnknownXml } from './xml-tool-output.ts'
 import { displayInlineText, displayText } from './text.ts'
 import { gradientText, type Palette } from './theme.ts'
 import { contentText, type ParsedArguments } from './content.ts'
@@ -58,9 +58,9 @@ function diffLines(diff: FileDiff, palette: Palette): string[] {
   // each hunk always carries its own path header (no redundancy to suppress).
   const lines = [palette.bold(displayText(diff.path))]
   if (diff.oldText !== null) {
-    for (const line of displayText(diff.oldText).split('\n')) lines.push(palette.removed(`- ${line}`))
+    for (const line of displayText(diff.oldText).split('\n')) lines.push(palette.error(`- ${line}`))
   }
-  for (const line of displayText(diff.newText).split('\n')) lines.push(palette.added(`+ ${line}`))
+  for (const line of displayText(diff.newText).split('\n')) lines.push(palette.success(`+ ${line}`))
   return lines
 }
 
@@ -109,7 +109,7 @@ export class HeaderComponent implements Component {
     const subtitle = this.subtitle()
     const lines = [
       title,
-      ...subtitle === undefined ? [] : [this.palette.muted(displayText(subtitle))],
+      ...subtitle === undefined ? [] : [this.palette.dim(displayText(subtitle))],
       this.palette.dim(detail),
     ]
       .flatMap(line => wrapTextWithAnsi(line, usable))
@@ -147,12 +147,12 @@ function assistantMessageChildren(
   const text = displayText(textBlocks(content, 'text').trim())
   const children: Component[] = [
     new Spacer(1),
-    new Text(messageHeader('Assistant', palette.accent2, palette), 0, 0),
+    new Text(messageHeader('Assistant', palette.accent, palette), 0, 0),
   ]
   if (reasoning && showReasoning) {
     children.push(
-      new Text(palette.italic(palette.muted('Reasoning')), 0, 0),
-      new Markdown(reasoning, 0, 0, mdTheme, { color: value => palette.muted(value), italic: true }),
+      new Text(palette.italic(palette.dim('Reasoning')), 0, 0),
+      new Markdown(reasoning, 0, 0, mdTheme, { color: value => palette.dim(value), italic: true }),
     )
   }
   if (text) children.push(new Markdown(text, 0, 0, mdTheme, { color: value => palette.text(value) }))
@@ -301,10 +301,27 @@ export class StreamingAssistantComponent extends Container {
   }
 }
 
+/**
+ * A tool card's body split at the Markdown boundary. `prelude` rows are already
+ * styled and render verbatim (a terminal `$` command, its cwd, a diff's hunks);
+ * `lines` is the tool's own text. A generic card renders both as one Markdown
+ * document under the dim body tone.
+ */
+interface CardBody {
+  readonly prelude: readonly string[]
+  readonly lines: readonly string[]
+}
+
+/**
+ * Ctrl+O card-visibility cycle: `hidden` drops tool cards from the transcript,
+ * `collapsed` previews the first body lines, `expanded` shows everything.
+ */
+export type ToolCardVisibility = 'hidden' | 'collapsed' | 'expanded'
+
 /** A tool call and its result, rendered as a collapsible status card. */
 export class ToolCardComponent implements Component {
   private result: { content: ContentBlock[]; isError: boolean; meta?: JsonValue } | undefined
-  private expanded = false
+  private visibility: ToolCardVisibility = 'collapsed'
   private callView: ToolCallView
   private resultView: ToolResultView | undefined
 
@@ -353,16 +370,19 @@ export class ToolCardComponent implements Component {
   }
 
   /**
-   * Expand or collapse the card's body preview.
-   * @param expanded - Whether the full body is shown.
+   * Set the card's visibility state.
+   * @param visibility - Hidden, collapsed preview, or full body.
    */
-  setExpanded(expanded: boolean): void {
-    this.expanded = expanded
+  setVisibility(visibility: ToolCardVisibility): void {
+    this.visibility = visibility
   }
 
   invalidate(): void {}
 
   render(width: number): string[] {
+    // Hidden renders nothing — not even the leading gap — so the transcript
+    // keeps only the conversation, the way Codex hides tool calls.
+    if (this.visibility === 'hidden') return []
     const isError = this.result?.isError ?? false
     // A ring marker: hollow while the call is pending, filled once it settles;
     // the header color (warning/success/error) tells pending from ok from error.
@@ -374,25 +394,23 @@ export class ToolCardComponent implements Component {
       ? renderUnknownXml(
         displayText(contentText(genericContent)),
         this.maxOutputLines,
-        this.expanded,
+        this.visibility === 'expanded',
         displayText,
-        text => this.palette.muted(text),
+        text => this.palette.dim(text),
+        text => this.palette.dim(text),
         /* v8 ignore next -- renderUnknownXml calls the collapsed summary only when hidden XML children exceed this card's limit. */
         count => this.palette.dim(`  … +${count} lines (Ctrl+O to expand)`),
       )
       : undefined
-    const body = unknownXml ?? (genericContent !== undefined && rawBody.length > 0
-      ? new Markdown(rawBody.join('\n'), 0, 0, this.mdTheme, { color: value => this.palette.text(value) }).render(width)
-      : rawBody)
-    const headLines = Math.ceil(this.maxOutputLines / 2)
-    const tailLines = this.maxOutputLines - headLines
-    const visibleBody = unknownXml !== undefined || this.expanded || body.length <= this.maxOutputLines
+    // A generic card renders title and result as one Markdown document, so the
+    // document's own block spacing is preserved, then dims every row — the whole
+    // card body reads as one dim block under the status-colored header.
+    const body = unknownXml ?? (genericContent !== undefined && rawBody.lines.length > 0
+      ? this.dimBody(rawBody, width)
+      : [...rawBody.prelude, ...rawBody.lines])
+    const visibleBody = unknownXml !== undefined || this.visibility === 'expanded'
       ? body
-      : [
-        ...body.slice(0, headLines),
-        this.palette.dim(`… +${body.length - this.maxOutputLines} lines (Ctrl+O to expand)`),
-        ...body.slice(body.length - tailLines),
-      ]
+      : preview(body, this.maxOutputLines, count => this.palette.dim(`… +${count} lines (Ctrl+O to expand)`))
     // The header is a fixed `Tool / <name>` frame in the status color (warning
     // pending / success ok / error), flat — no bold or underline, so one color
     // reads consistently across the whole row. Every tool-specific detail (a
@@ -409,7 +427,9 @@ export class ToolCardComponent implements Component {
     const desc = this.headerDescription()
     const headerText = `${glyph} Tool / ${displayText(this.name)}${desc === undefined ? '' : ` / ${displayInlineText(desc)}`}`
     const header = truncateToWidth(headerText, Math.max(1, width - 2), '')
-    const lines = [statusColor(header)]
+    // The blank first row is the card's own paragraph gap (no external Spacer),
+    // so the hidden state removes the gap together with the card.
+    const lines: string[] = ['', statusColor(header)]
     if (visibleBody.length > 0) lines.push(...new Text(visibleBody.join('\n'), 0, 0).render(width))
     return lines
   }
@@ -438,10 +458,11 @@ export class ToolCardComponent implements Component {
     return this.resultView?.title ?? this.callView.title
   }
 
-  private renderBody(): string[] {
+  private renderBody(): CardBody {
     const view = this.resultView ?? this.callView
     if (view.card === 'terminal') {
       const pending = this.terminalPending()
+      const prelude: string[] = []
       const lines: string[] = []
       // The command shows as a $-line here whenever it is not the header: either a
       // description headlines the row (the command still belongs somewhere) or the row
@@ -452,18 +473,18 @@ export class ToolCardComponent implements Component {
       // rows and collide with the output below.
       const headlined = pending?.description !== undefined && pending.description !== ''
       const commandInBody = pending !== undefined && (headlined || this.result === undefined)
-      if (commandInBody) lines.push(this.palette.code(`$ ${displayInlineText(pending.title)}`))
-      if (pending?.cwd) lines.push(this.palette.dim(displayInlineText(pending.cwd)))
+      if (commandInBody) prelude.push(this.palette.dim(`$ ${displayInlineText(pending.title)}`))
+      if (pending?.cwd) prelude.push(this.palette.dim(displayInlineText(pending.cwd)))
       if (this.resultView?.card === 'terminal') {
-        if (this.resultView.output) lines.push(...displayText(this.resultView.output).split('\n'))
+        if (this.resultView.output) lines.push(...this.dimOutput(this.resultView.output))
         if (this.resultView.exitCode !== undefined) lines.push(this.palette.dim(`[exit ${this.resultView.exitCode}]`))
         if (this.resultView.signal !== undefined) {
           lines.push(this.palette.error(`[signal ${displayText(this.resultView.signal)}]`))
         }
       } else if (this.result !== undefined) {
-        lines.push(...displayText(contentText(this.result.content)).split('\n'))
+        lines.push(...this.dimOutput(contentText(this.result.content)))
       }
-      return lines.filter(Boolean)
+      return { prelude: prelude.filter(Boolean), lines: lines.filter(Boolean) }
     }
     if (view.card === 'diff') {
       // The header no longer names the file, so each diff keeps its own path
@@ -477,22 +498,138 @@ export class ToolCardComponent implements Component {
       })
       const files = view.diffs.length
       const footer = this.palette.dim(`└ +${added} -${removed} · ${files} file${files === 1 ? '' : 's'}`)
-      return [...hunks, footer]
+      // A diff's own `+`/`-` colors carry its meaning, so it renders verbatim
+      // rather than under the dim result-output color.
+      return { prelude: [...hunks, footer], lines: [] }
     }
     const content = view.content ?? this.result?.content
+    const prelude: string[] = []
     const lines: string[] = []
     // The presenter title headlines the body now that the header is a fixed
     // `Tool / <name>` frame (a terminal card keeps its command $-line instead).
     // Skip it when it only repeats the tool name (the fallback presenter for a
     // tool with no presentCall, or an unknown tool), which the header already shows.
     const bodyTitle = this.bodyTitle()
-    if (bodyTitle !== displayText(this.name)) lines.push(displayInlineText(bodyTitle))
+    if (bodyTitle !== displayText(this.name)) prelude.push(displayInlineText(bodyTitle))
     if (content !== undefined) lines.push(...displayText(contentText(content)).split('\n'))
     const rawInput = this.result === undefined && this.callView.card === 'generic'
       ? this.callView.rawInput
       : undefined
     if (rawInput !== undefined) lines.push(...pretty(rawInput).split('\n'))
-    return lines.filter((line, index, all) => line.length > 0 || (index > 0 && index < all.length - 1))
+    // Blank-line trimming spans the whole body, so the title counts as a row:
+    // interior blanks (a result's own paragraph break) survive while the body's
+    // leading and trailing ones are dropped.
+    const total = prelude.length + lines.length
+    return {
+      prelude,
+      lines: lines.filter((line, index) => {
+        const row = prelude.length + index
+        return line.length > 0 || (row > 0 && row < total - 1)
+      }),
+    }
+  }
+
+  /**
+   * A tool's own output text as dim rows — the card's result-output color, which
+   * separates what the tool produced from the card's own framing. A blank row
+   * stays the empty string so the terminal branch's blank-row filter still reads
+   * it as blank instead of as an ANSI-wrapped value.
+   */
+  private dimOutput(text: string): string[] {
+    return displayText(text).split('\n').map(line => line === '' ? line : this.palette.dim(line))
+  }
+
+  /**
+   * Render a generic card's prelude and result as one Markdown document under the
+   * dim body tone. Rendering both together preserves the document's own block
+   * spacing (Markdown's blank row before a heading); dimming every row keeps the
+   * card body one uniform tone, so only the status-colored header carries color.
+   */
+  private dimBody(body: CardBody, width: number): string[] {
+    const rows = new Markdown([...body.prelude, ...body.lines].join('\n'), 0, 0, this.mdTheme, {
+      color: value => this.palette.text(value),
+    }).render(width)
+    // A whitespace-only row carries no output to dim; leaving it unwrapped keeps
+    // Markdown's padding out of the styled ranges.
+    return rows.map(row => row.trim() === '' ? row : this.palette.dim(row))
+  }
+}
+
+/**
+ * Matches a lone reminder-frame tag on its own line, capturing the element name.
+ * Producers emit the frame as whole lines (`workspace-context`, `dsh-tool-skill`),
+ * so anchoring the whole line keeps a tag mentioned inside prose from matching.
+ */
+const REMINDER_FRAME_LINE = /^<(\/?)([a-zA-Z][\w:.-]*)>$/u
+
+/**
+ * Drop a producer's outer reminder frame, keeping the instruction body verbatim.
+ * The card header already names the source, so the frame lines carry nothing.
+ * Only a matched open/close pair on the first and last lines is removed, so a
+ * body that merely starts with a tag-like line is left intact.
+ * @param text - Complete model-facing context text.
+ * @returns The body without its outer frame lines, trimmed of the blank lines they leave.
+ */
+function stripReminderFrame(text: string): string {
+  // A frame needs an open line and a distinct close line, so anything shorter than
+  // two lines is already frameless.
+  const [first = '', ...rest] = text.split('\n')
+  const last = rest.at(-1)
+  if (last === undefined) return text
+  const open = REMINDER_FRAME_LINE.exec(first.trim())
+  const close = REMINDER_FRAME_LINE.exec(last.trim())
+  if (open?.[1] !== '' || close?.[1] !== '/' || open[2] !== close[2]) return text
+  return rest.slice(0, -1).join('\n').replace(/^\n+|\n+$/gu, '')
+}
+
+/**
+ * Injected context (plugin/goal source, e.g. `workspace-context`), rendered as a
+ * collapsible dim card that shares the tool-card `Ctrl+O` toggle. The header is
+ * `Context · <label>`; the body is the message text as dim prose, one tone with
+ * the header and the fold marker, folded to `maxOutputLines`, with a surrounding
+ * reminder frame stripped because the source label already names the context.
+ *
+ * Injected context is prose, not markup, so this card does not parse it. The
+ * `<system-reminder>` frame is a prompting convention no model is trained on
+ * ([envelope rationale](../../../../../.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md)),
+ * and instruction bodies legitimately contain a raw `&` or angle-bracket
+ * placeholders (`packages/<group>/<pkg>/`, `-t <name>`) that are prose rather than
+ * elements. Tree-rendering such a payload depended on whether it happened to be
+ * well-formed XML, which made both the fold and the frame-line suppression
+ * content-dependent.
+ */
+export class ContextCardComponent implements Component {
+  private expanded = false
+
+  constructor(
+    private readonly label: string,
+    private readonly text: string,
+    private readonly maxOutputLines: number,
+    private readonly palette: Palette,
+  ) {}
+
+  /**
+   * Expand or collapse the card body.
+   * @param expanded - Whether the full body is shown.
+   */
+  setExpanded(expanded: boolean): void {
+    this.expanded = expanded
+  }
+
+  invalidate(): void {}
+
+  render(width: number): string[] {
+    const header = this.palette.dim(`Context · ${displayText(this.label)}`)
+    // Emptiness is decided on the stripped text: styling a blank body would yield
+    // one escape-only row, which reads as a stray blank line under the header.
+    const stripped = stripReminderFrame(this.text)
+    if (stripped === '') return [header]
+    const body = stripped.split('\n')
+      .map(line => line === '' ? line : this.palette.dim(displayText(line)))
+    const visibleBody = this.expanded
+      ? body
+      : preview(body, this.maxOutputLines, count => this.palette.dim(`… +${count} lines (Ctrl+O to expand)`))
+    return [header, ...new Text(visibleBody.join('\n'), 0, 0).render(width)]
   }
 }
 
@@ -514,7 +651,7 @@ export class TodoComponent implements Component {
 
   render(width: number): string[] {
     if (this.todos.length === 0) return []
-    const lines = [this.palette.bold(this.palette.accent('Plan'))]
+    const lines: string[] = [this.palette.bold(this.palette.accent('Plan'))]
     for (const todo of this.todos) {
       const prefix = todo.status === 'completed'
         ? this.palette.success('✓')
@@ -522,7 +659,7 @@ export class TodoComponent implements Component {
           ? this.palette.warning('●')
           : this.palette.dim('○')
       const content = displayText(todo.content)
-      const text = todo.status === 'completed' ? this.palette.muted(content) : content
+      const text: string = todo.status === 'completed' ? this.palette.dim(content) : content
       lines.push(truncateToWidth(`  ${prefix} ${text}`, width, ''))
     }
     return ['', ...lines]
diff --git a/packages/ui/tui/src/components/xml-tool-output.ts b/packages/ui/tui/src/components/xml-tool-output.ts
index 24beb58c31..2bce3c330a 100644
--- a/packages/ui/tui/src/components/xml-tool-output.ts
+++ b/packages/ui/tui/src/components/xml-tool-output.ts
@@ -1,6 +1,7 @@
 /**
  * Conservative readable-tree rendering for model-facing text containing one XML
- * document, used by the transcript's tool and context cards.
+ * document, used by the transcript's tool cards for unknown tool results. Injected
+ * context is prose and is not parsed; only {@link preview} is shared with its card.
  * @module @deepseek-ai/dsh-tui/components/xml-tool-output
  */
 
@@ -76,26 +77,42 @@ function meaningfulChildren(element: XmlElement): readonly XmlNode[] {
   return element.children.filter(child => typeof child !== 'string' || child.trim() !== '')
 }
 
-function textBlock(text: string, depth: number): string[] {
-  return text.replace(/^\n|\n$/gu, '').split('\n').map(line => `${'  '.repeat(depth)}${line}`)
+function textBlock(text: string, depth: number, body: (text: string) => string): string[] {
+  return text.replace(/^\n|\n$/gu, '').split('\n')
+    .map(line => line === '' ? line : `${'  '.repeat(depth)}${body(line)}`)
 }
 
-function treeLines(element: XmlElement, depth: number, label: (text: string) => string): string[] {
+function treeLines(
+  element: XmlElement,
+  depth: number,
+  label: (text: string) => string,
+  body: (text: string) => string,
+): string[] {
   const indent = '  '.repeat(depth)
   const children = meaningfulChildren(element)
   if (children.length === 0) return [`${indent}${label(elementLabel(element))}`]
   if (children.length === 1 && typeof children[0] === 'string' && !children[0].includes('\n')) {
-    return [`${indent}${label(`${elementLabel(element)}:`)} ${children[0].trim()}`]
+    return [`${indent}${label(`${elementLabel(element)}:`)} ${body(children[0].trim())}`]
   }
   const lines = [`${indent}${label(elementLabel(element))}`]
   for (const child of children) {
-    if (typeof child === 'string') lines.push(...textBlock(child, depth + 1))
-    else lines.push(...treeLines(child, depth + 1, label))
+    if (typeof child === 'string') lines.push(...textBlock(child, depth + 1, body))
+    else lines.push(...treeLines(child, depth + 1, label, body))
   }
   return lines
 }
 
-function preview(lines: readonly string[], limit: number, omitted: (count: number) => string): string[] {
+/**
+ * Collapse `lines` to a head/tail preview around one omitted-count marker.
+ * The single fold rule for every transcript card, so a card's fold never depends
+ * on how its body was rendered: tool cards share it with their tree output and
+ * context cards apply it to prose rows.
+ * @param lines - Fully rendered body rows.
+ * @param limit - Maximum retained rows, excluding the marker.
+ * @param omitted - Renders the marker for the omitted row count.
+ * @returns `lines` unchanged when within `limit`, else head rows, the marker, and tail rows.
+ */
+export function preview(lines: readonly string[], limit: number, omitted: (count: number) => string): string[] {
   if (lines.length <= limit) return [...lines]
   const head = Math.ceil(limit / 2)
   const tail = limit - head
@@ -104,13 +121,15 @@ function preview(lines: readonly string[], limit: number, omitted: (count: numbe
 
 /**
  * Render a complete XML document as an indented tree, or decline without changing partial/mixed text.
- * @param source - Raw model-facing text from a context message or unknown tool result.
+ * @param source - Raw model-facing text from an unknown tool result.
  * @param maxChildLines - Collapsed budget independently applied to each top-level child's lines and
  * to the number of top-level children, so many siblings cannot grow the collapsed card without bound.
  * @param expanded - Whether to retain every rendered child line.
  * @param display - Escapes parsed text and attribute values for terminal output; character references
  * can expand to control characters that pre-parse escaping never saw.
  * @param label - Styles element names and attributes.
+ * @param body - Styles the text content under those elements; the card's body tone, so tree
+ * content matches the surrounding card rows instead of falling back to the default foreground.
  * @param omitted - Renders the omitted-line marker for a collapsed child or child range.
  * @returns Tree rows, or `undefined` when `source` is not one supported complete XML document.
  */
@@ -120,12 +139,13 @@ export function renderUnknownXml(
   expanded: boolean,
   display: (text: string) => string,
   label: (text: string) => string,
+  body: (text: string) => string,
   omitted: (count: number) => string,
 ): string[] | undefined {
   const root = parseXml(source, display)
   if (root === undefined) return undefined
   const blocks = meaningfulChildren(root).map(child =>
-    typeof child === 'string' ? textBlock(child, 1) : treeLines(child, 1, label))
+    typeof child === 'string' ? textBlock(child, 1, body) : treeLines(child, 1, label, body))
   const rootLine = label(elementLabel(root))
   if (expanded) return [rootLine, ...blocks.flat()]
   const previewed = blocks.map(block => preview(block, maxChildLines, omitted))
diff --git a/packages/ui/tui/src/config.ts b/packages/ui/tui/src/config.ts
index a48a1d704c..def548861f 100644
--- a/packages/ui/tui/src/config.ts
+++ b/packages/ui/tui/src/config.ts
@@ -79,7 +79,7 @@ const colorSchema = z.boolean().default(true)
 // No default: an unset value auto-detects truecolor from COLORTERM in `apply`.
 const truecolorSchema = z.boolean()
 const DEFAULT_LEFT_PROMPT = '${cwd}${git/worktree}${model}${token_meter/cache_hit_rate}${context}'
-const DEFAULT_RIGHT_PROMPT = '${timing}'
+const DEFAULT_RIGHT_PROMPT = '${queued}'
 const DEFAULT_INPUT_PROMPT = '${symbol} ${indicator}'
 const DEFAULT_INPUT_PLACEHOLDER = 'press enter to steer and esc to cancel'
 const TuiThemeConfigSchema: z<TuiThemeConfig> = z.object({
@@ -120,19 +120,19 @@ export interface Config extends TuiConfig {
   /** Exact shared agent/session identity driven by this terminal. Defaults to `main`. */
   sessionId?: string
   /**
-   * Shell command fallback printed on exit or after selecting a session when
-   * the host cannot hand off in place. Every `{session}` becomes the selected
-   * id; the TUI never executes this text. Absent disables only the fallback,
-   * not the interactive selector.
+   * Skill name auto-invoked as this session's first user turn, exactly as if
+   * the user typed `/skill:<name>`. Set only by a launcher for a fresh
+   * skill-guided session (`dsh migrate`/`dsh upgrade`); absent leaves the first
+   * turn to the user.
    */
-  resumeCommand?: string
+  initialSkill?: string
 }
 
 /** Schemastery schema for the full plugin configuration. */
 export const Config: z<Config> = z.object({
   welcome: z.string(),
   sessionId: z.string().default('main'),
-  resumeCommand: z.string(),
+  initialSkill: z.string(),
   showReasoning: tuiConfigSchemaFields.showReasoning,
   maxToolOutputLines: tuiConfigSchemaFields.maxToolOutputLines,
   maxQuestionOptions: tuiConfigSchemaFields.maxQuestionOptions,
diff --git a/packages/ui/tui/src/extension/types.ts b/packages/ui/tui/src/extension/types.ts
index adb45d5430..cb0e7e434f 100644
--- a/packages/ui/tui/src/extension/types.ts
+++ b/packages/ui/tui/src/extension/types.ts
@@ -37,9 +37,7 @@ export interface TuiFocusable {
 export interface TuiTheme {
   /** Render ordinary foreground text. */
   readonly text: (value: string) => string
-  /** Render secondary information. */
-  readonly muted: (value: string) => string
-  /** Render low-emphasis hints. */
+  /** Render secondary information and low-emphasis hints, the one tone below `text`. */
   readonly dim: (value: string) => string
   /** Render the active accent role. */
   readonly accent: (value: string) => string
diff --git a/packages/ui/tui/src/index.ts b/packages/ui/tui/src/index.ts
index 498c1f90c8..d1ba37e61d 100644
--- a/packages/ui/tui/src/index.ts
+++ b/packages/ui/tui/src/index.ts
@@ -32,7 +32,6 @@ import type {} from '@deepseek-ai/dsh-token-meter'
 import type { CommandResult } from '@deepseek-ai/dsh-commands'
 import { createUserMessage, errorChain } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageId } from '@deepseek-ai/dsh-llm'
-import { renderUnknownXml } from './components/xml-tool-output.ts'
 import type {} from '@deepseek-ai/dsh-llm-retry'
 import { renderPrompt } from '@deepseek-ai/dsh-system-prompt'
 import {
@@ -67,7 +66,7 @@ import type {
   TuiTheme,
 } from './extension/types.ts'
 import { displayInlineText, displayText } from './components/text.ts'
-import { createPalette, markdownTheme, selectTheme } from './components/theme.ts'
+import { createPalette, markdownTheme, renderPalette, selectTheme } from './components/theme.ts'
 import { contentText, parseArguments } from './components/content.ts'
 import {
   cacheHitRate,
@@ -92,6 +91,8 @@ import {
   type Config,
 } from './config.ts'
 import {
+  ContextCardComponent,
+  type ToolCardVisibility,
   HeaderComponent,
   StreamingAssistantComponent,
   ToolCardComponent,
@@ -175,9 +176,68 @@ declare module 'cordis' {
     tui: TuiExtensionService
     /** Optional process host that can replace this TUI with a resumed session. */
     tuiResumeHost: TuiResumeHost
+    /** Launcher-owned `main` session identity; absent lets the app mint one. */
+    mainSessionId: MainSessionIdentity | undefined
+    /** Line the launcher wants printed on exit; absent prints nothing. */
+    tuiGoodbyeMessage: string | undefined
+    /** Skill the launcher wants auto-invoked as the fresh session's first turn; absent leaves it to the user. */
+    tuiInitialSkill: string | undefined
+    /** Launcher-owned session-store root the app bundle defaults to; absent keeps the bundle's project-local default. */
+    launcherSessionsRoot: string | undefined
   }
 }
 
+/** Launcher-chosen identity for the app's `main` session. */
+export interface MainSessionIdentity {
+  /** Exact session id `main` binds to. */
+  readonly id: SessionId
+  /**
+   * Whether that session already has persisted history to load. `true` requires
+   * an existing log and fails loud when absent; `false` creates it fresh.
+   */
+  readonly resume: boolean
+}
+
+/**
+ * Context key a launcher sets before any Loader entry mounts
+ * (`ctx.provide(MAIN_SESSION_ID_KEY, identity)`) to fix the `main` agent's
+ * session identity, so an app bundle mounted from a `cordis.yml` binds a
+ * launcher-selected session without a config key. `ctx.provide` is the only
+ * channel from launcher argv into a Loader-mounted plugin, because config
+ * `!!js` expressions evaluate against the entry's context. Absent leaves the
+ * choice to the app.
+ */
+export const MAIN_SESSION_ID_KEY = 'mainSessionId'
+
+/**
+ * Context key a launcher sets before any Loader entry mounts
+ * (`ctx.provide(TUI_GOODBYE_MESSAGE_KEY, line)`) to supply the line the TUI
+ * prints once the terminal is released on exit — for the shipped CLI, the
+ * command that resumes this session. The launcher owns the wording because only
+ * it knows how it was invoked; the TUI escapes terminal controls before
+ * rendering. Absent prints nothing.
+ */
+export const TUI_GOODBYE_MESSAGE_KEY = 'tuiGoodbyeMessage'
+
+/**
+ * Context key a launcher sets before any Loader entry mounts
+ * (`ctx.provide(INITIAL_SKILL_KEY, name)`) to seed a fresh session's first user
+ * turn with `/skill:<name>` — the `dsh migrate`/`dsh upgrade` guided-session
+ * entry. The launcher sets it only when minting a fresh session, so it never
+ * re-fires on a resumed one. Absent leaves the first turn to the user.
+ */
+export const INITIAL_SKILL_KEY = 'tuiInitialSkill'
+
+/**
+ * Context key a launcher sets before any Loader entry mounts
+ * (`ctx.provide(SESSIONS_ROOT_KEY, root)`) to supply its session-store root as
+ * the app bundle's default persistence root. Shared-store policy (one store
+ * across every cwd) belongs to the launcher — the dsh CLI resolves it under the
+ * Harness home — never to a plugin; a bundle without this slot keeps its own
+ * project-local default, and an explicit `persistenceRoot` config still wins.
+ */
+export const SESSIONS_ROOT_KEY = 'launcherSessionsRoot'
+
 /**
  * Optional terminal-local interaction service provided by one mounted TUI.
  *
@@ -246,7 +306,6 @@ export function createTuiChat(
   const sessionId = SessionId(config.sessionId ?? 'main')
   const agent = ctx.agents.get(sessionId)
   if (agent === undefined) throw new Error(`ui-tui: session "${sessionId}" is not running`)
-  const persistence = ctx.get('sessionPersistence')
   const sessionQuery = ctx.get('sessionQuery')
   const resolved = resolveTuiConfig(config)
   const palette = createPalette(resolved.theme.color)
@@ -271,7 +330,9 @@ export function createTuiChat(
   editor.hintPrefix = initialInputPrompt
   const todo = new TodoComponent(palette)
   let showReasoning = resolved.showReasoning
-  let toolsExpanded = false
+  // Ctrl+O cycles collapsed -> expanded -> hidden. Codex-style: hidden drops
+  // tool cards entirely, collapsed previews, expanded shows full bodies.
+  let toolsVisibility: ToolCardVisibility = 'collapsed'
   let streaming: StreamingAssistantComponent | undefined
   let completedStreaming: StreamingAssistantComponent | undefined
   let runningStatus: RunningStatus | undefined
@@ -295,6 +356,7 @@ export function createTuiChat(
   const tokens = sessionTokens(agent.session)
   const toolCards = new Map<string, ToolCardComponent>()
   const allToolCards = new Set<ToolCardComponent>()
+  const contextCards = new Set<ContextCardComponent>()
   const liveErrors = new Set<string>()
   const commandControllers = new Set<AbortController>()
   const referenceControllers = new Set<AbortController>()
@@ -323,33 +385,33 @@ export function createTuiChat(
   const branch = runtime.gitBranch?.(cwd) ?? gitBranch(cwd)
   const promptValues: TuiPromptValueHandle[] = [
     ctx.tuiPrompt.register('cwd', palette.bold(palette.accent(formattedCwd))),
-    ctx.tuiPrompt.register('git/worktree', branch === undefined ? undefined : palette.muted(` (${displayText(branch)})`)),
+    ctx.tuiPrompt.register('git/worktree', branch === undefined ? undefined : palette.dim(` (${displayText(branch)})`)),
     ctx.tuiPrompt.register('token_meter/cache_hit_rate'),
     ctx.tuiPrompt.register('model'),
     ctx.tuiPrompt.register('context'),
-    ctx.tuiPrompt.register('timing'),
+    ctx.tuiPrompt.register('queued'),
     ctx.tuiPrompt.register('symbol', palette.bold(palette.accent('dsh'))),
-    ctx.tuiPrompt.register('indicator', palette.muted('> ')),
+    ctx.tuiPrompt.register('indicator', palette.dim('> ')),
   ]
-  const [cwdValue, gitValue, tokenValue, modelValue, contextValue, timingValue, symbolValue, indicatorValue] = promptValues
+  const [cwdValue, gitValue, tokenValue, modelValue, contextValue, queuedValue, symbolValue, indicatorValue] = promptValues
   /* v8 ignore next -- the fixed built-in registration list always supplies each handle. */
   if (cwdValue === undefined || gitValue === undefined || tokenValue === undefined || modelValue === undefined
-    || contextValue === undefined || timingValue === undefined || symbolValue === undefined || indicatorValue === undefined) {
+    || contextValue === undefined || queuedValue === undefined || symbolValue === undefined || indicatorValue === undefined) {
     throw new Error('TUI prompt built-ins failed to initialize')
   }
   const updatePromptValues = (): void => {
     cwdValue.set(palette.bold(palette.accent(formattedCwd)))
-    gitValue.set(branch === undefined ? undefined : palette.muted(` (${displayText(branch)})`))
+    gitValue.set(branch === undefined ? undefined : palette.dim(` (${displayText(branch)})`))
     const rate = cacheHitRate(tokens)
     const usage = `↑${formatTokens(tokens.input)} ↓${formatTokens(tokens.output)}`
-    modelValue.set(`  ${palette.muted(displayText(target.current === undefined ? 'model unset' : compactTargetLabel(target.current)))}`)
-    tokenValue.set(`  ${palette.muted(rate === undefined ? usage : `${usage}  cache ${rate}%`)}`)
+    modelValue.set(`  ${palette.dim(displayText(target.current === undefined ? 'model unset' : compactTargetLabel(target.current)))}`)
+    tokenValue.set(`  ${palette.dim(rate === undefined ? usage : `${usage}  cache ${rate}%`)}`)
     const contextWindow = modelController.contextWindow()
-    contextValue.set(contextWindow === undefined ? undefined : `  ${palette.muted(
+    contextValue.set(contextWindow === undefined ? undefined : `  ${palette.dim(
       `${Math.min(100, Math.round(ctx.tokenMeter.measure(agent.session).totalTokens / contextWindow * 100))}% context`,
     )}`)
     const queued = runningStatus === undefined ? undefined : formatQueuedStatus(pendingSteering.size)
-    timingValue.set(queued === undefined ? undefined : palette.dim(queued))
+    queuedValue.set(queued === undefined ? undefined : palette.dim(queued))
     symbolValue.set(palette.bold(palette.accent('dsh')))
     // `${indicator}` owns the caret column and its trailing gap before the
     // cursor. The phase glyph replaces the `>` caret in place — same width
@@ -370,7 +432,7 @@ export function createTuiChat(
         ? { glyph: fadingStatus.glyph, level: Math.max(0, 1 - (now() - fadingStatus.endedAt) / STATUS_FADE_MS) }
         : undefined
     const caret = envelope === undefined
-      ? palette.muted('>')
+      ? palette.dim('>')
       : fadeGlyph(
         envelope.glyph,
         palette,
@@ -379,7 +441,7 @@ export function createTuiChat(
         envelope.level * pulseLevel(now()),
         envelope.level >= 0.5,
       )
-    indicatorValue.set(`${caret}${palette.muted(' ')}`)
+    indicatorValue.set(`${caret}${palette.dim(' ')}`)
   }
   const promptContext = new PromptContextComponent(
     parseTuiPromptTemplate(displayInlineText(resolved.theme.leftPrompt)),
@@ -416,7 +478,7 @@ export function createTuiChat(
   const disposePromptChanges = ctx.tuiPrompt.subscribe(requestRender)
 
   const appendNotice = (message: string, kind: 'info' | 'warning' | 'error' = 'info'): void => {
-    const color = kind === 'error' ? palette.error : kind === 'warning' ? palette.warning : palette.muted
+    const color = kind === 'error' ? palette.error : kind === 'warning' ? palette.warning : palette.dim
     chat.addChild(new Spacer(1))
     chat.addChild(new Text(color(displayText(message)), 0, 0))
     requestRender()
@@ -424,7 +486,6 @@ export function createTuiChat(
 
   const extensionTheme: TuiTheme = Object.freeze({
     text: (value: string) => palette.text(value),
-    muted: (value: string) => palette.muted(value),
     dim: (value: string) => palette.dim(value),
     accent: (value: string) => palette.accent(value),
     success: (value: string) => palette.success(value),
@@ -547,7 +608,7 @@ export function createTuiChat(
       palette,
       mdTheme,
     )
-    card.setExpanded(toolsExpanded)
+    card.setVisibility(toolsVisibility)
     toolCards.set(event.data.callId, card)
     allToolCards.add(card)
     return card
@@ -626,22 +687,18 @@ export function createTuiChat(
           /* v8 ignore next -- context events with empty content are rejected by their owning producers. */
           if (text) {
             // The tui type view lacks plugin-augmented source kinds (e.g. goal),
-            // so read the display label without narrowing on `kind`.
-            const labelled = source as { kind: string; plugin?: string }
-            /* v8 ignore next -- current plugin-augmented context sources always carry their display label. */
-            const label = labelled.plugin ?? labelled.kind
-            const xml = renderUnknownXml(
-              text,
-              resolved.maxToolOutputLines,
-              true,
-              displayText,
-              value => palette.muted(value),
-              /* v8 ignore next -- expanded context XML never asks renderUnknownXml for a collapsed summary. */
-              () => '',
-            )
+            // so read the display label without narrowing on `kind`. The session
+            // log is a durable/replay boundary: a corrupt or foreign injected
+            // source may not match the typed shape, so fall back to `context`.
+            const labelled = source as { kind?: unknown; plugin?: unknown }
+            const label = typeof labelled.plugin === 'string' ? labelled.plugin
+              : typeof labelled.kind === 'string' ? labelled.kind
+                : 'context'
+            const card = new ContextCardComponent(label, text, resolved.maxToolOutputLines, palette)
+            card.setExpanded(toolsVisibility === 'expanded')
+            contextCards.add(card)
             chat.addChild(new Spacer(1))
-            chat.addChild(new Text(palette.dim(`Context · ${displayText(label)}`), 0, 0))
-            chat.addChild(new Text(xml?.join('\n') ?? palette.muted(displayText(text)), 0, 0))
+            chat.addChild(card)
           }
           break
         }
@@ -681,8 +738,9 @@ export function createTuiChat(
         )
         break
       }
+      // No external Spacer for tool cards: the card renders its own leading
+      // gap, so the hidden state removes the row and the gap together.
       case 'tool/call':
-        chat.addChild(new Spacer(1))
         chat.addChild(parsedTool(event))
         trailStreamingTiming()
         break
@@ -691,7 +749,7 @@ export function createTuiChat(
         let card = toolCards.get(callId)
         if (card === undefined) {
           card = new ToolCardComponent('tool', { value: {}, valid: true }, undefined, resolved.maxToolOutputLines, palette, mdTheme)
-          chat.addChild(new Spacer(1))
+          card.setVisibility(toolsVisibility)
           chat.addChild(card)
           allToolCards.add(card)
         }
@@ -762,6 +820,7 @@ export function createTuiChat(
     chat.clear()
     toolCards.clear()
     allToolCards.clear()
+    contextCards.clear()
     streaming = undefined
     todo.update([])
     const active = activeSurfaceSeqs(agent.session)
@@ -790,12 +849,10 @@ export function createTuiChat(
   const resume = createResumeController({
     ctx,
     agent,
-    config,
     runtime,
     resolved,
     palette,
     overlayManager,
-    persistence,
     sessionQuery,
     ui,
     editor,
@@ -824,9 +881,8 @@ export function createTuiChat(
       await runtime.terminal.drainInput(100, 20)
       ui.stop()
       if (exitProcess) {
-        const command = await resume.currentResumeCommand()
-        if (command !== undefined) {
-          runtime.terminal.write(`${palette.muted('To resume this session:')} ${displayText(command)}\n`)
+        if (runtime.goodbyeMessage !== undefined) {
+          runtime.terminal.write(`${palette.dim(displayText(runtime.goodbyeMessage))}\n`)
         }
         runtime.exit(0)
       }
@@ -870,9 +926,15 @@ export function createTuiChat(
   ui.queryTerminalColorScheme({ timeoutMs: 2000 }).catch(() => {})
 
   const toggleTools = (): void => {
-    toolsExpanded = !toolsExpanded
-    for (const card of allToolCards) card.setExpanded(toolsExpanded)
-    appendNotice(`Tool cards ${toolsExpanded ? 'expanded' : 'collapsed'}.`)
+    // The cycle order puts the two common reading modes adjacent: preview ->
+    // full detail -> conversation-only, then back to the preview default.
+    toolsVisibility = toolsVisibility === 'collapsed' ? 'expanded'
+      : toolsVisibility === 'expanded' ? 'hidden' : 'collapsed'
+    for (const card of allToolCards) card.setVisibility(toolsVisibility)
+    // Context cards carry injected instructions rather than tool traffic, so
+    // they never hide: the hidden phase reads as their collapsed preview.
+    for (const card of contextCards) card.setExpanded(toolsVisibility === 'expanded')
+    appendNotice(toolsVisibility === 'hidden' ? 'Tool cards hidden.' : `Tool and context cards ${toolsVisibility}.`)
   }
 
   const toggleReasoning = (): void => {
@@ -898,12 +960,20 @@ export function createTuiChat(
     chat.addChild(new Text(palette.bold(palette.accent('Keyboard shortcuts')), 0, 0))
     chat.addChild(new Text([
       'Enter send • Shift/Alt+Enter newline • Up/Down prompt history',
-      'Esc cancel active turn • Ctrl+O toggle tool cards • Ctrl+R toggle reasoning',
+      'Esc cancel turn • Ctrl+O cycle cards (collapse/expand/hide) • Ctrl+R toggle reasoning • Ctrl+L redraw',
       'Ctrl+C cancel while running; clear input or exit while idle • Ctrl+D exit',
       '',
       ...commandLines,
       '/skill:<name> [instructions] — load a skill into the conversation',
-    ].map(line => palette.muted(line)).join('\n'), 0, 0))
+    ].map(line => palette.dim(line)).join('\n'), 0, 0))
+    requestRender()
+  }
+
+  const showPalette = (): void => {
+    chat.addChild(new Spacer(1))
+    chat.addChild(new Text(
+      renderPalette(palette, currentScheme, resolved.theme.color).join('\n'), 0, 0,
+    ))
     requestRender()
   }
 
@@ -1050,19 +1120,9 @@ export function createTuiChat(
       handler: () => { chat.clear(); requestRender(); return { kind: 'success' } },
     })
     commandCtx.commands.register({
-      name: 'reasoning',
-      description: 'Toggle reasoning blocks',
-      handler: () => { toggleReasoning(); return { kind: 'success' } },
-    })
-    commandCtx.commands.register({
-      name: 'tools',
-      description: 'Expand or collapse all tool cards',
-      handler: () => { toggleTools(); return { kind: 'success' } },
-    })
-    commandCtx.commands.register({
-      name: 'redraw',
-      description: 'Invalidate components and redraw the terminal',
-      handler: () => { ui.invalidate(); ui.requestRender(true); return { kind: 'success' } },
+      name: 'palette',
+      description: 'Show every color and attribute role this terminal renders',
+      handler: () => { showPalette(); return { kind: 'success' } },
     })
     commandCtx.commands.register({
       name: 'reload',
@@ -1504,6 +1564,13 @@ export function createTuiChat(
   })
   startBannerReveal()
 
+  // A launcher-seeded first turn (`dsh migrate`/`dsh upgrade`): invoke the
+  // named skill exactly as a typed `/skill:<name>` would, once the chat is live
+  // and the agent is idle. The launcher sets this only for a fresh session, so
+  // there is no prior turn to collide with; invokeSkill reports an unknown skill
+  // as a notice.
+  if (config.initialSkill !== undefined) invokeSkill(config.initialSkill, '')
+
   return {
     async dispose(): Promise<void> {
       detachListeners()
@@ -1567,10 +1634,20 @@ export function apply(ctx: Context, config: Config): void {
   // boundary from COLORTERM; an explicit theme value still wins.
   const truecolor = config.theme?.truecolor ?? ['truecolor', '24bit'].includes(process.env.COLORTERM ?? '')
   const resumeHost = ctx.get('tuiResumeHost')
-  mountTui(ctx, Object.assign({}, config, { theme: Object.assign({}, config.theme, { truecolor }) }), {
+  const goodbyeMessage = ctx.get('tuiGoodbyeMessage')
+  // The launcher seeds a guided fresh session's first turn through this key; a
+  // config value still wins. Consumed in createTuiChat via config.initialSkill.
+  const initialSkill = config.initialSkill ?? ctx.get('tuiInitialSkill')
+  mountTui(ctx, Object.assign(
+    {},
+    config,
+    { theme: Object.assign({}, config.theme, { truecolor }) },
+    initialSkill === undefined ? {} : { initialSkill },
+  ), {
     terminal: new ProcessTerminal(),
     exit: code => process.exit(code),
-    ...resumeHost === undefined ? {} : { handoffResume: sessionId => resumeHost.handoff(sessionId) },
+    ...resumeHost === undefined ? {} : { handoffResume: (sessionId, cwd) => resumeHost.handoff(sessionId, cwd) },
+    ...goodbyeMessage === undefined ? {} : { goodbyeMessage },
   })
 }
 /* v8 ignore stop */
diff --git a/packages/ui/tui/src/runtime.ts b/packages/ui/tui/src/runtime.ts
index 4345f656bf..7ed4bf4d08 100644
--- a/packages/ui/tui/src/runtime.ts
+++ b/packages/ui/tui/src/runtime.ts
@@ -12,12 +12,17 @@ import type { SessionId } from '@deepseek-ai/dsh-session'
 /** Process-lifecycle owner used by the shipped CLI for an atomic resume handoff. */
 export interface TuiResumeHost {
   /**
-   * Dispose the current app and replace it with a runtime for `sessionId`.
-   * Success does not return. A host may reject before it commits teardown;
-   * after commit it owns fatal reporting and process exit.
+   * Dispose the current app and replace it with a runtime for `sessionId` in
+   * `cwd`. Success does not return. A host may reject before it commits
+   * teardown; after commit it owns fatal reporting and process exit.
    * @param sessionId - validated persisted session selected by the user.
+   * @param cwd - the selected session's own workspace, which the replacement
+   *   process must run in: process cwd, not the restored session header, is what
+   *   filesystem and shell tools resolve against. It may differ from the current
+   *   workspace, so a host that cannot enter it must reject before committing
+   *   teardown.
    */
-  handoff(sessionId: SessionId): Promise<never>
+  handoff(sessionId: SessionId, cwd: string): Promise<never>
 }
 
 /** Runtime boundary used by the interactive TUI. */
@@ -40,6 +45,13 @@ export interface TuiRuntime {
   gitBranch?: (cwd: string) => string | undefined
   /** Monotonic-enough wall clock for elapsed status rendering. Defaults to `Date.now`. */
   now?(): number
-  /** Host-owned process handoff; absent leaves `resumeCommand` as the fallback. */
+  /** Host-owned process handoff; absent leaves the session selectable but not resumable in place. */
   handoffResume?: TuiResumeHost['handoff']
+  /**
+   * Line the host wants printed once the terminal is released on exit, such as
+   * the command that resumes this session. Absent prints nothing. The host owns
+   * the wording; the TUI owns rendering and escapes terminal controls, so
+   * embedded ANSI is shown literally rather than applied.
+   */
+  goodbyeMessage?: string
 }
diff --git a/packages/ui/tui/tests/harness.ts b/packages/ui/tui/tests/harness.ts
index 60b69991b5..87282276f8 100644
--- a/packages/ui/tui/tests/harness.ts
+++ b/packages/ui/tui/tests/harness.ts
@@ -71,6 +71,8 @@ export interface TuiHarnessOptions {
     load?(id: ReturnType<typeof SessionId>): Promise<{ meta: SessionHeader; events: Session['events'] }>
   }
   handoffResume?: TuiRuntime['handoffResume']
+  /** Host-supplied exit line; absent exercises the no-message path. */
+  goodbyeMessage?: TuiRuntime['goodbyeMessage']
   /** Set false to exercise the optional session-query degradation path. */
   mountSessionQuery?: boolean
 }
@@ -253,6 +255,7 @@ export async function createTuiTestHarness<TerminalType extends Terminal, Exit e
     ...(options.now === undefined ? {} : { now: options.now }),
     ...(options.formatCwd === undefined ? {} : { formatCwd: options.formatCwd }),
     ...(options.handoffResume === undefined ? {} : { handoffResume: options.handoffResume }),
+    ...(options.goodbyeMessage === undefined ? {} : { goodbyeMessage: options.goodbyeMessage }),
     gitBranch: options.gitBranch ?? (() => 'tui-staging'),
   })
   return { ctx, session, agent, terminal, exit, controller }
diff --git a/packages/ui/tui/tests/snapshots/advanced-cards-collapsed.expected.txt b/packages/ui/tui/tests/snapshots/advanced-cards-collapsed.expected.txt
index f0fd74b989..2a005383e1 100644
--- a/packages/ui/tui/tests/snapshots/advanced-cards-collapsed.expected.txt
+++ b/packages/ui/tui/tests/snapshots/advanced-cards-collapsed.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=34 bufferRow=34
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,7 +17,7 @@ buffer
 6| "● Tool / bash / Run the coverage gate"
   style 0-36 fg=green
 7| "$ pnpm run test:coverage                                                                            "
-  style 0-23 fg=cyan
+  style 0-23 dim
 8| "/workspace/project                                                                                  "
   style 0-17 dim
 9| "… +4 lines (Ctrl+O to expand)                                                                       "
@@ -39,11 +39,14 @@ buffer
 18| "● Tool / subagent"
   style 0-16 fg=green
 19| "Delegate renderer audit                                                                             "
+  style 0-99 dim
 20| "The renderer has explicit lifecycle ownership.                                                      "
+  style 0-99 dim
 21| <blank>
 22| "● Tool / task_output"
   style 0-19 fg=green
 23| "Read output from background task subagent-7                                                         "
+  style 0-99 dim
 24| "                                                                                                    "
 25| "… +2 lines (Ctrl+O to expand)                                                                       "
   style 0-28 dim
@@ -52,18 +55,20 @@ buffer
 28| "● Tool / skill"
   style 0-13 fg=green
 29| "Load skill dsh-code-review                                                                          "
+  style 0-99 dim
 30| "Loaded review instructions.                                                                         "
+  style 0-99 dim
 31| "Model wait 0.0s                                                                                     "
   style 0-14 dim
 32| <blank>
 33| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 34| " dsh >                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 35-39| <blank>
diff --git a/packages/ui/tui/tests/snapshots/advanced-cards-expanded.expected.txt b/packages/ui/tui/tests/snapshots/advanced-cards-expanded.expected.txt
index 05e1f11b3c..6f9aa094f3 100644
--- a/packages/ui/tui/tests/snapshots/advanced-cards-expanded.expected.txt
+++ b/packages/ui/tui/tests/snapshots/advanced-cards-expanded.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=39 bufferRow=42
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,13 +17,17 @@ buffer
 6| "● Tool / bash / Run the coverage gate"
   style 0-36 fg=green
 7| "$ pnpm run test:coverage                                                                            "
-  style 0-23 fg=cyan
+  style 0-23 dim
 8| "/workspace/project                                                                                  "
   style 0-17 dim
 9| "packages/ui/tui 100%                                                                                "
+  style 0-19 dim
 10| "4016 tests passed                                                                                   "
+  style 0-16 dim
 11| "1 test skipped                                                                                      "
+  style 0-13 dim
 12| "coverage complete                                                                                   "
+  style 0-16 dim
 13| "[exit 0]                                                                                            "
   style 0-7 dim
 14| <blank>
@@ -45,35 +49,42 @@ buffer
 23| "● Tool / subagent"
   style 0-16 fg=green
 24| "Delegate renderer audit                                                                             "
+  style 0-99 dim
 25| "The renderer has explicit lifecycle ownership.                                                      "
+  style 0-99 dim
 26| <blank>
 27| "● Tool / task_output"
   style 0-19 fg=green
 28| "Read output from background task subagent-7                                                         "
+  style 0-99 dim
 29| "                                                                                                    "
 30| "console                                                                                             "
   style 0-6 dim
 31| "  started background task bash-5                                                                    "
-  style 2-31 fg=cyan
+  style 0-1 dim
+  style 2-31 fg=cyan dim
+  style 32-99 dim
 32| "                                                                                                    "
 33| <blank>
 34| "● Tool / skill"
   style 0-13 fg=green
 35| "Load skill dsh-code-review                                                                          "
+  style 0-99 dim
 36| "Loaded review instructions.                                                                         "
+  style 0-99 dim
 37| "Model wait 0.0s                                                                                     "
   style 0-14 dim
 38| <blank>
-39| "Tool cards expanded.                                                                                "
-  style 0-19 fg=bright-black
+39| "Tool and context cards expanded.                                                                    "
+  style 0-31 dim
 40| <blank>
 41| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 42| " dsh >                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/packages/ui/tui/tests/snapshots/banner-gradient.expected.txt b/packages/ui/tui/tests/snapshots/banner-gradient.expected.txt
index 0477513ebd..559cd27d0a 100644
--- a/packages/ui/tui/tests/snapshots/banner-gradient.expected.txt
+++ b/packages/ui/tui/tests/snapshots/banner-gradient.expected.txt
@@ -14,7 +14,7 @@ viewport
   style 8-8 fg=#2498ff bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -24,13 +24,13 @@ viewport
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 8| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 9-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/code-mode-pending.expected.txt b/packages/ui/tui/tests/snapshots/code-mode-pending.expected.txt
index db131247d0..cd59ddbb6e 100644
--- a/packages/ui/tui/tests/snapshots/code-mode-pending.expected.txt
+++ b/packages/ui/tui/tests/snapshots/code-mode-pending.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=15 bufferRow=15
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -25,13 +25,13 @@ buffer
   style 0-14 dim
 13| <blank>
 14| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 15| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 16-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/conversation-streaming.expected.txt b/packages/ui/tui/tests/snapshots/conversation-streaming.expected.txt
index db68564b48..98c0d359d2 100644
--- a/packages/ui/tui/tests/snapshots/conversation-streaming.expected.txt
+++ b/packages/ui/tui/tests/snapshots/conversation-streaming.expected.txt
@@ -4,19 +4,19 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=18 bufferRow=18
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "Assistant                                                                                       "
   style 0-8 fg=bright-magenta bold underline
 5| "Reasoning                                                                                       "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 6| "Inspecting width and styles.                                                                    "
-  style 0-27 fg=bright-black italic
+  style 0-27 dim italic
 7| "Streaming visible state…                                                                        "
   style 10-22 bold
 8| "                                                                                                "
@@ -29,17 +29,16 @@ viewport
   style 0-30 dim
 13| <blank>
 14| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 15| "Show the live update.                                                                           "
 16| <blank>
 17| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 18| " dsh ● press enter to steer and esc to cancel                                                   "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
-  style 7-44 dim
+  style 1-3 fg=bright-magenta bold
+  style 5-44 dim
 19-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/cordis-tools-pending.expected.txt b/packages/ui/tui/tests/snapshots/cordis-tools-pending.expected.txt
index 96564a8227..94f75e7219 100644
--- a/packages/ui/tui/tests/snapshots/cordis-tools-pending.expected.txt
+++ b/packages/ui/tui/tests/snapshots/cordis-tools-pending.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=21 bufferRow=21
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -33,13 +33,13 @@ buffer
   style 0-14 dim
 19| <blank>
 20| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 21| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 22-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/disposed-terminal.expected.txt b/packages/ui/tui/tests/snapshots/disposed-terminal.expected.txt
index 9be96fe5e1..a6a73566d6 100644
--- a/packages/ui/tui/tests/snapshots/disposed-terminal.expected.txt
+++ b/packages/ui/tui/tests/snapshots/disposed-terminal.expected.txt
@@ -1,13 +1,13 @@
-terminal 92x32 buffer=normal length=38 base=6 viewport=6
+terminal 92x32 buffer=normal length=37 base=5 viewport=5
 lifecycle started=1 stopped=1 progress=inactive
 title "DSH snapshot"
-cursor visible column=0 viewportRow=31 bufferRow=37
+cursor visible column=0 viewportRow=31 bufferRow=36
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,62 +17,60 @@ buffer
   style 0-46 dim
 6| <blank>
 7| "Keyboard shortcuts                                                                          "
-  style 0-17 fg=bright-blue bold
+  style 0-17 fg=bright-magenta bold
 8| "Enter send • Shift/Alt+Enter newline • Up/Down prompt history                               "
-  style 0-60 fg=bright-black
-9| "Esc cancel active turn • Ctrl+O toggle tool cards • Ctrl+R toggle reasoning                 "
-  style 0-74 fg=bright-black
-10| "Ctrl+C cancel while running; clear input or exit while idle • Ctrl+D exit                   "
-  style 0-72 fg=bright-black
-11| "                                                                                            "
-12| "/clear — Clear the transcript view (session history is unchanged)                           "
-  style 0-64 fg=bright-black
-13| "/exit — Exit after the active turn reaches idle                                             "
-  style 0-46 fg=bright-black
-14| "/help — Show keyboard shortcuts and commands                                                "
-  style 0-43 fg=bright-black
-15| "/model [[provider/]model] — Show or switch this session's model                             "
-  style 0-62 fg=bright-black
-16| "/quit — Exit after the active turn reaches idle                                             "
-  style 0-46 fg=bright-black
-17| "/reasoning — Toggle reasoning blocks                                                        "
-  style 0-35 fg=bright-black
-18| "/redraw — Invalidate components and redraw the terminal                                     "
-  style 0-54 fg=bright-black
+  style 0-60 dim
+9| "Esc cancel turn • Ctrl+O cycle cards (collapse/expand/hide) • Ctrl+R toggle reasoning •     "
+  style 0-91 dim
+10| "Ctrl+L redraw                                                                               "
+  style 0-12 dim
+11| "Ctrl+C cancel while running; clear input or exit while idle • Ctrl+D exit                   "
+  style 0-72 dim
+12| "                                                                                            "
+13| "/clear — Clear the transcript view (session history is unchanged)                           "
+  style 0-64 dim
+14| "/exit — Exit after the active turn reaches idle                                             "
+  style 0-46 dim
+15| "/help — Show keyboard shortcuts and commands                                                "
+  style 0-43 dim
+16| "/model [[provider/]model] — Show or switch this session's model                             "
+  style 0-62 dim
+17| "/palette — Show every color and attribute role this terminal renders                        "
+  style 0-67 dim
+18| "/quit — Exit after the active turn reaches idle                                             "
+  style 0-46 dim
 19| "/reload — EXPERIMENTAL (dev): re-read loader config files and apply the diff (idle only)    "
-  style 0-87 fg=bright-black
+  style 0-87 dim
 20| "/resume — List this workspace's resumable sessions                                          "
-  style 0-49 fg=bright-black
+  style 0-49 dim
 21| "/status — Show session diagnostics, system prompt, and registered tools                     "
-  style 0-70 fg=bright-black
-22| "/tools — Expand or collapse all tool cards                                                  "
-  style 0-41 fg=bright-black
-23| "/skill:<name> [instructions] — load a skill into the conversation                           "
-  style 0-64 fg=bright-black
-24| <blank>
-25| "provider stream failed after partial output                                                 "
+  style 0-70 dim
+22| "/skill:<name> [instructions] — load a skill into the conversation                           "
+  style 0-64 dim
+23| <blank>
+24| "provider stream failed after partial output                                                 "
   style 0-42 fg=red
-26| <blank>
-27| "The previous process ended during this turn.                                                "
+25| <blank>
+26| "The previous process ended during this turn.                                                "
   style 0-43 fg=yellow
-28| <blank>
-29| "Turn stopped: the agent was disposed.                                                       "
+27| <blank>
+28| "Turn stopped: the agent was disposed.                                                       "
   style 0-36 fg=yellow
-30| <blank>
-31| "Turn ended: plugin-policy.                                                                  "
+29| <blank>
+30| "Turn ended: plugin-policy.                                                                  "
   style 0-25 fg=yellow
-32| <blank>
-33| "Unknown command: /unknown-advanced-command                                                  "
+31| <blank>
+32| "Unknown command: /unknown-advanced-command                                                  "
   style 0-41 fg=yellow
-34| <blank>
-35| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
-36| " dsh >                                                                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+33| <blank>
+34| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
+35| " dsh >                                                                                      "
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
-37| <blank>
+36| <blank>
diff --git a/packages/ui/tui/tests/snapshots/dynamic-workflow-pending.expected.txt b/packages/ui/tui/tests/snapshots/dynamic-workflow-pending.expected.txt
index 9826588b32..5b0749a15f 100644
--- a/packages/ui/tui/tests/snapshots/dynamic-workflow-pending.expected.txt
+++ b/packages/ui/tui/tests/snapshots/dynamic-workflow-pending.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=17 bufferRow=17
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -28,13 +28,13 @@ buffer
   style 0-14 dim
 15| <blank>
 16| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 17| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 18-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/errors-and-help.expected.txt b/packages/ui/tui/tests/snapshots/errors-and-help.expected.txt
index f93a4b47da..b8b62bca11 100644
--- a/packages/ui/tui/tests/snapshots/errors-and-help.expected.txt
+++ b/packages/ui/tui/tests/snapshots/errors-and-help.expected.txt
@@ -1,13 +1,13 @@
-terminal 92x32 buffer=normal length=37 base=5 viewport=5
+terminal 92x32 buffer=normal length=36 base=4 viewport=4
 lifecycle started=1 stopped=0 progress=inactive
 title "DSH snapshot"
-cursor hidden column=7 viewportRow=31 bufferRow=36
+cursor hidden column=7 viewportRow=31 bufferRow=35
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,61 +17,59 @@ buffer
   style 0-46 dim
 6| <blank>
 7| "Keyboard shortcuts                                                                          "
-  style 0-17 fg=bright-blue bold
+  style 0-17 fg=bright-magenta bold
 8| "Enter send • Shift/Alt+Enter newline • Up/Down prompt history                               "
-  style 0-60 fg=bright-black
-9| "Esc cancel active turn • Ctrl+O toggle tool cards • Ctrl+R toggle reasoning                 "
-  style 0-74 fg=bright-black
-10| "Ctrl+C cancel while running; clear input or exit while idle • Ctrl+D exit                   "
-  style 0-72 fg=bright-black
-11| "                                                                                            "
-12| "/clear — Clear the transcript view (session history is unchanged)                           "
-  style 0-64 fg=bright-black
-13| "/exit — Exit after the active turn reaches idle                                             "
-  style 0-46 fg=bright-black
-14| "/help — Show keyboard shortcuts and commands                                                "
-  style 0-43 fg=bright-black
-15| "/model [[provider/]model] — Show or switch this session's model                             "
-  style 0-62 fg=bright-black
-16| "/quit — Exit after the active turn reaches idle                                             "
-  style 0-46 fg=bright-black
-17| "/reasoning — Toggle reasoning blocks                                                        "
-  style 0-35 fg=bright-black
-18| "/redraw — Invalidate components and redraw the terminal                                     "
-  style 0-54 fg=bright-black
+  style 0-60 dim
+9| "Esc cancel turn • Ctrl+O cycle cards (collapse/expand/hide) • Ctrl+R toggle reasoning •     "
+  style 0-91 dim
+10| "Ctrl+L redraw                                                                               "
+  style 0-12 dim
+11| "Ctrl+C cancel while running; clear input or exit while idle • Ctrl+D exit                   "
+  style 0-72 dim
+12| "                                                                                            "
+13| "/clear — Clear the transcript view (session history is unchanged)                           "
+  style 0-64 dim
+14| "/exit — Exit after the active turn reaches idle                                             "
+  style 0-46 dim
+15| "/help — Show keyboard shortcuts and commands                                                "
+  style 0-43 dim
+16| "/model [[provider/]model] — Show or switch this session's model                             "
+  style 0-62 dim
+17| "/palette — Show every color and attribute role this terminal renders                        "
+  style 0-67 dim
+18| "/quit — Exit after the active turn reaches idle                                             "
+  style 0-46 dim
 19| "/reload — EXPERIMENTAL (dev): re-read loader config files and apply the diff (idle only)    "
-  style 0-87 fg=bright-black
+  style 0-87 dim
 20| "/resume — List this workspace's resumable sessions                                          "
-  style 0-49 fg=bright-black
+  style 0-49 dim
 21| "/status — Show session diagnostics, system prompt, and registered tools                     "
-  style 0-70 fg=bright-black
-22| "/tools — Expand or collapse all tool cards                                                  "
-  style 0-41 fg=bright-black
-23| "/skill:<name> [instructions] — load a skill into the conversation                           "
-  style 0-64 fg=bright-black
-24| <blank>
-25| "provider stream failed after partial output                                                 "
+  style 0-70 dim
+22| "/skill:<name> [instructions] — load a skill into the conversation                           "
+  style 0-64 dim
+23| <blank>
+24| "provider stream failed after partial output                                                 "
   style 0-42 fg=red
-26| <blank>
-27| "The previous process ended during this turn.                                                "
+25| <blank>
+26| "The previous process ended during this turn.                                                "
   style 0-43 fg=yellow
-28| <blank>
-29| "Turn stopped: the agent was disposed.                                                       "
+27| <blank>
+28| "Turn stopped: the agent was disposed.                                                       "
   style 0-36 fg=yellow
-30| <blank>
-31| "Turn ended: plugin-policy.                                                                  "
+29| <blank>
+30| "Turn ended: plugin-policy.                                                                  "
   style 0-25 fg=yellow
-32| <blank>
-33| "Unknown command: /unknown-advanced-command                                                  "
+31| <blank>
+32| "Unknown command: /unknown-advanced-command                                                  "
   style 0-41 fg=yellow
-34| <blank>
-35| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
-36| " dsh >                                                                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+33| <blank>
+34| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
+35| " dsh >                                                                                      "
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/packages/ui/tui/tests/snapshots/file-autocomplete.expected.txt b/packages/ui/tui/tests/snapshots/file-autocomplete.expected.txt
index 73b7c494c5..b230b38dee 100644
--- a/packages/ui/tui/tests/snapshots/file-autocomplete.expected.txt
+++ b/packages/ui/tui/tests/snapshots/file-autocomplete.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=11 viewportRow=8 bufferRow=8
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,15 +17,15 @@ viewport
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 8| " dsh > @tsc                                                                                     "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 11-11 inverse
 9| "       → File · terminal-special-case.t  src/terminal-special-case.ts                           "
-  style 7-38 fg=bright-blue
+  style 7-38 fg=bright-magenta
 10-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/model-selector-filtered.expected.txt b/packages/ui/tui/tests/snapshots/model-selector-filtered.expected.txt
new file mode 100644
index 0000000000..bb79cc00fd
--- /dev/null
+++ b/packages/ui/tui/tests/snapshots/model-selector-filtered.expected.txt
@@ -0,0 +1,52 @@
+terminal 92x32 buffer=normal length=32 base=0 viewport=0
+lifecycle started=1 stopped=0 progress=inactive
+title "DSH snapshot"
+cursor hidden column=15 viewportRow=13 bufferRow=13
+buffer
+0| " DEEPSEEK HARNESS"
+  style 1-8 fg=bright-magenta bold
+  style 10-16 bold
+1| " Snapshot agent ready."
+  style 1-21 dim
+2| " main-session"
+  style 1-12 dim
+3| <blank>
+4| "Assistant                                                                                   "
+  style 0-8 fg=bright-magenta bold underline
+5| "Model wait 0.0s                                                                             "
+  style 0-14 dim
+6| <blank>
+7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
+8| " dsh >                                                                                      "
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
+  style 7-7 inverse
+9-11| <blank>
+12| "        ╭ Select model ────────────────────────────────────────────────────────────╮        "
+  style 8-83 fg=bright-magenta
+13| "        │ > pro                                                                    │        "
+  style 8-8 fg=bright-magenta
+  style 15-15 inverse
+  style 83-83 fg=bright-magenta
+14| "        │                                                                          │        "
+  style 8-8 fg=bright-magenta
+  style 83-83 fg=bright-magenta
+15| "        │ → deepseek/deepseek-v4-pro        DeepSeek V4 Pro                        │        "
+  style 8-8 fg=bright-magenta
+  style 10-58 fg=bright-magenta inverse
+  style 83-83 fg=bright-magenta
+16| "        │                                                                          │        "
+  style 8-8 fg=bright-magenta
+  style 83-83 fg=bright-magenta
+17| "        │ type to filter • ↑/↓ move • Shift+Tab reasoning • Enter select • Esc     │        "
+  style 8-8 fg=bright-magenta
+  style 10-77 dim
+  style 83-83 fg=bright-magenta
+18| "        ╰──────────────────────────────────────────────────────────────────────────╯        "
+  style 8-83 fg=bright-magenta
+19-31| <blank>
diff --git a/packages/ui/tui/tests/snapshots/model-selector.expected.txt b/packages/ui/tui/tests/snapshots/model-selector.expected.txt
index df2dbf5e33..449a1c7bfc 100644
--- a/packages/ui/tui/tests/snapshots/model-selector.expected.txt
+++ b/packages/ui/tui/tests/snapshots/model-selector.expected.txt
@@ -1,13 +1,13 @@
 terminal 92x32 buffer=normal length=32 base=0 viewport=0
 lifecycle started=1 stopped=0 progress=inactive
 title "DSH snapshot"
-cursor hidden column=0 viewportRow=31 bufferRow=31
+cursor hidden column=12 viewportRow=13 bufferRow=13
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,33 +17,40 @@ buffer
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 8| " dsh >                                                                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
-9-12| <blank>
-13| "        ╭ Select model ────────────────────────────────────────────────────────────╮        "
-  style 8-83 fg=bright-blue
-14| "        │ → deepseek/deepseek-v4-flash      DeepSeek V4 Flash — current            │        "
-  style 8-8 fg=bright-blue
-  style 10-70 fg=bright-blue inverse
-  style 83-83 fg=bright-blue
-15| "        │   deepseek/deepseek-v4-pro        DeepSeek V4 Pro                        │        "
-  style 8-8 fg=bright-blue
-  style 36-58 fg=bright-black
-  style 83-83 fg=bright-blue
-16| "        │                                                                          │        "
-  style 8-8 fg=bright-blue
-  style 83-83 fg=bright-blue
-17| "        │ ↑/↓ navigate • Shift+Tab reasoning • Enter select • Esc cancel           │        "
-  style 8-8 fg=bright-blue
-  style 10-71 dim
-  style 83-83 fg=bright-blue
-18| "        ╰──────────────────────────────────────────────────────────────────────────╯        "
-  style 8-83 fg=bright-blue
-19-31| <blank>
+9-11| <blank>
+12| "        ╭ Select model ────────────────────────────────────────────────────────────╮        "
+  style 8-83 fg=bright-magenta
+13| "        │ >                                                                        │        "
+  style 8-8 fg=bright-magenta
+  style 12-12 inverse
+  style 83-83 fg=bright-magenta
+14| "        │                                                                          │        "
+  style 8-8 fg=bright-magenta
+  style 83-83 fg=bright-magenta
+15| "        │ → deepseek/deepseek-v4-flash      DeepSeek V4 Flash — current            │        "
+  style 8-8 fg=bright-magenta
+  style 10-70 fg=bright-magenta inverse
+  style 83-83 fg=bright-magenta
+16| "        │   deepseek/deepseek-v4-pro        DeepSeek V4 Pro                        │        "
+  style 8-8 fg=bright-magenta
+  style 36-58 dim
+  style 83-83 fg=bright-magenta
+17| "        │                                                                          │        "
+  style 8-8 fg=bright-magenta
+  style 83-83 fg=bright-magenta
+18| "        │ type to filter • ↑/↓ move • Shift+Tab reasoning • Enter select • Esc     │        "
+  style 8-8 fg=bright-magenta
+  style 10-77 dim
+  style 83-83 fg=bright-magenta
+19| "        ╰──────────────────────────────────────────────────────────────────────────╯        "
+  style 8-83 fg=bright-magenta
+20-31| <blank>
diff --git a/packages/ui/tui/tests/snapshots/model-switching.expected.txt b/packages/ui/tui/tests/snapshots/model-switching.expected.txt
index 9bba7a9b14..b57b3f8b23 100644
--- a/packages/ui/tui/tests/snapshots/model-switching.expected.txt
+++ b/packages/ui/tui/tests/snapshots/model-switching.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=10 bufferRow=10
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,16 +17,16 @@ buffer
   style 0-14 dim
 6| <blank>
 7| "Model selected: deepseek/deepseek-v4-pro. New steps will use it.                            "
-  style 0-63 fg=bright-black
+  style 0-63 dim
 8| <blank>
 9| "/workspace/project (tui-staging)  deepseek-v4-pro  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-48 fg=bright-black
-  style 51-55 fg=bright-black
-  style 58-67 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-48 dim
+  style 51-55 dim
+  style 58-67 dim
 10| " dsh >                                                                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 11-31| <blank>
diff --git a/packages/ui/tui/tests/snapshots/question-dialog-single-option.expected.txt b/packages/ui/tui/tests/snapshots/question-dialog-single-option.expected.txt
index 02d1ff0c97..a81556d42a 100644
--- a/packages/ui/tui/tests/snapshots/question-dialog-single-option.expected.txt
+++ b/packages/ui/tui/tests/snapshots/question-dialog-single-option.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=0 viewportRow=19 bufferRow=19
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,23 +17,23 @@ viewport
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 "
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-55 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-55 dim
 8| " dsh >                                                  "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 9-11| <blank>
 12| "                                                        "
 13| "  Question 1/1 (1 unanswered) · Confirm                 "
-  style 2-38 fg=bright-black
+  style 2-38 dim
 14| "  Continue with this change?                            "
 15| "                                                        "
 16| "  › 1. Proceed  Apply the proposed change               "
-  style 2-13 fg=bright-blue bold
-  style 16-40 fg=bright-black
+  style 2-13 fg=bright-magenta bold
+  style 16-40 dim
 17| "  Tab custom answer • Enter submit • Esc interrupt      "
   style 2-49 dim
 18| "                                                        "
diff --git a/packages/ui/tui/tests/snapshots/question-dialog-validation.expected.txt b/packages/ui/tui/tests/snapshots/question-dialog-validation.expected.txt
index c5787378e0..14193efdda 100644
--- a/packages/ui/tui/tests/snapshots/question-dialog-validation.expected.txt
+++ b/packages/ui/tui/tests/snapshots/question-dialog-validation.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=56 viewportRow=17 bufferRow=17
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -15,17 +15,17 @@ viewport
   style 0-8 fg=bright-magenta bold underline
 5| "                                                        "
 6| "  Question 1/3 (3 unanswered) · Coverage                "
-  style 2-39 fg=bright-black
+  style 2-39 dim
 7| "  Which advanced TUI states belong in the required      "
 8| "  matrix?                                               "
 9| "                                                        "
 10| "  › 1. [ ] Code Mode     run_code programs and capture  "
-  style 2-19 fg=bright-blue bold
-  style 25-53 fg=bright-black
+  style 2-19 fg=bright-magenta bold
+  style 25-53 dim
 11| "    2. [ ] Workflows     phases and parallel agents     "
-  style 25-50 fg=bright-black
+  style 25-50 dim
 12| "    3. [ ] Cordis tools  inspect, mount, and unmount    "
-  style 25-51 fg=bright-black
+  style 25-51 dim
 13| "  1/4                                                   "
   style 2-4 dim
 14| "  Tab custom answer • ↑/↓ navigate • Space toggle •     "
diff --git a/packages/ui/tui/tests/snapshots/question-dialog.expected.txt b/packages/ui/tui/tests/snapshots/question-dialog.expected.txt
index 611b8262d4..640bd6fed2 100644
--- a/packages/ui/tui/tests/snapshots/question-dialog.expected.txt
+++ b/packages/ui/tui/tests/snapshots/question-dialog.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=0 viewportRow=19 bufferRow=19
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -18,17 +18,17 @@ viewport
 6| <blank>
 7| "                                                        "
 8| "  Question 1/3 (3 unanswered) · Coverage                "
-  style 2-39 fg=bright-black
+  style 2-39 dim
 9| "  Which advanced TUI states belong in the required      "
 10| "  matrix?                                               "
 11| "                                                        "
 12| "  › 1. [ ] Code Mode     run_code programs and capture  "
-  style 2-19 fg=bright-blue bold
-  style 25-53 fg=bright-black
+  style 2-19 fg=bright-magenta bold
+  style 25-53 dim
 13| "    2. [ ] Workflows     phases and parallel agents     "
-  style 25-50 fg=bright-black
+  style 25-50 dim
 14| "    3. [ ] Cordis tools  inspect, mount, and unmount    "
-  style 25-51 fg=bright-black
+  style 25-51 dim
 15| "  1/4                                                   "
   style 2-4 dim
 16| "  Tab custom answer • ↑/↓ navigate • Space toggle •     "
diff --git a/packages/ui/tui/tests/snapshots/resume-sessions-all-workspaces.expected.txt b/packages/ui/tui/tests/snapshots/resume-sessions-all-workspaces.expected.txt
new file mode 100644
index 0000000000..1e68714d7e
--- /dev/null
+++ b/packages/ui/tui/tests/snapshots/resume-sessions-all-workspaces.expected.txt
@@ -0,0 +1,57 @@
+terminal 92x32 buffer=normal length=32 base=0 viewport=0
+lifecycle started=1 stopped=0 progress=inactive
+title "DSH snapshot"
+cursor hidden column=6 viewportRow=4 bufferRow=4
+buffer
+0| "                                                                                            "
+1| "  Resume session (1 of 3)                                                                   "
+  style 2-24 fg=bright-magenta bold
+2| "                                                                                            "
+3| "  ╭──────────────────────────────────────────────────────────────────────────────────────╮  "
+  style 2-89 dim
+4| "  │ ⌕                                                                                    │  "
+  style 2-2 dim
+  style 6-6 inverse
+  style 89-89 dim
+5| "  ╰──────────────────────────────────────────────────────────────────────────────────────╯  "
+  style 2-89 dim
+6| "                                                                                            "
+7| "  all workspaces (3)  ⇥ this workspace (2)                                                  "
+  style 2-19 fg=bright-magenta
+  style 20-41 dim
+8| "                                                                                            "
+9| "  ❯ Untitled session                                                                        "
+  style 2-19 fg=bright-magenta bold
+10| "    2026-07-23T08:00:00.000Z · no completed turn · route unavailable                        "
+  style 2-67 dim
+11| "    current · live · main-session                                                           "
+  style 2-32 dim
+12| "    workspace /workspace/project                                                            "
+  style 2-31 dim
+13| "    unavailable: current session                                                            "
+  style 2-31 fg=yellow
+14| "    Other workspace work                                                                    "
+15| "    2024-02-02T00:00:08.000Z · turn 1: completed · deepseek/deepseek-v4-pro                 "
+  style 2-74 dim
+16| "    persisted · elsewhere-session                                                           "
+  style 2-32 dim
+17| "    workspace /workspace/other                                                              "
+  style 2-29 dim
+18| "    Resume selector design                                                                  "
+19| "    2024-01-01T00:00:08.000Z · turn 1: completed · deepseek/deepseek-v4-pro                 "
+  style 2-74 dim
+20| "    persisted · earlier-session                                                             "
+  style 2-30 dim
+21| "    workspace /workspace/project                                                            "
+  style 2-31 dim
+22| "                                                                                            "
+23| "                                                                                            "
+24| "                                                                                            "
+25| "                                                                                            "
+26| "                                                                                            "
+27| "                                                                                            "
+28| "                                                                                            "
+29| "                                                                                            "
+30| "  Type to search  •  ↑/↓ navigate  •  Tab scope  •  Enter resume  •  Esc clear/cancel       "
+  style 2-84 dim
+31| "                                                                                            "
diff --git a/packages/ui/tui/tests/snapshots/resume-sessions.expected.txt b/packages/ui/tui/tests/snapshots/resume-sessions.expected.txt
index db54654115..fdd13c23e9 100644
--- a/packages/ui/tui/tests/snapshots/resume-sessions.expected.txt
+++ b/packages/ui/tui/tests/snapshots/resume-sessions.expected.txt
@@ -5,7 +5,7 @@ cursor hidden column=6 viewportRow=4 bufferRow=4
 buffer
 0| "                                                                                            "
 1| "  Resume session (1 of 2)                                                                   "
-  style 2-24 fg=bright-blue bold
+  style 2-24 fg=bright-magenta bold
 2| "                                                                                            "
 3| "  ╭──────────────────────────────────────────────────────────────────────────────────────╮  "
   style 2-89 dim
@@ -16,20 +16,21 @@ buffer
 5| "  ╰──────────────────────────────────────────────────────────────────────────────────────╯  "
   style 2-89 dim
 6| "                                                                                            "
-7| "  /workspace/project                                                                        "
-  style 2-19 fg=bright-black
+7| "  this workspace /workspace/project  ⇥ all workspaces (3)                                   "
+  style 2-34 fg=bright-magenta
+  style 35-56 dim
 8| "                                                                                            "
 9| "  ❯ Untitled session                                                                        "
-  style 2-19 fg=bright-blue bold
+  style 2-19 fg=bright-magenta bold
 10| "    2026-07-23T08:00:00.000Z · no completed turn · route unavailable                        "
-  style 2-67 fg=bright-black
+  style 2-67 dim
 11| "    current · live · main-session                                                           "
   style 2-32 dim
 12| "    unavailable: current session                                                            "
   style 2-31 fg=yellow
 13| "    Resume selector design                                                                  "
 14| "    2024-01-01T00:00:08.000Z · turn 1: completed · deepseek/deepseek-v4-pro                 "
-  style 2-74 fg=bright-black
+  style 2-74 dim
 15| "    persisted · earlier-session                                                             "
   style 2-30 dim
 16| "                                                                                            "
@@ -46,6 +47,6 @@ buffer
 27| "                                                                                            "
 28| "                                                                                            "
 29| "                                                                                            "
-30| "  Type to search  •  ↑/↓ navigate  •  Enter resume  •  Esc clear/cancel                     "
-  style 2-70 dim
+30| "  Type to search  •  ↑/↓ navigate  •  Tab scope  •  Enter resume  •  Esc clear/cancel       "
+  style 2-84 dim
 31| "                                                                                            "
diff --git a/packages/ui/tui/tests/snapshots/retry-cancelled.expected.txt b/packages/ui/tui/tests/snapshots/retry-cancelled.expected.txt
index 9f6b5e8c4f..d19a63f603 100644
--- a/packages/ui/tui/tests/snapshots/retry-cancelled.expected.txt
+++ b/packages/ui/tui/tests/snapshots/retry-cancelled.expected.txt
@@ -4,15 +4,15 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=12 bufferRow=12
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Start then cancel.                                                                              "
 6| <blank>
 7| "Retrying model request (1/∞) in 1000ms: temporary transport failure                             "
@@ -22,13 +22,13 @@ buffer
   style 0-14 fg=yellow
 10| <blank>
 11| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 12| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 13-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/retry-exhausted.expected.txt b/packages/ui/tui/tests/snapshots/retry-exhausted.expected.txt
index c642694132..5b1af5fc41 100644
--- a/packages/ui/tui/tests/snapshots/retry-exhausted.expected.txt
+++ b/packages/ui/tui/tests/snapshots/retry-exhausted.expected.txt
@@ -4,28 +4,28 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=10 bufferRow=10
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Let the bounded policy exhaust.                                                                 "
 6| <blank>
 7| "provider still unavailable                                                                      "
   style 0-25 fg=red
 8| <blank>
 9| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 10| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 11-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/retry-recovered.expected.txt b/packages/ui/tui/tests/snapshots/retry-recovered.expected.txt
index 4144bac651..33ae562990 100644
--- a/packages/ui/tui/tests/snapshots/retry-recovered.expected.txt
+++ b/packages/ui/tui/tests/snapshots/retry-recovered.expected.txt
@@ -4,28 +4,28 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=10 bufferRow=10
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Recover this request.                                                                           "
 6| <blank>
 7| "Retrying model request (1/2) in 500ms: provider rate limit                                      "
   style 0-57 fg=yellow
 8| <blank>
 9| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 10| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 11-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/retry-scheduled.expected.txt b/packages/ui/tui/tests/snapshots/retry-scheduled.expected.txt
index 4144bac651..33ae562990 100644
--- a/packages/ui/tui/tests/snapshots/retry-scheduled.expected.txt
+++ b/packages/ui/tui/tests/snapshots/retry-scheduled.expected.txt
@@ -4,28 +4,28 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=10 bufferRow=10
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Recover this request.                                                                           "
 6| <blank>
 7| "Retrying model request (1/2) in 500ms: provider rate limit                                      "
   style 0-57 fg=yellow
 8| <blank>
 9| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 10| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 11-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/session-reference.expected.txt b/packages/ui/tui/tests/snapshots/session-reference.expected.txt
index 3e0d12f045..f1927fe198 100644
--- a/packages/ui/tui/tests/snapshots/session-reference.expected.txt
+++ b/packages/ui/tui/tests/snapshots/session-reference.expected.txt
@@ -4,15 +4,15 @@ title "DSH session reference"
 cursor hidden column=7 viewportRow=14 bufferRow=14
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Session reference snapshot."
-  style 1-27 fg=bright-black
+  style 1-27 dim
 2| " target-session"
   style 1-14 dim
 3| <blank>
 4| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Use @Source session                                                                             "
 6| <blank>
 7| "Referenced sessions · Source session (source-session)                                           "
@@ -25,11 +25,11 @@ buffer
   style 0-46 dim
 12| <blank>
 13| "/workspace/project  mock  ↑0 ↓0"
-  style 0-17 fg=bright-blue bold
-  style 20-23 fg=bright-black
-  style 26-30 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 20-23 dim
+  style 26-30 dim
 14| " dsh ◍                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 15-23| <blank>
diff --git a/packages/ui/tui/tests/snapshots/session-title-autocomplete.expected.txt b/packages/ui/tui/tests/snapshots/session-title-autocomplete.expected.txt
index 0d374ee506..56b990d61c 100644
--- a/packages/ui/tui/tests/snapshots/session-title-autocomplete.expected.txt
+++ b/packages/ui/tui/tests/snapshots/session-title-autocomplete.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=14 viewportRow=8 bufferRow=8
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,15 +17,15 @@ viewport
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 8| " dsh > @design                                                                                  "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 14-14 inverse
 9| "       → Session · Searchable design re  opaque-source-id · /workspace/project · 1970-01-01T0   "
-  style 7-38 fg=bright-blue
+  style 7-38 fg=bright-magenta
 10-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/shell-prompt-multiline.expected.txt b/packages/ui/tui/tests/snapshots/shell-prompt-multiline.expected.txt
index 3b47364308..1b312834ed 100644
--- a/packages/ui/tui/tests/snapshots/shell-prompt-multiline.expected.txt
+++ b/packages/ui/tui/tests/snapshots/shell-prompt-multiline.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=38 viewportRow=13 bufferRow=13
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -17,9 +17,9 @@ viewport
   style 0-14 dim
 6| <blank>
 7| "/workspace/project (tui-staging)  deepseek-v"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-43 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-43 dim
 8| "       ↑ 1 more                             "
   style 1-14 dim
 9| " enough detail to wrap across multiple      "
diff --git a/packages/ui/tui/tests/snapshots/status-diagnostics-narrow.expected.txt b/packages/ui/tui/tests/snapshots/status-diagnostics-narrow.expected.txt
index 5bb673882a..58cc124b75 100644
--- a/packages/ui/tui/tests/snapshots/status-diagnostics-narrow.expected.txt
+++ b/packages/ui/tui/tests/snapshots/status-diagnostics-narrow.expected.txt
@@ -4,10 +4,10 @@ title "Inspect session diagnostics — DSH snapshot"
 cursor hidden column=7 viewportRow=35 bufferRow=43
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Inspect session diagnostics"
-  style 1-27 fg=bright-black
+  style 1-27 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -18,28 +18,28 @@ buffer
   style 0-14 dim
 7| <blank>
 8| "You                                                     "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 9| "inspect this session                                    "
 10| <blank>
 11| "╭─ Session status ─────────────────────────────────────╮"
   style 0-2 dim
-  style 3-16 fg=bright-blue bold
+  style 3-16 fg=bright-magenta bold
   style 17-55 dim
 12| "│  Session:    main-session                            │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 13| "│  Title:      Inspect session diagnostics             │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 14| "│  Directory:  /workspace/project                      │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 15| "│  Model:      deepseek/deepseek-v4-pro (effort        │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 40-55 dim
 16| "│              default; reasoning blocks shown)        │"
   style 0-0 dim
@@ -50,7 +50,7 @@ buffer
   style 55-55 dim
 18| "│  Agent:      idle · 7 events · 1 turn · 1 step · 1   │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 19| "│              tool call                               │"
   style 0-0 dim
@@ -60,13 +60,13 @@ buffer
   style 55-55 dim
 21| "│  Tokens:     1,250 input + 340 output                │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 22| "│  KV cache:   [███████████░░░░░] 67% hit (3,000 read  │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 15-15 dim
-  style 16-26 fg=bright-blue
+  style 16-26 fg=bright-magenta
   style 27-32 dim
   style 55-55 dim
 23| "│              + 250 write)                            │"
@@ -74,9 +74,9 @@ buffer
   style 55-55 dim
 24| "│  Context:    [█████░░░░░░░░░░░] 33% used (42,000 /   │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 15-15 dim
-  style 16-20 fg=bright-blue
+  style 16-20 fg=bright-magenta
   style 21-32 dim
   style 55-55 dim
 25| "│              128,000)                                │"
@@ -87,17 +87,17 @@ buffer
   style 55-55 dim
 27| "│  Created:    2026-07-22 09:10:11 UTC                 │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 28| "│  Active:     2026-07-22 09:10:11 UTC                 │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 55-55 dim
 29| "╰──────────────────────────────────────────────────────╯"
   style 0-55 dim
 30| <blank>
 31| "System prompt                                           "
-  style 0-12 fg=bright-blue bold
+  style 0-12 fg=bright-magenta bold
 32| "You are an AI agent powered by the DeepSeek Harness SDK."
 33| "                                                        "
 34| "Paths prefixed with @ are files explicitly referenced by"
@@ -106,15 +106,15 @@ buffer
 37| "reading it.                                             "
 38| <blank>
 39| "Registered tools                                        "
-  style 0-15 fg=bright-blue bold
+  style 0-15 fg=bright-magenta bold
 40| "read, write                                             "
 41| <blank>
 42| "/workspace/project (tui-staging)  deepseek-v4-pro  ↑1.3k"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-48 fg=bright-black
-  style 51-55 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-48 dim
+  style 51-55 dim
 43| " dsh >                                                  "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/packages/ui/tui/tests/snapshots/status-diagnostics.expected.txt b/packages/ui/tui/tests/snapshots/status-diagnostics.expected.txt
index cff733907e..b5f776918f 100644
--- a/packages/ui/tui/tests/snapshots/status-diagnostics.expected.txt
+++ b/packages/ui/tui/tests/snapshots/status-diagnostics.expected.txt
@@ -4,10 +4,10 @@ title "Inspect session diagnostics — DSH snapshot"
 cursor hidden column=7 viewportRow=31 bufferRow=37
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Inspect session diagnostics"
-  style 1-27 fg=bright-black
+  style 1-27 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -18,28 +18,28 @@ buffer
   style 0-14 dim
 7| <blank>
 8| "You                                                                                         "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 9| "inspect this session                                                                        "
 10| <blank>
 11| "╭─ Session status ───────────────────────────────────────────────────────────────╮"
   style 0-2 dim
-  style 3-16 fg=bright-blue bold
+  style 3-16 fg=bright-magenta bold
   style 17-81 dim
 12| "│  Session:    main-session                                                      │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 13| "│  Title:      Inspect session diagnostics                                       │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 14| "│  Directory:  /workspace/project                                                │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 15| "│  Model:      deepseek/deepseek-v4-pro (effort default; reasoning blocks shown) │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 40-79 dim
   style 81-81 dim
 16| "│                                                                                │"
@@ -47,27 +47,27 @@ buffer
   style 81-81 dim
 17| "│  Agent:      idle · 7 events · 1 turn · 1 step · 1 tool call                   │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 18| "│                                                                                │"
   style 0-0 dim
   style 81-81 dim
 19| "│  Tokens:     1,250 input + 340 output                                          │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 20| "│  KV cache:   [███████████░░░░░] 67% hit (3,000 read + 250 write)               │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 15-15 dim
-  style 16-26 fg=bright-blue
+  style 16-26 fg=bright-magenta
   style 27-32 dim
   style 81-81 dim
 21| "│  Context:    [█████░░░░░░░░░░░] 33% used (42,000 / 128,000)                    │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 15-15 dim
-  style 16-20 fg=bright-blue
+  style 16-20 fg=bright-magenta
   style 21-32 dim
   style 81-81 dim
 22| "│                                                                                │"
@@ -75,33 +75,33 @@ buffer
   style 81-81 dim
 23| "│  Created:    2026-07-22 09:10:11 UTC                                           │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 24| "│  Active:     2026-07-22 09:10:11 UTC                                           │"
   style 0-0 dim
-  style 3-12 fg=bright-black
+  style 3-12 dim
   style 81-81 dim
 25| "╰────────────────────────────────────────────────────────────────────────────────╯"
   style 0-81 dim
 26| <blank>
 27| "System prompt                                                                               "
-  style 0-12 fg=bright-blue bold
+  style 0-12 fg=bright-magenta bold
 28| "You are an AI agent powered by the DeepSeek Harness SDK.                                    "
 29| "                                                                                            "
 30| "Paths prefixed with @ are files explicitly referenced by the user. Use the read tool when   "
 31| "their contents are needed; do not claim to have inspected a file before reading it.         "
 32| <blank>
 33| "Registered tools                                                                            "
-  style 0-15 fg=bright-blue bold
+  style 0-15 fg=bright-magenta bold
 34| "read, write                                                                                 "
 35| <blank>
 36| "/workspace/project (tui-staging)  deepseek-v4-pro  ↑1.3k ↓340  cache 67%  33% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-48 fg=bright-black
-  style 51-71 fg=bright-black
-  style 74-84 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-48 dim
+  style 51-71 dim
+  style 74-84 dim
 37| " dsh >                                                                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/packages/ui/tui/tests/snapshots/step-timing-completed.expected.txt b/packages/ui/tui/tests/snapshots/step-timing-completed.expected.txt
index 728d7116b5..1e19c6a32b 100644
--- a/packages/ui/tui/tests/snapshots/step-timing-completed.expected.txt
+++ b/packages/ui/tui/tests/snapshots/step-timing-completed.expected.txt
@@ -4,31 +4,31 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=11 bufferRow=11
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "Assistant                                                                                       "
   style 0-8 fg=bright-magenta bold underline
 5| "Reasoning                                                                                       "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 6| "Checking the result.                                                                            "
-  style 0-19 fg=bright-black italic
+  style 0-19 dim italic
 7| "The result is ready.                                                                            "
 8| "Model wait 1.0s · Thinking 2.0s · Response 3.0s · Completed 2026-07-21 14:32:12                 "
   style 0-78 dim
 9| <blank>
 10| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 11| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 12-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/surface-after-compaction-narrow.expected.txt b/packages/ui/tui/tests/snapshots/surface-after-compaction-narrow.expected.txt
index 4eeb12de71..e1686f3574 100644
--- a/packages/ui/tui/tests/snapshots/surface-after-compaction-narrow.expected.txt
+++ b/packages/ui/tui/tests/snapshots/surface-after-compaction-narrow.expected.txt
@@ -1,13 +1,13 @@
 terminal 44x18 buffer=normal length=18 base=0 viewport=0
 lifecycle started=1 stopped=0 progress=inactive
 title "DSH snapshot"
-cursor hidden column=7 viewportRow=15 bufferRow=15
+cursor hidden column=7 viewportRow=14 bufferRow=14
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -16,21 +16,22 @@ buffer
 5| "Model wait 0.0s                             "
   style 0-14 dim
 6| <blank>
-7| "Context · workspace-context                 "
+7| "Context · workspace-context"
   style 0-26 dim
-8| "system-reminder                             "
-  style 0-14 fg=bright-black
-9| "  Additional instructions from:             "
-10| "nested/AGENTS.md                            "
-11| "                                            "
-12| "  Render workspace context XML clearly.     "
-13| <blank>
-14| "/workspace/project (tui-staging)  deepseek-v"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-43 fg=bright-black
-15| " dsh >                                      "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+8| "Additional instructions from:               "
+  style 0-43 dim
+9| "nested/AGENTS.md                            "
+  style 0-15 dim
+10| "                                            "
+11| "Render workspace context XML clearly.       "
+  style 0-36 dim
+12| <blank>
+13| "/workspace/project (tui-staging)  deepseek-v"
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-43 dim
+14| " dsh >                                      "
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
-16-17| <blank>
+15-17| <blank>
diff --git a/packages/ui/tui/tests/snapshots/surface-after-compaction-wide.expected.txt b/packages/ui/tui/tests/snapshots/surface-after-compaction-wide.expected.txt
index 74ca972da9..0724786b40 100644
--- a/packages/ui/tui/tests/snapshots/surface-after-compaction-wide.expected.txt
+++ b/packages/ui/tui/tests/snapshots/surface-after-compaction-wide.expected.txt
@@ -1,13 +1,13 @@
 terminal 104x30 buffer=normal length=30 base=0 viewport=0
 lifecycle started=1 stopped=0 progress=inactive
 title "DSH snapshot"
-cursor hidden column=7 viewportRow=14 bufferRow=14
+cursor hidden column=7 viewportRow=13 bufferRow=13
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -16,22 +16,22 @@ buffer
 5| "Model wait 0.0s                                                                                         "
   style 0-14 dim
 6| <blank>
-7| "Context · workspace-context                                                                             "
+7| "Context · workspace-context"
   style 0-26 dim
-8| "system-reminder                                                                                         "
-  style 0-14 fg=bright-black
-9| "  Additional instructions from: nested/AGENTS.md                                                        "
-10| "                                                                                                        "
-11| "  Render workspace context XML clearly.                                                                 "
-12| <blank>
-13| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
-14| " dsh >                                                                                                  "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+8| "Additional instructions from: nested/AGENTS.md                                                          "
+  style 0-45 dim
+9| "                                                                                                        "
+10| "Render workspace context XML clearly.                                                                   "
+  style 0-36 dim
+11| <blank>
+12| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
+13| " dsh >                                                                                                  "
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
-15-29| <blank>
+14-29| <blank>
diff --git a/packages/ui/tui/tests/snapshots/surface-before-compaction.expected.txt b/packages/ui/tui/tests/snapshots/surface-before-compaction.expected.txt
index 54f04ef787..cf3915dab7 100644
--- a/packages/ui/tui/tests/snapshots/surface-before-compaction.expected.txt
+++ b/packages/ui/tui/tests/snapshots/surface-before-compaction.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=20 bufferRow=20
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -15,33 +15,36 @@ buffer
   style 0-8 fg=bright-magenta bold underline
 5| <blank>
 6| "You                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 7| "Old prompt with a long line that exercises wrapping before compaction.          "
 8| <blank>
 9| "● Tool / bash / Run the coverage gate"
   style 0-36 fg=green
 10| "$ pnpm run test:coverage                                                        "
-  style 0-23 fg=cyan
+  style 0-23 dim
 11| "/workspace/project                                                              "
   style 0-17 dim
 12| "packages/ui/tui 100%                                                            "
+  style 0-19 dim
 13| "… +1 lines (Ctrl+O to expand)                                                   "
   style 0-28 dim
 14| "1 test skipped                                                                  "
+  style 0-13 dim
 15| "coverage complete                                                               "
+  style 0-16 dim
 16| "[exit 0]                                                                        "
   style 0-7 dim
 17| "Model wait 0.0s                                                                 "
   style 0-14 dim
 18| <blank>
 19| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 20| " dsh >                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 21-23| <blank>
diff --git a/packages/ui/tui/tests/snapshots/todo-plan-cleared.expected.txt b/packages/ui/tui/tests/snapshots/todo-plan-cleared.expected.txt
index 0f4c9ea0ab..85faa9a867 100644
--- a/packages/ui/tui/tests/snapshots/todo-plan-cleared.expected.txt
+++ b/packages/ui/tui/tests/snapshots/todo-plan-cleared.expected.txt
@@ -4,10 +4,10 @@ title "DSH snapshot"
 cursor hidden column=7 viewportRow=15 bufferRow=15
 viewport
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Snapshot agent ready."
-  style 1-21 fg=bright-black
+  style 1-21 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -18,21 +18,21 @@ viewport
   style 0-46 dim
 7| <blank>
 8| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 9| "Plan the work.                                                                                  "
 10| <blank>
 11| "You                                                                                             "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 12| "Next question.                                                                                  "
 13| <blank>
 14| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 15| " dsh >                                                                                          "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 16-35| <blank>
diff --git a/packages/ui/tui/tests/snapshots/untrusted-controls.expected.txt b/packages/ui/tui/tests/snapshots/untrusted-controls.expected.txt
index 506b89b0ba..74cdd416d9 100644
--- a/packages/ui/tui/tests/snapshots/untrusted-controls.expected.txt
+++ b/packages/ui/tui/tests/snapshots/untrusted-controls.expected.txt
@@ -4,10 +4,10 @@ title "Unsafe terminal title \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m"
 cursor hidden column=0 viewportRow=33 bufferRow=33
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Unsafe welcome \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m"
-  style 1-60 fg=bright-black
+  style 1-60 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
@@ -15,51 +15,52 @@ buffer
   style 0-8 fg=bright-magenta bold underline
 5| <blank>
 6| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 7| "Unsafe user \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                           "
 8| <blank>
 9| "● Tool / unsafe / Unsafe description \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m"
   style 0-81 fg=green
 10| "$ Unsafe title \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                        "
-  style 0-59 fg=cyan
+  style 0-59 dim
 11| "/unsafe/\\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                               "
   style 0-52 dim
 12| "Unsafe output \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                         "
+  style 0-58 dim
 13| "[signal SIG\\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m]                                           "
   style 0-56 fg=red
 14| "Model wait 0.0s · Completed 2026-07-21 15:00:00                                                     "
   style 0-46 dim
 15| <blank>
-16| "Context · unsafe-\\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                      "
+16| "Context · unsafe-\\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m"
   style 0-61 dim
 17| "Unsafe context \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                        "
-  style 0-59 fg=bright-black
+  style 0-59 dim
 18| <blank>
 19| "Unsafe turn error \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                     "
   style 0-62 fg=red
 20-21| <blank>
 22| "Plan"
-  style 0-3 fg=bright-blue bold
+  style 0-3 fg=bright-magenta bold
 23| "  ● Unsafe todo \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m"
   style 2-2 fg=yellow
 24| "/workspace/project (tui-staging)  deepseek-v4-flash  ↑0 ↓0  0% context"
-  style 0-17 fg=bright-blue bold
-  style 18-31 fg=bright-black
-  style 34-50 fg=bright-black
-  style 53-57 fg=bright-black
-  style 60-69 fg=bright-black
+  style 0-17 fg=bright-magenta bold
+  style 18-31 dim
+  style 34-50 dim
+  style 53-57 dim
+  style 60-69 dim
 25| " dsh >                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 26| "                                                                                                    "
 27| "  Question 1/1 (1 unanswered) · Unsafe header \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m         "
-  style 2-90 fg=bright-black
+  style 2-90 dim
 28| "  Unsafe question \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m                                     "
 29| "                                                                                                    "
 30| "  › 1. Unsafe option \\x1b]2;snapshot-controlled\\x07\\x09\\x7f\\x9b31m Unsafe detail \\x1b]2;snapshot-c  "
-  style 2-65 fg=bright-blue bold
-  style 67-97 fg=bright-black
+  style 2-65 fg=bright-magenta bold
+  style 67-97 dim
 31| "  Tab custom answer • Enter submit • Esc interrupt                                                  "
   style 2-49 dim
 32| "                                                                                                    "
diff --git a/packages/ui/tui/tests/tui.snapshot.ts b/packages/ui/tui/tests/tui.snapshot.ts
index 14be84af0f..adf1c071bd 100644
--- a/packages/ui/tui/tests/tui.snapshot.ts
+++ b/packages/ui/tui/tests/tui.snapshot.ts
@@ -7,7 +7,7 @@ import type { Context } from 'cordis'
 import { agentEvents } from '@deepseek-ai/dsh-agent'
 import { createUserMessage, CallId, type ContentBlock , createMessage, createToolResultMessage } from '@deepseek-ai/dsh-llm'
 import type {} from '@deepseek-ai/dsh-llm-retry'
-import { SessionId, type JsonValue, type Session } from '@deepseek-ai/dsh-session'
+import { SessionId, type JsonValue, type Session, type SessionEvent } from '@deepseek-ai/dsh-session'
 import SessionReferenceService from '@deepseek-ai/dsh-session-reference'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { type ToolDefinition, type ToolResultView } from '@deepseek-ai/dsh-tools'
@@ -51,10 +51,12 @@ const CHECKPOINTS = [
   'surface-after-compaction-narrow',
   'surface-after-compaction-wide',
   'model-selector',
+  'model-selector-filtered',
   'model-switching',
   'errors-and-help',
   'disposed-terminal',
   'resume-sessions',
+  'resume-sessions-all-workspaces',
   'status-diagnostics',
   'status-diagnostics-narrow',
   'todo-plan-cleared',
@@ -801,6 +803,10 @@ describe('TUI terminal-state snapshots', () => {
       harness.terminal.send('\r')
     })
     await checkpoint('model-selector', harness.terminal, { includeScrollback: true })
+    await renderAfter(harness, () => {
+      harness.terminal.send('pro')
+    })
+    await checkpoint('model-selector-filtered', harness.terminal, { includeScrollback: true })
     await renderAfter(harness, () => {
       harness.terminal.send('\x1b[B')
       harness.terminal.send('\r')
@@ -812,35 +818,33 @@ describe('TUI terminal-state snapshots', () => {
   it('opens the searchable resume selector with log-backed session summaries', async () => {
     const dateNow = vi.spyOn(Date, 'now').mockReturnValue(Date.parse('2026-07-23T08:00:00.000Z'))
     const earlier = { version: 0, id: SessionId('earlier-session'), createdAt: Date.parse('2024-01-01T00:00:00Z'), cwd: '/workspace/project' }
+    const elsewhere = { version: 0, id: SessionId('elsewhere-session'), createdAt: Date.parse('2024-02-02T00:00:00Z'), cwd: '/workspace/other' }
+    const log = (meta: typeof earlier, title: string, day: string): { meta: typeof earlier; events: SessionEvent[] } => ({
+      meta,
+      events: [
+        { type: 'turn/start', seq: 0, time: Date.parse(`${day}T00:00:01Z`), data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } },
+        { type: 'user/message', seq: 1, time: Date.parse(`${day}T00:00:02Z`), data: createUserMessage({ content: [{ type: 'text', text: 'restore the selector' }], source: { kind: 'user' } }), surfaceOp: 'append' },
+        { type: 'step/start', seq: 2, time: Date.parse(`${day}T00:00:03Z`), data: { turn: 1, step: 1 } },
+        { type: 'request/header', seq: 3, time: Date.parse(`${day}T00:00:04Z`), data: { header: { config: { provider: 'deepseek', model: 'deepseek-v4-pro' } }, reason: 'initial' } },
+        { type: 'assistant/message', seq: 4, time: Date.parse(`${day}T00:00:05Z`), data: {
+          turn: 1, step: 1,
+          message: createMessage({
+            role: 'assistant',
+            content: [{ type: 'text', text: 'ready' }],
+            source: { kind: 'model', provider: 'deepseek', model: 'deepseek-v4-pro' },
+          }),
+        }, surfaceOp: 'append' },
+        { type: 'step/end', seq: 5, time: Date.parse(`${day}T00:00:06Z`), data: { turn: 1, step: 1 } },
+        { type: 'turn/end', seq: 6, time: Date.parse(`${day}T00:00:07Z`), data: { turn: 1, reason: { kind: 'completed' } } },
+        { type: 'session/title', seq: 7, time: Date.parse(`${day}T00:00:08Z`), data: { title, messageSeqs: [1], source: { kind: 'fallback' } } },
+      ],
+    })
     const harness = await setupSnapshot({
-      config: { resumeCommand: 'dsh --resume {session}' },
       sessionPersistence: {
-        list: async () => [earlier],
-        load: async () => ({
-          meta: earlier,
-          events: [
-            { type: 'turn/start', seq: 0, time: Date.parse('2024-01-01T00:00:01Z'), data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } },
-            { type: 'user/message', seq: 1, time: Date.parse('2024-01-01T00:00:02Z'), data: createUserMessage({
-              content: [{ type: 'text', text: 'restore the selector' }], source: { kind: 'user' },
-            }), surfaceOp: 'append' },
-            { type: 'step/start', seq: 2, time: Date.parse('2024-01-01T00:00:03Z'), data: { turn: 1, step: 1 } },
-            { type: 'request/header', seq: 3, time: Date.parse('2024-01-01T00:00:04Z'), data: { header: { config: { provider: 'deepseek', model: 'deepseek-v4-pro' } }, reason: 'initial' } },
-            { type: 'assistant/message', seq: 4, time: Date.parse('2024-01-01T00:00:05Z'), data: {
-              turn: 1, step: 1,
-              message: createMessage({
-                role: 'assistant',
-                content: [{ type: 'text', text: 'ready' }],
-                source: {
-                  kind: 'model',
-                  ...{ provider: 'deepseek', model: 'deepseek-v4-pro' },
-                },
-              }),
-            }, surfaceOp: 'append' },
-            { type: 'step/end', seq: 5, time: Date.parse('2024-01-01T00:00:06Z'), data: { turn: 1, step: 1 } },
-            { type: 'turn/end', seq: 6, time: Date.parse('2024-01-01T00:00:07Z'), data: { turn: 1, reason: { kind: 'completed' } } },
-            { type: 'session/title', seq: 7, time: Date.parse('2024-01-01T00:00:08Z'), data: { title: 'Resume selector design', messageSeqs: [1], source: { kind: 'fallback' } } },
-          ],
-        }),
+        list: async () => [earlier, elsewhere],
+        load: async id => id === elsewhere.id
+          ? log(elsewhere, 'Other workspace work', '2024-02-02')
+          : log(earlier, 'Resume selector design', '2024-01-01'),
       },
     }, { columns: 92, rows: 32 })
     harness.terminal.send('/resume')
@@ -850,6 +854,12 @@ describe('TUI terminal-state snapshots', () => {
     await new Promise(resolve => setTimeout(resolve, 60))
     await harness.terminal.flush()
     await checkpoint('resume-sessions', harness.terminal, { includeScrollback: true })
+    // Tab switches to the all-workspaces scope, which adds the other workspace's
+    // session and labels every row with the directory it belongs to.
+    harness.terminal.send('\t')
+    await new Promise(resolve => setTimeout(resolve, 60))
+    await harness.terminal.flush()
+    await checkpoint('resume-sessions-all-workspaces', harness.terminal, { includeScrollback: true })
     await disposeSnapshot(harness)
     dateNow.mockRestore()
   })
diff --git a/packages/ui/tui/tests/tui.spec.ts b/packages/ui/tui/tests/tui.spec.ts
index a7e7488674..e918f9b299 100644
--- a/packages/ui/tui/tests/tui.spec.ts
+++ b/packages/ui/tui/tests/tui.spec.ts
@@ -36,6 +36,7 @@ import {
   type TuiRuntime,
 } from '../src/index.ts'
 import { WorkspaceFileSearch } from '../src/chat/file-autocomplete.ts'
+import { ATTRIBUTE_ROLES, COLOR_ROLES, paletteSpec } from '../src/components/theme.ts'
 import {
   appendAssistant,
   appendUser,
@@ -180,7 +181,7 @@ describe('TUI config', () => {
         color: true,
         truecolor: false,
         leftPrompt: '${cwd}${git/worktree}${model}${token_meter/cache_hit_rate}${context}',
-        rightPrompt: '${timing}',
+        rightPrompt: '${queued}',
         inputPrompt: '${symbol} ${indicator}',
         inputPlaceholder: 'press enter to steer and esc to cancel',
       },
@@ -220,7 +221,7 @@ describe('TUI config', () => {
         color: false,
         truecolor: true,
         leftPrompt: '${cwd}${git/worktree}${model}${token_meter/cache_hit_rate}${context}',
-        rightPrompt: '${timing}',
+        rightPrompt: '${queued}',
         inputPrompt: '${symbol} ${indicator}',
         inputPlaceholder: 'press enter to steer and esc to cancel',
       },
@@ -229,8 +230,7 @@ describe('TUI config', () => {
   })
 })
 
-describe('resume command and /resume', () => {
-  const RESUME = 'dsh --resume {session}'
+describe('goodbye message and /resume', () => {
   const header = (id: string, createdAt: number, cwd: string): SessionHeader =>
     ({ version: 0, id: SessionId(id), createdAt, cwd })
   const resumeEvents = (
@@ -261,11 +261,10 @@ describe('resume command and /resume', () => {
     { type: 'session/title', seq: 7, time: time + 7, data: { title, messageSeqs: [1], source: { kind: 'fallback' } } },
   ]
 
-  it('prints the resume command on exit once the session is persisted', async () => {
+  it('prints the host goodbye message on exit', async () => {
     const result = await setup({
       cwd: '/workspace',
-      config: { resumeCommand: RESUME },
-      sessionPersistence: { list: async () => [header('main-session', 1000, '/workspace')] },
+      goodbyeMessage: 'To resume this session: dsh --resume main-session',
     })
     result.terminal.send('/exit')
     result.terminal.send('\r')
@@ -275,8 +274,8 @@ describe('resume command and /resume', () => {
     await dispose(result)
   })
 
-  it('omits the exit hint when the session is not yet persisted', async () => {
-    const result = await setup({ cwd: '/workspace', config: { resumeCommand: RESUME } })
+  it('prints nothing on exit when the host supplies no goodbye message', async () => {
+    const result = await setup({ cwd: '/workspace' })
     result.terminal.send('/exit')
     result.terminal.send('\r')
     await tick()
@@ -285,17 +284,16 @@ describe('resume command and /resume', () => {
     await dispose(result)
   })
 
-  it('omits the exit hint when the session listing fails', async () => {
+  it('escapes terminal controls in the host goodbye message', async () => {
     const result = await setup({
       cwd: '/workspace',
-      config: { resumeCommand: RESUME },
-      sessionPersistence: { list: () => Promise.reject(new Error('disk gone')) },
+      goodbyeMessage: 'resume \u001b]2;hijacked\u0007now',
     })
     result.terminal.send('/exit')
     result.terminal.send('\r')
     await tick()
-    expect(result.terminal.output).not.toContain('To resume this session')
-    expect(result.exit).toHaveBeenCalledWith(0)
+    expect(result.terminal.output).toContain('resume \\x1b]2;hijacked\\x07now')
+    expect(result.terminal.output).not.toContain('\u001b]2;hijacked')
     await dispose(result)
   })
 
@@ -305,7 +303,6 @@ describe('resume command and /resume', () => {
     const handoff = vi.fn<NonNullable<TuiRuntime['handoffResume']>>()
     const result = await setup({
       cwd: '/workspace',
-      config: { resumeCommand: RESUME },
       handoffResume: handoff,
       sessionPersistence: {
         list: async () => [older, newer, header('foreign-session', 3000, '/elsewhere')],
@@ -323,7 +320,10 @@ describe('resume command and /resume', () => {
     expect(output).toContain('Older investigation')
     expect(output).toContain('current · live')
     expect(output.indexOf('Newer product work')).toBeLessThan(output.indexOf('Older investigation'))
+    // Default scope is the current workspace; one of the four records (three
+    // listed plus the live current session) belongs to another.
     expect(output).not.toContain('foreign-session')
+    expect(output).toContain('all workspaces (4)')
     result.terminal.send('Older')
     await tick()
     expect(result.terminal.output).toContain('⌕ Older')
@@ -351,7 +351,9 @@ describe('resume command and /resume', () => {
     await tick(); await tick()
     result.terminal.send('\x1b[B')
     result.terminal.send('\x1b[A')
-    result.terminal.send('\t')
+    // A key the search editor swallows without changing its value (backspace on
+    // an empty box) keeps the selection and error untouched.
+    result.terminal.send('\x7f')
     result.terminal.send('zz')
     result.terminal.send('\r')
     await tick()
@@ -602,7 +604,6 @@ describe('resume command and /resume', () => {
     const corrupt = header('corrupt', 30, '/workspace')
     const result = await setup({
       cwd: '/workspace',
-      config: { resumeCommand: RESUME },
       sessionPersistence: {
         list: async () => [missing, corrupt],
         load: async (id) => {
@@ -683,7 +684,7 @@ describe('resume command and /resume', () => {
     await dispose(result)
   })
 
-  it('flushes, releases the terminal, and invokes one host handoff for the same SessionId', async () => {
+  it('flushes, releases the terminal, and invokes one host handoff for the same SessionId and workspace', async () => {
     const target = header('target-session', 10, '/workspace')
     const handoff = vi.fn<NonNullable<TuiRuntime['handoffResume']>>(() => Promise.reject(new Error('test host retained process')))
     const result = await setup({
@@ -701,7 +702,7 @@ describe('resume command and /resume', () => {
     result.terminal.send('\r')
     await tick(); await tick()
     expect(handoff).toHaveBeenCalledTimes(1)
-    expect(handoff).toHaveBeenCalledWith(target.id)
+    expect(handoff).toHaveBeenCalledWith(target.id, '/workspace')
     expect(result.terminal.stopped).toBeGreaterThan(0)
     expect(result.terminal.output).toContain('Resume handoff failed: test host retained process')
     await dispose(result)
@@ -817,7 +818,7 @@ describe('resume command and /resume', () => {
     result.terminal.send('Query without persistence')
     result.terminal.send('\r')
     await tick(); await tick()
-    expect(handoff).toHaveBeenCalledWith(target.id)
+    expect(handoff).toHaveBeenCalledWith(target.id, '/workspace')
     expect(result.terminal.output).toContain('Resume handoff failed: test host retained process')
     await dispose(result)
   })
@@ -902,16 +903,23 @@ describe('resume command and /resume', () => {
     expect(result.terminal.output).not.toContain('host rejected after disposal')
   })
 
-  it('rejects a candidate whose cwd changes between listing and preflight', async () => {
+  // A cwd that changes between listing and preflight is no longer a rejection:
+  // resume targets whatever workspace the record names at preflight, so the
+  // handoff must carry the RE-READ cwd rather than the one the row displayed.
+  it('hands off with the cwd re-read at preflight, not the one listed', async () => {
     const target = header('moving-workspace', 10, '/workspace')
+    const moved = header('moving-workspace', 10, '/elsewhere')
+    const handoff = vi.fn<NonNullable<TuiRuntime['handoffResume']>>(
+      () => Promise.reject(new Error('test host retained process')),
+    )
     let listings = 0
     const result = await setup({
       cwd: '/workspace',
-      handoffResume: vi.fn(),
+      handoffResume: handoff,
       sessionPersistence: {
-        list: async () => [++listings <= 2 ? target : header('moving-workspace', 10, '/elsewhere')],
+        list: async () => [++listings <= 2 ? target : moved],
         load: async () => ({
-          meta: listings <= 2 ? target : header('moving-workspace', 10, '/elsewhere'),
+          meta: listings <= 2 ? target : moved,
           events: resumeEvents('Moving workspace'),
         }),
       },
@@ -922,7 +930,101 @@ describe('resume command and /resume', () => {
     result.terminal.send('Moving workspace')
     result.terminal.send('\r')
     await tick(); await tick()
-    expect(result.terminal.output).toContain('different workspace')
+    expect(handoff).toHaveBeenCalledWith(target.id, '/elsewhere')
+    await dispose(result)
+  })
+
+  it('keeps a session with no recorded workspace visible but disabled', async () => {
+    // The key is omitted, not set to undefined: an explicit undefined is not
+    // losslessly JSON-serializable and the header validator rejects it.
+    const { cwd: _cwd, ...rootless } = header('no-workspace', 10, '/workspace')
+    const handoff = vi.fn<NonNullable<TuiRuntime['handoffResume']>>()
+    const result = await setup({
+      cwd: '/workspace',
+      handoffResume: handoff,
+      sessionPersistence: {
+        list: async () => [rootless],
+        load: async () => ({ meta: rootless, events: resumeEvents('Rootless session') }),
+      },
+    })
+    result.terminal.send('/resume')
+    result.terminal.send('\r')
+    await tick(); await tick()
+    // A cwd-less session lists under all workspaces, never the current one.
+    result.terminal.send('\t')
+    await tick()
+    result.terminal.send('Rootless session')
+    result.terminal.send('\r')
+    await tick()
+    expect(result.terminal.output).toContain('session has no recorded workspace')
+    expect(handoff).not.toHaveBeenCalled()
+    await dispose(result)
+  })
+
+  it('lists other workspaces only in the all-workspaces scope and resumes into their cwd', async () => {
+    const local = header('local-session', 2000, '/workspace')
+    const foreign = header('foreign-session', 3000, '/elsewhere')
+    const handoff = vi.fn<NonNullable<TuiRuntime['handoffResume']>>(
+      () => Promise.reject(new Error('test host retained process')),
+    )
+    const result = await setup({
+      cwd: '/workspace',
+      handoffResume: handoff,
+      sessionPersistence: {
+        list: async () => [local, foreign],
+        load: async id => id === local.id
+          ? { meta: local, events: resumeEvents('Local product work') }
+          : { meta: foreign, events: resumeEvents('Foreign investigation') },
+      },
+    })
+    result.terminal.send('/resume')
+    result.terminal.send('\r')
+    await tick(); await tick()
+    // Three records: the two listed plus the live current session.
+    expect(result.terminal.output).toContain('Local product work')
+    expect(result.terminal.output).not.toContain('Foreign investigation')
+    expect(result.terminal.output).toContain('all workspaces (3)')
+    result.terminal.send('\t')
+    await tick()
+    const scoped = result.terminal.output.slice(result.terminal.output.lastIndexOf('Resume session'))
+    expect(scoped).toContain('Foreign investigation')
+    expect(scoped).toContain('workspace /elsewhere')
+    expect(scoped).toContain('this workspace (2)')
+    // Searching the workspace label reaches a row the title would not match.
+    result.terminal.send('elsewhere')
+    result.terminal.send('\r')
+    await tick(); await tick()
+    expect(handoff).toHaveBeenCalledWith(foreign.id, '/elsewhere')
+    await dispose(result)
+  })
+
+  it('returns to the current workspace when Tab toggles back and clears the search', async () => {
+    const local = header('scope-local', 2000, '/workspace')
+    const foreign = header('scope-foreign', 3000, '/elsewhere')
+    const result = await setup({
+      cwd: '/workspace',
+      handoffResume: vi.fn(),
+      sessionPersistence: {
+        list: async () => [local, foreign],
+        load: async id => id === local.id
+          ? { meta: local, events: resumeEvents('Scope local') }
+          : { meta: foreign, events: resumeEvents('Scope foreign') },
+      },
+    })
+    result.terminal.send('/resume')
+    result.terminal.send('\r')
+    await tick(); await tick()
+    result.terminal.send('\t')
+    await tick()
+    result.terminal.send('Scope foreign')
+    await tick()
+    expect(result.terminal.output).toContain('⌕ Scope foreign')
+    result.terminal.send('\t')
+    await tick()
+    const back = result.terminal.output.slice(result.terminal.output.lastIndexOf('Resume session'))
+    expect(back).not.toContain('⌕ Scope foreign')
+    expect(back).toContain('Scope local')
+    expect(back).not.toContain('Scope foreign')
     await dispose(result)
   })
 
@@ -1018,30 +1120,7 @@ describe('resume command and /resume', () => {
     await dispose(result)
   })
 
-  it('keeps resumeCommand as a displayed fallback when the host cannot hand off', async () => {
-    const target = header('fallback-session', 10, '/workspace')
-    const result = await setup({
-      cwd: '/workspace',
-      config: { resumeCommand: RESUME },
-      sessionPersistence: {
-        list: async () => [target],
-        load: async () => ({ meta: target, events: resumeEvents('Fallback target') }),
-      },
-    })
-    result.terminal.send('/resume')
-    result.terminal.send('\r')
-    await tick(); await tick()
-    result.terminal.send('Fallback target')
-    result.terminal.send('\r')
-    await vi.waitFor(() => {
-      expect(result.terminal.output).toContain('This host cannot hand off in place. Exit and run:')
-    })
-    expect(result.terminal.output).toContain('dsh --resume fallback-session')
-    expect(result.terminal.stopped).toBe(0)
-    await dispose(result)
-  })
-
-  it('keeps the selector independent from an absent command fallback', async () => {
+  it('warns without releasing the terminal when the host cannot hand off', async () => {
     const target = header('no-fallback-session', 10, '/workspace')
     const result = await setup({
       cwd: '/workspace',
@@ -1058,6 +1137,7 @@ describe('resume command and /resume', () => {
     await vi.waitFor(() => {
       expect(result.terminal.output).toContain('Session is resumable, but this host cannot hand it off in place')
     })
+    expect(result.terminal.stopped).toBe(0)
     await dispose(result)
   })
 
@@ -1330,10 +1410,16 @@ describe('pi-tui chat lifecycle and transcript', () => {
     expect(result.terminal.output).toContain('Steering')
     expect(result.terminal.output).toContain('user context')
     expect(result.terminal.output).toContain('Context · workspace-context')
-    expect(result.terminal.output).toContain('system-reminder')
+    // The redundant `system-reminder` frame element is dropped: the source label
+    // already names the context, so the card body starts at the instruction text.
     expect(result.terminal.output).toContain('Additional instructions from: nested/AGENTS.md')
-    expect(result.terminal.output).not.toContain('<system-reminder>')
-    expect(result.terminal.output).toContain('\\x9b')
+    expect(result.terminal.output).toContain('Render XML context clearly.')
+    // A one-line frame has no open/close line pair to strip, so its text renders as
+    // the prose it is. The card no longer parses context, so a character reference
+    // stays literal instead of expanding to the control character it names — which
+    // is why the expanded-C1 escaping the parser needed is no longer reachable here.
+    expect(result.terminal.output).toContain('&#155;')
+    expect(result.terminal.output).not.toContain('\u009b')
     expect(result.terminal.output).toContain('Context · goal') // goal-sourced injected context labels by kind
     expect(result.terminal.output).toContain('Turn cancelled')
     expect(result.terminal.progress).toContain(true)
@@ -1361,6 +1447,104 @@ describe('pi-tui chat lifecycle and transcript', () => {
     expect(result.terminal.drainInput).toHaveBeenCalledWith(100, 20)
   })
 
+  it('folds an injected-context card by default and expands it with Ctrl+O', async () => {
+    const result = await setup()
+    // A reminder body past the default 6-line budget so the collapsed card shows
+    // the expand marker and hides a middle line until Ctrl+O.
+    const instructions = Array.from({ length: 10 }, (_, index) => `instruction line ${index}`).join('\n')
+    result.session.append('user/message', createUserMessage({
+      content: [{ type: 'text', text: `<system-reminder>\n${instructions}\n</system-reminder>` }],
+      source: { kind: 'plugin', plugin: 'workspace-context' },
+    }), { surfaceOp: 'append' })
+    await tick()
+
+    // The redundant `system-reminder` frame element is dropped; the card is
+    // collapsed by default with the shared Ctrl+O expand marker.
+    expect(result.terminal.output).toContain('Context · workspace-context')
+    expect(result.terminal.output).not.toContain('system-reminder')
+    expect(result.terminal.output).toContain('lines (Ctrl+O to expand)')
+    expect(result.terminal.output).toContain('instruction line 0')
+    expect(result.terminal.output).not.toContain('instruction line 5')
+
+    result.terminal.send('\x0f')
+    await tick()
+    expect(result.terminal.output).toContain('Tool and context cards expanded.')
+    expect(result.terminal.output).toContain('instruction line 5')
+
+    // Third state: tool cards hide; a context card is injected instructions,
+    // not tool traffic, so it stays visible at its collapsed preview.
+    result.terminal.send('\x0f')
+    await tick()
+    expect(result.terminal.output).toContain('Tool cards hidden.')
+    // A repaint proves the context card SURVIVES the hidden phase: injected
+    // instructions are not tool traffic, so they stay at the collapsed preview.
+    result.terminal.send('\x0c')
+    await tick()
+    const hidden = result.terminal.output.slice(result.terminal.output.lastIndexOf('\x1b[2J'))
+    expect(hidden).toContain('Context · workspace-context')
+    // Fourth press returns to the collapsed default, closing the cycle.
+    result.terminal.send('\x0f')
+    await tick()
+    expect(result.terminal.output).toContain('Tool and context cards collapsed.')
+
+    // Context with no frame renders as muted prose under the header; a frame
+    // wrapping nothing renders header-only.
+    result.session.append('user/message', createUserMessage({
+      content: [{ type: 'text', text: 'plain reminder text, no tags' }],
+      source: { kind: 'plugin', plugin: 'plain-context' },
+    }), { surfaceOp: 'append' })
+    result.session.append('user/message', createUserMessage({
+      content: [{ type: 'text', text: '<system-reminder>\n</system-reminder>' }],
+      source: { kind: 'plugin', plugin: 'empty-context' },
+    }), { surfaceOp: 'append' })
+    // Only a matched open/close pair is a frame: an unpaired tag line is prose and
+    // survives, so a body is never silently truncated by a tag-like first line.
+    result.session.append('user/message', createUserMessage({
+      content: [{ type: 'text', text: '<available_skills>\nkept prose line\n</other-tag>' }],
+      source: { kind: 'plugin', plugin: 'unpaired-context' },
+    }), { surfaceOp: 'append' })
+    await tick()
+    expect(result.terminal.output).toContain('Context · plain-context')
+    expect(result.terminal.output).toContain('plain reminder text, no tags')
+    expect(result.terminal.output).toContain('Context · empty-context')
+    expect(result.terminal.output).toContain('<available_skills>')
+    expect(result.terminal.output).toContain('kept prose line')
+    // Ctrl+L invalidates the mounted tree, exercising the card's invalidate hook.
+    result.terminal.send('\x0c')
+    await tick()
+    await dispose(result)
+  })
+
+  it('renders XML-hostile instruction prose verbatim, framed and folded', async () => {
+    const result = await setup()
+    // Real AGENTS.md prose carries a raw `&` (a badge URL's `&logo=`) and
+    // angle-bracket placeholders that name nothing (`packages/<group>/<pkg>/`).
+    // Both are prose the model must read literally, and neither may affect whether
+    // the frame is stripped or the body folds.
+    const lines = Array.from({ length: 10 }, (_, index) => `prose line ${index}`).join('\n')
+    result.session.append('user/message', createUserMessage({
+      content: [{
+        type: 'text',
+        text: `<system-reminder>\nbadge: https://img.shields.io/badge/x?style=flat&logo=deepseek\npath: packages/<group>/<pkg>/\n${lines}\n</system-reminder>`,
+      }],
+      source: { kind: 'plugin', plugin: 'prose-context' },
+    }), { surfaceOp: 'append' })
+    await tick()
+
+    expect(result.terminal.output).toContain('Context · prose-context')
+    expect(result.terminal.output).not.toContain('<system-reminder>')
+    expect(result.terminal.output).toContain('lines (Ctrl+O to expand)')
+    expect(result.terminal.output).not.toContain('prose line 5')
+
+    result.terminal.send('\x0f')
+    await tick()
+    expect(result.terminal.output).toContain('prose line 5')
+    // Characters that break a strict XML parse survive unescaped and unexpanded.
+    expect(result.terminal.output).toContain('&logo=deepseek')
+    expect(result.terminal.output).toContain('packages/<group>/<pkg>/')
+    await dispose(result)
+  })
+
   it('counts failed and recovered request usage once per step', async () => {
     const result = await setup()
     result.session.append('assistant/chunk', {
@@ -1445,10 +1629,10 @@ describe('pi-tui chat lifecycle and transcript', () => {
     await dispose(result)
   })
 
-  it('badges queued steering on the prompt context timing and clears it as each drains', async () => {
+  it('badges queued steering on the prompt context and clears it as each drains', async () => {
     // Pin a cwd free of the substring under test; the prompt context renders the path.
     const result = await setup({ status: 'running', cwd: '/workspace' })
-    // Running with nothing queued: timing appears once in the prompt context and the editor keeps its hint.
+    // Running with nothing queued: the badge is absent and the editor keeps its hint.
     expect(result.terminal.output).toContain('Assistant')
     expect(result.terminal.output).toContain('Model wait 0.0s')
     expect(result.terminal.output).toContain('press enter to steer and esc to cancel')
@@ -1854,13 +2038,13 @@ describe('pi-tui chat lifecycle and transcript', () => {
     }
 
     // Without truecolor there is no per-frame gray: below the fade midpoint the
-    // glyph slot is blank; past it the glyph shows in the palette muted role
-    // (ANSI 90), never the accent (SGR 94).
+    // glyph slot is blank; past it the glyph shows in the palette dim role,
+    // never the accent (ANSI 95).
     const early = await frameAt(60)
     expect(early).not.toMatch(/dsh(?:\x1b\[[0-9;]*m| )*●/u)
     const shown = await frameAt(300)
-    expect(shown).toMatch(/\x1b\[90m●/u)
-    expect(shown).not.toMatch(/\x1b\[94m●/u)
+    expect(shown).toMatch(/\x1b\[2;39m●/u)
+    expect(shown).not.toMatch(/\x1b\[95m●/u)
 
     await dispose(result)
   })
@@ -2065,8 +2249,7 @@ describe('pi-tui chat lifecycle and transcript', () => {
     })
 
     expect(result.terminal.output).not.toContain('stale partial response')
-    result.terminal.send('/reasoning')
-    result.terminal.send('\r')
+    result.terminal.send('\x12')
     result.terminal.send('\x1b[A')
     result.terminal.send('\x1b[A')
     result.terminal.send('\x1b[A')
@@ -2231,8 +2414,7 @@ describe('pi-tui chat lifecycle and transcript', () => {
     expect(result.terminal.output).not.toContain('\u001B]2;unsafe\u0007')
 
     result.terminal.resize(56)
-    result.terminal.send('/redraw')
-    result.terminal.send('\r')
+    result.terminal.send('\x0c')
     await tick()
 
     await dispose(result)
@@ -2304,7 +2486,7 @@ describe('pi-tui chat lifecycle and transcript', () => {
     expect(result.agent.cancelled).toContainEqual({ kind: 'user' })
 
     result.agent.status = 'idle'
-    for (const command of ['/help', '/reasoning', '/tools', '/redraw', '/reload']) {
+    for (const command of ['/help', '/palette', '/reload']) {
       result.terminal.send(command)
       result.terminal.send('\r')
       await tick()
@@ -2321,7 +2503,7 @@ describe('pi-tui chat lifecycle and transcript', () => {
 
     expect(result.terminal.output).toContain('Keyboard shortcuts')
     expect(result.terminal.output).toContain('Reasoning blocks')
-    expect(result.terminal.output).toContain('Tool cards')
+    expect(result.terminal.output).toContain('Tool and context cards')
     expect(result.terminal.output).toContain('Unknown command')
     // /reload without a Loader in the context degrades to a warning.
     expect(result.terminal.output).toContain('/reload needs the cordis Loader')
@@ -3133,8 +3315,25 @@ describe('pi-tui chat lifecycle and transcript', () => {
     await vi.waitFor(() => {
       expect(result.terminal.output.slice(firstSelectorOutput)).toContain('Select model')
     })
+    const filterOpenOutput = result.terminal.output.length
+    result.terminal.send('beta')
+    await tick()
+    expect(result.terminal.output.slice(filterOpenOutput)).toContain('> beta')
+    expect(result.terminal.output.slice(filterOpenOutput)).toContain('beta/b1')
+    expect(result.terminal.output.slice(filterOpenOutput)).not.toContain('alpha/a1')
+    const noMatchOutput = result.terminal.output.length
+    result.terminal.send('zzz')
+    await tick()
+    expect(result.terminal.output.slice(noMatchOutput)).toContain('No models match the filter')
+    result.terminal.send('\x1b[D')
+    await tick()
+    expect(result.terminal.output.slice(noMatchOutput)).toContain('No models match the filter')
     result.terminal.send('\x1b')
     await tick()
+    const filterClearedOutput = result.terminal.output.length
+    result.terminal.send('\x1b')
+    await tick()
+    expect(result.terminal.output.slice(filterClearedOutput)).not.toContain('Select model')
 
     const providerDefaultOutput = result.terminal.output.length
     result.terminal.send('/model alpha/shared')
@@ -3669,6 +3868,23 @@ describe('skill slash command', () => {
     await dispose(result)
   })
 
+  it('auto-invokes a launcher-seeded initial skill as the first turn', async () => {
+    const result = await setup({ config: { initialSkill: 'demo-skill' }, configureContext: withSkills })
+    // The seed rides the same path as a typed `/skill:demo-skill`, delivered
+    // once the chat is live; no user input is required.
+    await tick()
+    expect(result.agent.sent).toEqual([[{ type: 'text', text: '<skill name="demo-skill">\nDemo instructions body.\n</skill>' }]])
+    await dispose(result)
+  })
+
+  it('reports an unknown initial skill as a notice without sending', async () => {
+    const result = await setup({ config: { initialSkill: 'nope' }, configureContext: withSkills })
+    await tick()
+    expect(result.terminal.output).toContain('Unknown skill: nope')
+    expect(result.agent.sent).toEqual([])
+    await dispose(result)
+  })
+
   it('reports an unknown skill and an empty skill name without sending', async () => {
     const result = await setup({ configureContext: withSkills })
     result.terminal.send('/skill:does-not-exist')
@@ -3895,8 +4111,7 @@ describe('tool cards and surface replay', () => {
     }
     await tick()
     expect(result.terminal.output).toContain('$ raw command')
-    result.terminal.send('/reasoning')
-    result.terminal.send('\r')
+    result.terminal.send('\x12')
     await tick()
     expect(result.terminal.output).toContain('call presenter boom')
     expect(result.terminal.output).toContain('Symbol(input)')
@@ -4030,8 +4245,7 @@ describe('tool cards and surface replay', () => {
     expect(output).toContain('line (number="1"): hello')
     expect(output).not.toContain('<result>')
 
-    result.terminal.send('/redraw')
-    result.terminal.send('\r')
+    result.terminal.send('\x0c')
     await tick()
     const collapsed = result.terminal.output.slice(result.terminal.output.lastIndexOf('\x1b[2J'))
     expect(collapsed).toContain('Run command')
@@ -4041,7 +4255,7 @@ describe('tool cards and surface replay', () => {
     result.terminal.send('\x0f')
     await tick()
     expect(result.terminal.output).toContain('world')
-    expect(result.terminal.output).toContain('Tool cards expanded.')
+    expect(result.terminal.output).toContain('Tool and context cards expanded.')
     expect(result.terminal.output).not.toContain('tools:expanded')
     expect(result.terminal.output).toContain('+ created')
     expect(result.terminal.output).toContain('console')
@@ -4049,6 +4263,42 @@ describe('tool cards and surface replay', () => {
     // expanded (`+ after` is b.txt's new text; the footer counts both files).
     expect(result.terminal.output).toContain('+ after')
     expect(result.terminal.output).toContain('· 2 files')
+
+    // Third Ctrl+O phase hides every tool card: after a redraw the repainted
+    // frame carries no tool header at all, only the conversation.
+    result.terminal.send('\x0f')
+    await tick()
+    expect(result.terminal.output).toContain('Tool cards hidden.')
+    // A result for an untracked call mints a fallback card mid-hidden: it must
+    // adopt the current visibility instead of rendering collapsed.
+    result.session.append('tool/result', {
+      turn: 1, step: 1,
+      message: createToolResultMessage({
+        callId: 'untracked' as never,
+        content: [{ type: 'text', text: 'fallback result body' }],
+        isError: false,
+      }),
+    }, { surfaceOp: 'append' })
+    await tick()
+    result.terminal.send('\x0c')
+    await tick()
+    const hiddenFrame = result.terminal.output.slice(result.terminal.output.lastIndexOf('\x1b[2J'))
+    expect(hiddenFrame).not.toContain('Tool / bash')
+    expect(hiddenFrame).not.toContain('Run command')
+    expect(hiddenFrame).not.toContain('fallback result body')
+    // The dozen hidden cards leave no per-card blank rows behind: each card owns
+    // its leading gap, so the trimmed frame has no long blank run where the
+    // cards used to be.
+    const frameRows = hiddenFrame.split('\n').map(row => row.replaceAll(/\x1b\[[0-9;]*[A-Za-z]/g, '').trim())
+    const first = frameRows.findIndex(row => row.includes('Calling tools'))
+    expect(first).toBeGreaterThan(-1)
+    let blankRun = 0
+    let longestRun = 0
+    for (const row of frameRows.slice(first)) {
+      blankRun = row === '' ? blankRun + 1 : 0
+      longestRun = Math.max(longestRun, blankRun)
+    }
+    expect(longestRun).toBeLessThanOrEqual(2)
     await dispose(result)
   })
 
@@ -4075,6 +4325,46 @@ describe('tool cards and surface replay', () => {
     await dispose(result)
   })
 
+  it('drops blank rows from a terminal card result that the dim styling wraps', async () => {
+    const blankRowTools: Record<string, ToolDefinition> = {
+      trailing: {
+        name: 'trailing', description: '', parameters: {}, output: UNUSED_TOOL_OUTPUT, execute: async () => [],
+        presentCall: () => ({ card: 'terminal', title: 'printf out', description: 'Run it', cwd: '/tmp' }),
+        // Real command output ends in a newline, so the split yields a trailing blank row.
+        presentResult: () => ({ card: 'terminal', output: 'first\n\nlast\n', exitCode: 0 }),
+      },
+    }
+    // Color on: the dim wrapper is what makes a blank row non-empty, so the
+    // guard against wrapping one is only observable with ANSI enabled.
+    const result = await setup({ tools: blankRowTools, config: { theme: { color: true } } })
+    appendUser(result.session, 'run it')
+    appendAssistant(result.session, [
+      { type: 'tool-call', id: 'blank' as never, name: 'trailing', arguments: '{}' },
+    ])
+    result.session.append('tool/call', {
+      turn: 1, step: 1, callId: 'blank' as never, name: 'trailing', arguments: '{}',
+    })
+    result.session.append('tool/result', {
+      turn: 1, step: 1,
+      message: createToolResultMessage({
+        callId: 'blank' as never, content: [{ type: 'text', text: 'ignored' }], isError: false,
+      }),
+    }, { surfaceOp: 'append' })
+    await tick()
+    // Each output row is dim-wrapped, and the result's blank rows are dropped
+    // rather than kept as dim-wrapped empty strings: `last` is the row right
+    // after `first`, and no empty dim pair reaches the terminal.
+    expect(result.terminal.output).toContain('\x1b[2;39mfirst\x1b[22;39m')
+    expect(result.terminal.output).toContain('\x1b[2;39mlast\x1b[22;39m')
+    expect(result.terminal.output).not.toContain('\x1b[2;39m\x1b[22;39m')
+    const rows = result.terminal.output.split('\n')
+    const firstRow = rows.findIndex(row => row.includes('first'))
+    expect(firstRow).toBeGreaterThan(-1)
+    expect(rows[firstRow + 1]).toContain('last')
+    expect(rows[firstRow + 2]).toContain('[exit 0]')
+    await dispose(result)
+  })
+
   it('rebuilds after a surface replacement and hides shadowed tool calls', async () => {
     const result = await setup({ tools })
     appendUser(result.session, 'old prompt')
@@ -4311,7 +4601,6 @@ describe('TUI extension service', () => {
                 host.theme.accent(`${label} plugin overlay`),
                 [
                   host.theme.text('text'),
-                  host.theme.muted('muted'),
                   host.theme.dim('dim'),
                   host.theme.success('success'),
                   host.theme.warning('warning'),
@@ -4605,10 +4894,42 @@ describe('terminal mounting', () => {
     await ctx.fiber.dispose()
   })
 
-  it('detects a light terminal color scheme and switches from dark- to light-optimised ANSI codes', async () => {
+  it('prints every palette role through /palette, each painted by the code it reports', async () => {
     const result = await setup({ config: { theme: { color: true } } })
-    // Initial render uses dark-optimised palette: SGR 2 (dim) for dim text.
-    expect(result.terminal.output).toContain('\x1b[90mdeepseek-v4-flash')
+    const before = result.terminal.output.length
+    result.terminal.send('/palette')
+    result.terminal.send('\r')
+    await tick()
+    const printed = result.terminal.output.slice(before)
+
+    // Every declared role appears with its purpose, so a role added to the spec
+    // without a listing entry (or the reverse) fails here rather than silently
+    // going unlisted.
+    const spec = paletteSpec('dark')
+    for (const name of COLOR_ROLES) {
+      expect(printed).toContain(name)
+      expect(printed).toContain(spec.colors[name].purpose)
+    }
+    for (const name of ATTRIBUTE_ROLES) {
+      expect(printed).toContain(name)
+      expect(printed).toContain(spec.attributes[name].purpose)
+    }
+
+    // Each row is painted by the role it names, so the listing cannot report one
+    // code while rendering another: the sample carries the spec's own open code.
+    expect(printed).toContain(`\x1b[${spec.colors.accent.open}m`)
+    expect(printed).toContain(`\x1b[${spec.colors.dim.open}m`)
+    expect(printed).toContain(`\x1b[${spec.attributes.selected.open}m`)
+    // `text` is the terminal default, emitted as no escape at all.
+    expect(printed).toContain('no escape')
+    await dispose(result)
+  })
+
+  it('detects a light terminal color scheme and switches the scheme-dependent code role', async () => {
+    const result = await setup({ config: { theme: { color: true } } })
+    // `dim` is scheme-independent (SGR 2 over the default foreground), so the
+    // startup render carries it on both schemes; `code` is the role that varies.
+    expect(result.terminal.output).toContain('\x1b[2;39mdeepseek-v4-flash')
 
     // A report matching the current scheme is a no-op: no palette rebuild or
     // re-render (ESC [?997;1n = dark, the startup default).
@@ -4622,20 +4943,14 @@ describe('terminal mounting', () => {
     result.terminal.send('\x1b[?997;2n')
     await tick()
     await tick()
+    // The rebuild re-renders under the light palette, where `code` is ANSI 34
+    // (blue) rather than the dark scheme's ANSI 36 (cyan); `dim` is unchanged.
+    expect(result.terminal.output).toContain('\x1b[2;39mdeepseek-v4-flash')
 
-    // After switching to light-optimised palette: palette.dim uses ANSI 90
-    // (gray) instead of SGR 2. The header now uses \x1b[90m for the detail
-    // line. The cumulative output still contains the initial SGR 2 render,
-    // so we assert that a LATER write (appended after the scheme switch)
-    // uses ANSI 90 for the same header text.
-    expect(result.terminal.output).toContain('\x1b[90mdeepseek-v4-flash')
-
-    // Switch back to dark scheme.
     result.terminal.send('\x1b[?997;1n')
     await tick()
     await tick()
-    // After switching back, a new write uses SGR 2 for the header detail.
-    expect(result.terminal.output).toContain('\x1b[90mdeepseek-v4-flash')
+    expect(result.terminal.output).toContain('\x1b[2;39mdeepseek-v4-flash')
     await dispose(result)
   })
 
@@ -4656,8 +4971,8 @@ describe('terminal mounting', () => {
       cwd: join(homedir(), 'projects', 'dsh-tui'),
     })
     await tick()
-    expect(terminal.output).toContain('\x1b[94m~/')
-    expect(terminal.output).toContain('\x1b[90m (tui-staging)')
+    expect(terminal.output).toContain('\x1b[95m~/')
+    expect(terminal.output).toContain('\x1b[2;39m (tui-staging)')
     await disposeTuiTestHarness(result)
   })
   it('runs /reload against every file-backed loader subtree, reports completion, and rejects re-entry while in flight', async () => {
diff --git a/packages/ui/tui/tests/xml-tool-output.spec.ts b/packages/ui/tui/tests/xml-tool-output.spec.ts
index 62fb475d73..8efe1f0884 100644
--- a/packages/ui/tui/tests/xml-tool-output.spec.ts
+++ b/packages/ui/tui/tests/xml-tool-output.spec.ts
@@ -8,6 +8,7 @@ const render = (source: string, limit = 4, expanded = false): string[] | undefin
   text => text.replace(/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/gu, control =>
     `\\x${control.charCodeAt(0).toString(16).padStart(2, '0')}`),
   text => `[label]${text}[/label]`,
+  text => `[body]${text}[/body]`,
   count => `  … +${count} lines`,
 )
 
@@ -22,30 +23,38 @@ describe('unknown-tool XML rendering', () => {
   </content>
 </result>`)).toEqual([
       '[label]result[/label]',
-      '  [label]path:[/label] /tmp/a.txt',
-      '  [label]type:[/label] file',
+      '  [label]path:[/label] [body]/tmp/a.txt[/body]',
+      '  [label]type:[/label] [body]file[/body]',
       '  [label]content[/label]',
-      '    [label]line (number="1"):[/label] hello',
-      '    [label]line (number="2"):[/label] world',
+      '    [label]line (number="1"):[/label] [body]hello[/body]',
+      '    [label]line (number="2"):[/label] [body]world[/body]',
     ])
   })
 
   it('renders root text, CDATA, empty elements, and multiline nested text', () => {
     expect(render('  <result>\nfirst\nsecond\n</result>  ')).toEqual([
       '[label]result[/label]',
-      '  first',
-      '  second',
+      '  [body]first[/body]',
+      '  [body]second[/body]',
     ])
     expect(render('<result>\nfirst\nsecond\n</result>', 1, true)).toEqual([
       '[label]result[/label]',
-      '  first',
-      '  second',
+      '  [body]first[/body]',
+      '  [body]second[/body]',
     ])
     expect(render('<result><value><![CDATA[literal <xml>]]></value><empty /></result>')).toEqual([
       '[label]result[/label]',
-      '  [label]value:[/label] literal <xml>',
+      '  [label]value:[/label] [body]literal <xml>[/body]',
       '  [label]empty[/label]',
     ])
+    // An interior blank line stays the empty string: styling it would emit an
+    // escape-only row, which reads as a stray indented blank rather than a gap.
+    expect(render('<result>\nfirst\n\nsecond\n</result>', 4, true)).toEqual([
+      '[label]result[/label]',
+      '  [body]first[/body]',
+      '',
+      '  [body]second[/body]',
+    ])
   })
 
   it('previews each top-level child independently and expands all rows', () => {
@@ -53,13 +62,13 @@ describe('unknown-tool XML rendering', () => {
     expect(render(xml, 3)).toEqual([
       '[label]result[/label]',
       '  [label]first[/label]',
-      '    a',
+      '    [body]a[/body]',
       '  … +4 lines',
-      '    f',
+      '    [body]f[/body]',
       '  [label]second[/label]',
-      '    g',
+      '    [body]g[/body]',
       '  … +4 lines',
-      '    l',
+      '    [body]l[/body]',
     ])
     expect(render(xml, 3, true)).toHaveLength(15)
   })
@@ -68,10 +77,10 @@ describe('unknown-tool XML rendering', () => {
     const xml = `<result>${Array.from({ length: 8 }, (_, index) => `<item>${index}</item>`).join('')}</result>`
     expect(render(xml, 3)).toEqual([
       '[label]result[/label]',
-      '  [label]item:[/label] 0',
-      '  [label]item:[/label] 1',
+      '  [label]item:[/label] [body]0[/body]',
+      '  [label]item:[/label] [body]1[/body]',
       '  … +5 lines',
-      '  [label]item:[/label] 7',
+      '  [label]item:[/label] [body]7[/body]',
     ])
     expect(render(xml, 3, true)).toHaveLength(9)
   })
@@ -79,11 +88,11 @@ describe('unknown-tool XML rendering', () => {
   it('escapes control characters expanded from character references', () => {
     expect(render('<result attr="a&#155;b">tab&#9;csi&#155;</result>')).toEqual([
       '[label]result (attr="a\\\\x9bb")[/label]',
-      '  tab\\x09csi\\x9b',
+      '  [body]tab\\x09csi\\x9b[/body]',
     ])
     expect(render('<result><value><![CDATA[del\u007f]]></value></result>')).toEqual([
       '[label]result[/label]',
-      '  [label]value:[/label] del\\x7f',
+      '  [label]value:[/label] [body]del\\x7f[/body]',
     ])
   })
 

From d0548e0ac96dcd3f50f657812857ef1f209e51ec Mon Sep 17 00:00:00 2001
From: Turtle <turtle1999@deepseek.com>
Date: Wed, 29 Jul 2026 10:01:39 +0800
Subject: [PATCH 13/16] docs: regenerate TUI catalogs

---
 docs/config-catalog.md          | 10 +++++-----
 docs/cordis-catalog/services.md |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 5b9ece6019..f7ff742322 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -1845,12 +1845,12 @@ export interface Config extends TuiConfig {
   /** Exact shared agent/session identity driven by this terminal. Defaults to `main`. */
   sessionId?: string
   /**
-   * Shell command fallback printed on exit or after selecting a session when
-   * the host cannot hand off in place. Every `{session}` becomes the selected
-   * id; the TUI never executes this text. Absent disables only the fallback,
-   * not the interactive selector.
+   * Skill name auto-invoked as this session's first user turn, exactly as if
+   * the user typed `/skill:<name>`. Set only by a launcher for a fresh
+   * skill-guided session (`dsh migrate`/`dsh upgrade`); absent leaves the first
+   * turn to the user.
    */
-  resumeCommand?: string
+  initialSkill?: string
 }
 
 /** Interaction and presentation settings for the pi-tui terminal mode. */
diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md
index 6f32d656af..0d80e4be57 100644
--- a/docs/cordis-catalog/services.md
+++ b/docs/cordis-catalog/services.md
@@ -2152,7 +2152,7 @@ The concrete provider retains pi-tui, focus, and terminal lifecycle state. Plugi
 abstract openOverlay(request: TuiOverlayRequest): TuiOverlaySession
 ```
 
-Source: [`packages/ui/tui/src/index.ts:187`](../../packages/ui/tui/src/index.ts)
+Source: [`packages/ui/tui/src/index.ts:247`](../../packages/ui/tui/src/index.ts)
 
 ## `ctx.userInteraction` — `UserInteractionService`
 

From efb67365d3df69db39e2630e00a5634479432a95 Mon Sep 17 00:00:00 2001
From: Turtle <turtle1999@deepseek.com>
Date: Wed, 29 Jul 2026 10:03:38 +0800
Subject: [PATCH 14/16] test(tui): update assembled terminal snapshots

---
 .../bash-terminal-card/terminal.expected.txt  | 29 ++++----
 .../terminal.expected.txt                     | 30 ++++----
 .../snapshots/code-mode/terminal.expected.txt | 73 ++++++++++---------
 .../terminal.expected.txt                     | 37 +++++++---
 .../dynamic-workflow/terminal.expected.txt    | 54 ++++++++------
 .../terminal.expected.txt                     | 36 ++++-----
 .../parallel-file-reads/terminal.expected.txt | 24 +++---
 .../snapshots/todo-plan/terminal.expected.txt | 32 ++++----
 8 files changed, 175 insertions(+), 140 deletions(-)

diff --git a/examples/tui-agent/tests/snapshots/bash-terminal-card/terminal.expected.txt b/examples/tui-agent/tests/snapshots/bash-terminal-card/terminal.expected.txt
index 0d8f454204..2efc357338 100644
--- a/examples/tui-agent/tests/snapshots/bash-terminal-card/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/bash-terminal-card/terminal.expected.txt
@@ -4,29 +4,30 @@ title "Use the bash tool to — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=24 bufferRow=24
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Use the bash tool to"
-  style 1-20 fg=bright-black
+  style 1-20 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Use the bash tool to run exactly: echo TERMINAL_OK. Then reply with the single word DONE and stop.  "
 6| <blank>
 7| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 8| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 9| "The user wants me to run a simple bash command and then reply with \"DONE\".                          "
-  style 0-73 fg=bright-black italic
+  style 0-73 dim italic
 10| <blank>
 11| "● Tool / bash / Echo TERMINAL_OK to verify terminal access"
   style 0-57 fg=green
 12| "$ echo TERMINAL_OK                                                                                  "
-  style 0-17 fg=cyan
+  style 0-17 dim
 13| "TERMINAL_OK                                                                                         "
+  style 0-10 dim
 14| "[exit 0]                                                                                            "
   style 0-7 dim
 15| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
@@ -35,20 +36,20 @@ buffer
 17| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 18| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 19| "The command ran successfully and output \"TERMINAL_OK\". I should now reply with just \"DONE\".         "
-  style 0-90 fg=bright-black italic
+  style 0-90 dim italic
 20| "DONE                                                                                                "
 21| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 22| <blank>
 23| "/workspace/project  deepseek-v4-flash  ↑3.0k ↓115  cache 48%  3% contex"
-  style 0-46 fg=bright-blue bold
-  style 49-65 fg=bright-black
-  style 68-88 fg=bright-black
-  style 91-99 fg=bright-black
+  style 0-46 fg=bright-magenta bold
+  style 49-65 dim
+  style 68-88 dim
+  style 91-99 dim
 24| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 25-35| <blank>
diff --git a/examples/tui-agent/tests/snapshots/code-mode-dispatch-spill/terminal.expected.txt b/examples/tui-agent/tests/snapshots/code-mode-dispatch-spill/terminal.expected.txt
index 248ea2f4e7..f4208bf650 100644
--- a/examples/tui-agent/tests/snapshots/code-mode-dispatch-spill/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/code-mode-dispatch-spill/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Using ONE run_code program: call — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=26 bufferRow=26
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Using ONE run_code program: call"
-  style 1-32 fg=bright-black
+  style 1-32 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Using ONE run_code program: call the bash tool exactly once with the command seq 1 200 | awk        "
   style 77-99 fg=cyan
 6| "'{printf \"line %04d: the quick brown fox jumps over the lazy dog\\n\", $1}', then return ONLY the     "
@@ -22,36 +22,38 @@ buffer
 9| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 10| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 11| "The user wants me to write a single run_code program that calls bash exactly once with a specific   "
-  style 0-99 fg=bright-black italic
+  style 0-99 dim italic
 12| "command, then returns only the number of lines in its output.                                       "
-  style 0-60 fg=bright-black italic
+  style 0-60 dim italic
 13| <blank>
 14| "● Tool / run_code"
   style 0-16 fg=green
 15| "Count lines in seq/awk output                                                                       "
+  style 0-99 dim
 16| "200                                                                                                 "
+  style 0-99 dim
 17| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 18| <blank>
 19| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 20| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 21| "The result is 200 lines. The user wants me to reply with just that number and stop.                 "
-  style 0-82 fg=bright-black italic
+  style 0-82 dim italic
 22| "200                                                                                                 "
 23| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 24| <blank>
 25| "/workspace/project  deepseek-v4-flash  ↑123 ↓208  cache 99%  3% c"
-  style 0-52 fg=bright-blue bold
-  style 55-71 fg=bright-black
-  style 74-93 fg=bright-black
-  style 96-99 fg=bright-black
+  style 0-52 fg=bright-magenta bold
+  style 55-71 dim
+  style 74-93 dim
+  style 96-99 dim
 26| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 27-35| <blank>
diff --git a/examples/tui-agent/tests/snapshots/code-mode/terminal.expected.txt b/examples/tui-agent/tests/snapshots/code-mode/terminal.expected.txt
index 45879f889f..03d65530b1 100644
--- a/examples/tui-agent/tests/snapshots/code-mode/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/code-mode/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Using ONE run_code program: call — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=35 bufferRow=61
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Using ONE run_code program: call"
-  style 1-32 fg=bright-black
+  style 1-32 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Using ONE run_code program: call the bash tool twice — exactly echo CODE_ONE then exactly echo      "
   style 63-75 fg=cyan
   style 90-99 fg=cyan
@@ -24,37 +24,37 @@ buffer
 9| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 10| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 11| "The user wants me to write a single run_code program that:                                          "
-  style 0-35 fg=bright-black italic
+  style 0-35 dim italic
   style 36-43 fg=cyan
-  style 44-57 fg=bright-black italic
+  style 44-57 dim italic
 12| "1. Calls bash tool twice - first with echo CODE_ONE, then with echo CODE_TWO                        "
-  style 0-2 fg=bright-blue
-  style 3-8 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-8 dim italic
   style 9-12 fg=cyan
-  style 13-37 fg=bright-black italic
+  style 13-37 dim italic
   style 38-50 fg=cyan
-  style 51-62 fg=bright-black italic
+  style 51-62 dim italic
   style 63-75 fg=cyan
 13| "2. console.log exactly captured output                                                              "
-  style 0-2 fg=bright-blue
+  style 0-2 fg=bright-magenta
   style 3-13 fg=cyan
-  style 14-22 fg=bright-black italic
+  style 14-22 dim italic
   style 23-37 fg=cyan
 14| "3. Returns the two outputs joined with a plus sign                                                  "
-  style 0-2 fg=bright-blue
-  style 3-49 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-49 dim italic
 15| "                                                                                                    "
 16| "Let me think about the structure. The bash tool returns an object with stdout/stderr. I need to     "
-  style 0-37 fg=bright-black italic
+  style 0-37 dim italic
   style 38-41 fg=cyan
-  style 42-99 fg=bright-black italic
+  style 42-99 dim italic
 17| "extract the stdout text from each call.                                                             "
-  style 0-38 fg=bright-black italic
+  style 0-38 dim italic
 18| "                                                                                                    "
 19| "Looking at the bash output type:                                                                    "
-  style 0-31 fg=bright-black italic
+  style 0-31 dim italic
 20| "                                                                                                    "
 21| "                                                                                                    "
 22| "  {                                                                                                 "
@@ -90,51 +90,54 @@ buffer
 37| "                                                                                                    "
 38| "                                                                                                    "
 39| "So I need to access .stdout.text from each result.                                                  "
-  style 0-19 fg=bright-black italic
+  style 0-19 dim italic
   style 20-31 fg=cyan
-  style 32-49 fg=bright-black italic
+  style 32-49 dim italic
 40| "                                                                                                    "
 41| "Let me write the program.                                                                           "
-  style 0-24 fg=bright-black italic
+  style 0-24 dim italic
 42| <blank>
 43| "● Tool / run_code"
   style 0-16 fg=green
 44| "Call bash twice, log, join outputs                                                                  "
+  style 0-99 dim
 45| "captured output                                                                                     "
+  style 0-99 dim
 46| "CODE_ONE+CODE_TWO                                                                                   "
+  style 0-99 dim
 47| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 48| <blank>
 49| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 50| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 51| "The program ran successfully. The output shows:                                                     "
-  style 0-46 fg=bright-black italic
+  style 0-46 dim italic
 52| "- captured output (from console.log)                                                                "
-  style 0-1 fg=bright-blue
+  style 0-1 fg=bright-magenta
   style 2-16 fg=cyan
-  style 17-35 fg=bright-black italic
+  style 17-35 dim italic
 53| "- CODE_ONE+CODE_TWO (the returned joined string)                                                    "
-  style 0-1 fg=bright-blue
+  style 0-1 fg=bright-magenta
   style 2-18 fg=cyan
-  style 19-47 fg=bright-black italic
+  style 19-47 dim italic
 54| "                                                                                                    "
 55| "The user asked me to reply with that joined string only and stop. So I'll reply with just           "
-  style 0-99 fg=bright-black italic
+  style 0-99 dim italic
 56| "CODE_ONE+CODE_TWO.                                                                                  "
   style 0-16 fg=cyan
-  style 17-17 fg=bright-black italic
+  style 17-17 dim italic
 57| "CODE_ONE+CODE_TWO                                                                                   "
 58| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 59| <blank>
 60| "/workspace/project  deepseek-v4-flash  ↑182 ↓446  cache 98%  4% context"
-  style 0-37 fg=bright-blue bold
-  style 40-56 fg=bright-black
-  style 59-78 fg=bright-black
-  style 81-90 fg=bright-black
+  style 0-37 fg=bright-magenta bold
+  style 40-56 dim
+  style 59-78 dim
+  style 81-90 dim
 61| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/examples/tui-agent/tests/snapshots/cordis-dynamic-toolchain/terminal.expected.txt b/examples/tui-agent/tests/snapshots/cordis-dynamic-toolchain/terminal.expected.txt
index b4add028d8..7d6a92ea77 100644
--- a/examples/tui-agent/tests/snapshots/cordis-dynamic-toolchain/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/cordis-dynamic-toolchain/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Run this advanced flow exactly — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=35 bufferRow=58
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Run this advanced flow exactly"
-  style 1-30 fg=bright-black
+  style 1-30 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Run this advanced flow exactly once: try a no-op temporary Cordis Plugin named snapshot-marker; use "
 6| "run_code to inspect the live temporary Plugins through tools.cordis_inspect; delegate once to a     "
 7| "direct spawn child; run one workflow that delegates to another spawn child; stop dyn-1; then reply  "
@@ -24,8 +24,11 @@ buffer
 12| "● Tool / cordis_mount"
   style 0-20 fg=green
 13| "Mount temporary Cordis Plugin                                                                       "
+  style 0-99 dim
 14| "Temporary Plugin dyn-1 is running (plugin \"snapshot-marker\"; available until unmounted or DSH       "
+  style 0-99 dim
 15| "restarts).                                                                                          "
+  style 0-99 dim
 16| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 17| <blank>
@@ -35,13 +38,16 @@ buffer
 20| "● Tool / run_code"
   style 0-16 fg=green
 21| "Verify the temporary marker Plugin                                                                  "
+  style 0-99 dim
 22| "                                                                                                    "
 23| "Temporary Plugins                                                                                   "
-  style 0-16 fg=bright-blue bold
+  style 0-16 fg=bright-magenta bold dim
 24| "                                                                                                    "
 25| "- Temporary Plugin dyn-1: snapshot-marker [running] — provides: none; waiting for: none; lifetime:  "
-  style 0-1 fg=bright-blue
+  style 0-1 fg=bright-magenta dim
+  style 2-99 dim
 26| "  until unmounted or DSH restarts                                                                   "
+  style 0-99 dim
 27| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 28| <blank>
@@ -51,6 +57,7 @@ buffer
 31| "● Tool / subagent"
   style 0-16 fg=green
 32| "DIRECT_CHILD_OK                                                                                     "
+  style 0-99 dim
 33| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 34| <blank>
@@ -60,11 +67,17 @@ buffer
 37| "● Tool / workflow"
   style 0-16 fg=green
 38| "workflow: advanced-acp-snapshot                                                                     "
+  style 0-99 dim
 39| "workflow \"advanced-acp-snapshot\" completed (1 agent).                                               "
+  style 0-99 dim
 40| "Return value:                                                                                       "
+  style 0-99 dim
 41| "{                                                                                                   "
+  style 0-99 dim
 42| "  \"reply\": \"WORKFLOW_CHILD_OK\"                                                                      "
+  style 0-99 dim
 43| "}                                                                                                   "
+  style 0-99 dim
 44| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 45| <blank>
@@ -74,7 +87,9 @@ buffer
 48| "● Tool / cordis_unmount"
   style 0-22 fg=green
 49| "Unmount temporary Cordis Plugin dyn-1                                                               "
+  style 0-99 dim
 50| "Temporary Plugin dyn-1 was unmounted and removed.                                                   "
+  style 0-99 dim
 51| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 52| <blank>
@@ -85,11 +100,11 @@ buffer
   style 0-46 dim
 56| <blank>
 57| "/workspace/project  deepseek-v4-flash  ↑18 ↓18  cache 0%  8% cont"
-  style 0-52 fg=bright-blue bold
-  style 55-71 fg=bright-black
-  style 74-90 fg=bright-black
-  style 93-99 fg=bright-black
+  style 0-52 fg=bright-magenta bold
+  style 55-71 dim
+  style 74-90 dim
+  style 93-99 dim
 58| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/examples/tui-agent/tests/snapshots/dynamic-workflow/terminal.expected.txt b/examples/tui-agent/tests/snapshots/dynamic-workflow/terminal.expected.txt
index c704cb2399..ff8125c5ad 100644
--- a/examples/tui-agent/tests/snapshots/dynamic-workflow/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/dynamic-workflow/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Use the workflow tool exactly — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=35 bufferRow=42
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Use the workflow tool exactly"
-  style 1-29 fg=bright-black
+  style 1-29 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Use the workflow tool exactly once, with args omitted, meta set to { \"name\": \"snapshot-flow\",       "
 6| "\"description\": \"one child for the snapshot\" }, and this EXACT script body (copy it verbatim):       "
 7| "phase('Run')                                                                                        "
@@ -24,57 +24,63 @@ buffer
 13| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 14| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 15| "The user wants me to use the workflow tool exactly once with specific parameters. Let me carefully  "
-  style 0-99 fg=bright-black italic
+  style 0-99 dim italic
 16| "follow the instructions:                                                                            "
-  style 0-23 fg=bright-black italic
+  style 0-23 dim italic
 17| "                                                                                                    "
 18| "1. args omitted (so I don't include it)                                                             "
-  style 0-2 fg=bright-blue
-  style 3-38 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-38 dim italic
 19| "2. meta = { \"name\": \"snapshot-flow\", \"description\": \"one child for the snapshot\" }                  "
-  style 0-2 fg=bright-blue
-  style 3-81 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-81 dim italic
 20| "3. script = as given verbatim                                                                       "
-  style 0-2 fg=bright-blue
-  style 3-28 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-28 dim italic
 21| "4. After it returns, reply with \"WORKFLOW_DONE\"                                                     "
-  style 0-2 fg=bright-blue
-  style 3-46 fg=bright-black italic
+  style 0-2 fg=bright-magenta
+  style 3-46 dim italic
 22| "                                                                                                    "
 23| "Let me do exactly that.                                                                             "
-  style 0-22 fg=bright-black italic
+  style 0-22 dim italic
 24| <blank>
 25| "● Tool / workflow"
   style 0-16 fg=green
 26| "workflow: snapshot-flow                                                                             "
+  style 0-99 dim
 27| "workflow \"snapshot-flow\" completed (1 agent).                                                       "
+  style 0-99 dim
 28| "Return value:                                                                                       "
+  style 0-99 dim
 29| "{                                                                                                   "
+  style 0-99 dim
 30| "  \"reply\": \"WF_CHILD_OK\"                                                                            "
+  style 0-99 dim
 31| "}                                                                                                   "
+  style 0-99 dim
 32| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 33| <blank>
 34| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 35| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 36| "The workflow returned successfully with the reply \"WF_CHILD_OK\". Now I need to reply with exactly   "
-  style 0-99 fg=bright-black italic
+  style 0-99 dim italic
 37| "\"WORKFLOW_DONE\" and stop.                                                                           "
-  style 0-24 fg=bright-black italic
+  style 0-24 dim italic
 38| "WORKFLOW_DONE                                                                                       "
 39| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 40| <blank>
 41| "/workspace/project  deepseek-v4-flash  ↑3.5k ↓227  cache 47%  3% context"
-  style 0-44 fg=bright-blue bold
-  style 47-63 fg=bright-black
-  style 66-86 fg=bright-black
-  style 89-98 fg=bright-black
+  style 0-44 fg=bright-magenta bold
+  style 47-63 dim
+  style 66-86 dim
+  style 89-98 dim
 42| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
diff --git a/examples/tui-agent/tests/snapshots/multi-turn-conversation/terminal.expected.txt b/examples/tui-agent/tests/snapshots/multi-turn-conversation/terminal.expected.txt
index 09f3cb1fb4..c0c38592c3 100644
--- a/examples/tui-agent/tests/snapshots/multi-turn-conversation/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/multi-turn-conversation/terminal.expected.txt
@@ -4,59 +4,59 @@ title "Reply with exactly the word: — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=30 bufferRow=30
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Reply with exactly the word:"
-  style 1-28 fg=bright-black
+  style 1-28 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Reply with exactly the word: ONE. No tools.                                                         "
 6| <blank>
 7| "Plan mode on. Use /plan off to leave.                                                               "
-  style 0-36 fg=bright-black
+  style 0-36 dim
 8| <blank>
 9| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 10| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 11| "The user wants me to reply with exactly the word \"ONE\" and use no tools.                            "
-  style 0-71 fg=bright-black italic
+  style 0-71 dim italic
 12| "ONE                                                                                                 "
 13| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 14| <blank>
-15| "Context · plan-mode                                                                                 "
+15| "Context · plan-mode"
   style 0-18 dim
 16| "The user switched this session back to the default mode.                                            "
-  style 0-55 fg=bright-black
+  style 0-55 dim
 17| <blank>
 18| "Plan mode off.                                                                                      "
-  style 0-13 fg=bright-black
+  style 0-13 dim
 19| <blank>
 20| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 21| "Reply with exactly the word: TWO. No tools.                                                         "
 22| <blank>
 23| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 24| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 25| "The user wants me to reply with exactly the word \"TWO\" and no tools.                                "
-  style 0-67 fg=bright-black italic
+  style 0-67 dim italic
 26| "TWO                                                                                                 "
 27| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 28| <blank>
 29| "/workspace/project  deepseek-v4-flash  ↑2.9k ↓41  cache 49%  3% co"
-  style 0-51 fg=bright-blue bold
-  style 54-70 fg=bright-black
-  style 73-92 fg=bright-black
-  style 95-99 fg=bright-black
+  style 0-51 fg=bright-magenta bold
+  style 54-70 dim
+  style 73-92 dim
+  style 95-99 dim
 30| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 31-35| <blank>
diff --git a/examples/tui-agent/tests/snapshots/parallel-file-reads/terminal.expected.txt b/examples/tui-agent/tests/snapshots/parallel-file-reads/terminal.expected.txt
index 3d99c45758..82b3048bb4 100644
--- a/examples/tui-agent/tests/snapshots/parallel-file-reads/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/parallel-file-reads/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Use the read tool twice — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=27 bufferRow=27
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Use the read tool twice"
-  style 1-23 fg=bright-black
+  style 1-23 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Use the read tool twice in the same assistant message: read a.txt and b.txt. Then reply DONE.       "
 6| <blank>
 7| "Assistant                                                                                           "
@@ -21,16 +21,22 @@ buffer
 9| "● Tool / read"
   style 0-12 fg=green
 10| "Read a.txt                                                                                          "
+  style 0-99 dim
 11| "1: alpha                                                                                            "
+  style 0-99 dim
 12| "                                                                                                    "
 13| "(End of file - total 1 lines)                                                                       "
+  style 0-99 dim
 14| <blank>
 15| "● Tool / read"
   style 0-12 fg=green
 16| "Read b.txt                                                                                          "
+  style 0-99 dim
 17| "1: beta                                                                                             "
+  style 0-99 dim
 18| "                                                                                                    "
 19| "(End of file - total 1 lines)                                                                       "
+  style 0-99 dim
 20| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 21| <blank>
@@ -41,12 +47,12 @@ buffer
   style 0-46 dim
 25| <blank>
 26| "/workspace/project  deepseek-v4-flash  ↑20 ↓6  cache 0%  3% context"
-  style 0-47 fg=bright-blue bold
-  style 50-66 fg=bright-black
-  style 69-84 fg=bright-black
-  style 87-96 fg=bright-black
+  style 0-47 fg=bright-magenta bold
+  style 50-66 dim
+  style 69-84 dim
+  style 87-96 dim
 27| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 28-35| <blank>
diff --git a/examples/tui-agent/tests/snapshots/todo-plan/terminal.expected.txt b/examples/tui-agent/tests/snapshots/todo-plan/terminal.expected.txt
index 9dafcf576d..a5d2ca07b3 100644
--- a/examples/tui-agent/tests/snapshots/todo-plan/terminal.expected.txt
+++ b/examples/tui-agent/tests/snapshots/todo-plan/terminal.expected.txt
@@ -4,15 +4,15 @@ title "Use the todo_write tool to — DSH TUI snapshot"
 cursor hidden column=7 viewportRow=31 bufferRow=31
 buffer
 0| " DEEPSEEK HARNESS"
-  style 1-8 fg=bright-blue bold
+  style 1-8 fg=bright-magenta bold
   style 10-16 bold
 1| " Use the todo_write tool to"
-  style 1-26 fg=bright-black
+  style 1-26 dim
 2| " main-session"
   style 1-12 dim
 3| <blank>
 4| "You                                                                                                 "
-  style 0-2 fg=bright-blue bold underline
+  style 0-2 fg=bright-magenta bold underline
 5| "Use the todo_write tool to record a plan with exactly three todos: \"read the code\" (in_progress),   "
 6| "\"write the fix\" (pending), \"run the tests\" (pending). Send all three in one todo_write call. Then   "
 7| "reply with the single word DONE and stop.                                                           "
@@ -20,31 +20,33 @@ buffer
 9| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 10| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 11| "The user wants me to use the todo_write tool to record a plan with exactly three todos in the       "
-  style 0-99 fg=bright-black italic
+  style 0-99 dim italic
 12| "specified statuses, then reply with \"DONE\".                                                         "
-  style 0-42 fg=bright-black italic
+  style 0-42 dim italic
 13| <blank>
 14| "● Tool / todo_write"
   style 0-18 fg=green
 15| "Update todo list                                                                                    "
+  style 0-99 dim
 16| "Updated todo list: 2 pending, 1 in progress, 0 completed.                                           "
+  style 0-99 dim
 17| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 18| <blank>
 19| "Assistant                                                                                           "
   style 0-8 fg=bright-magenta bold underline
 20| "Reasoning                                                                                           "
-  style 0-8 fg=bright-black italic
+  style 0-8 dim italic
 21| "The todos have been written successfully. Now I just need to reply with the single word \"DONE\".     "
-  style 0-94 fg=bright-black italic
+  style 0-94 dim italic
 22| "DONE                                                                                                "
 23| "Model wait 0.0s · Completed 2026-07-21 12:00:00                                                     "
   style 0-46 dim
 24-25| <blank>
 26| "Plan"
-  style 0-3 fg=bright-blue bold
+  style 0-3 fg=bright-magenta bold
 27| "  ● read the code"
   style 2-2 fg=yellow
 28| "  ○ write the fix"
@@ -52,12 +54,12 @@ buffer
 29| "  ○ run the tests"
   style 2-2 dim
 30| "/workspace/project  deepseek-v4-flash  ↑3.1k ↓145  cache 47%  3% context"
-  style 0-37 fg=bright-blue bold
-  style 40-56 fg=bright-black
-  style 59-79 fg=bright-black
-  style 82-91 fg=bright-black
+  style 0-37 fg=bright-magenta bold
+  style 40-56 dim
+  style 59-79 dim
+  style 82-91 dim
 31| " dsh ◍                                                                                              "
-  style 1-3 fg=bright-blue bold
-  style 5-6 fg=bright-black
+  style 1-3 fg=bright-magenta bold
+  style 5-6 dim
   style 7-7 inverse
 32-35| <blank>

From c7e6cb57532f3825a1d9abd151b8e06f965e003d Mon Sep 17 00:00:00 2001
From: Turtle <turtle1999@deepseek.com>
Date: Wed, 29 Jul 2026 10:25:07 +0800
Subject: [PATCH 15/16] fix(tui): complete launcher integration and rationale

---
 ...-07-28-tui-palette-single-source.i18n.yaml |  6 ++
 .../2026-07-28-tui-palette-single-source.md   | 57 +++++++++++++++++++
 ...2026-07-28-tui-palette-single-source.zh.md | 57 +++++++++++++++++++
 ...xt-card-content-independent-fold.i18n.yaml |  6 ++
 ...8-context-card-content-independent-fold.md | 37 ++++++++++++
 ...ontext-card-content-independent-fold.zh.md | 37 ++++++++++++
 ...ntext-cards-render-prose-not-xml.i18n.yaml |  6 ++
 ...7-28-context-cards-render-prose-not-xml.md | 49 ++++++++++++++++
 ...8-context-cards-render-prose-not-xml.zh.md | 49 ++++++++++++++++
 ...terminal-card-double-exit-status.i18n.yaml |  6 ++
 ...-07-28-terminal-card-double-exit-status.md | 46 +++++++++++++++
 ...-28-terminal-card-double-exit-status.zh.md | 46 +++++++++++++++
 ...026-07-28-cross-workspace-resume.i18n.yaml |  6 ++
 .../2026-07-28-cross-workspace-resume.md      | 52 +++++++++++++++++
 .../2026-07-28-cross-workspace-resume.zh.md   | 52 +++++++++++++++++
 ...07-28-tui-dim-tool-result-output.i18n.yaml |  6 ++
 .../2026-07-28-tui-dim-tool-result-output.md  | 39 +++++++++++++
 ...026-07-28-tui-dim-tool-result-output.zh.md | 39 +++++++++++++
 ...07-28-tui-foldable-context-cards.i18n.yaml |  6 ++
 .../2026-07-28-tui-foldable-context-cards.md  | 35 ++++++++++++
 ...026-07-28-tui-foldable-context-cards.zh.md | 35 ++++++++++++
 ...-07-28-tui-uniform-dim-card-body.i18n.yaml |  6 ++
 .../2026-07-28-tui-uniform-dim-card-body.md   | 51 +++++++++++++++++
 ...2026-07-28-tui-uniform-dim-card-body.zh.md | 51 +++++++++++++++++
 apps/cli/src/tui.ts                           | 17 +++++-
 25 files changed, 795 insertions(+), 2 deletions(-)
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
 create mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md

diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml
new file mode 100644
index 0000000000..bdd45027ed
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
+2026-07-28-tui-palette-single-source.md: 7027e650bfb94dca7608342b10c994b255f48d2d
+2026-07-28-tui-palette-single-source.zh.md: a956a916c01feceedc7b6b6715bee6ceb8b80e7f
diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
new file mode 100644
index 0000000000..7027e650bf
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
@@ -0,0 +1,57 @@
+# Agent Note: One palette table, one role per meaning, printable by `/palette`
+
+Status: implemented
+
+English | [中文](2026-07-28-tui-palette-single-source.zh.md)
+
+## Problem
+
+The palette had fifteen roles built from escape codes written inline in `createPalette`, and three pairs of them resolved to the same SGR parameters: `added`/`success` were both `32`, `removed`/`error` both `31`, and on a light scheme `muted`/`dim` were both `90`. A reader picking `added` or `muted` believed they had chosen a distinct tone; they had chosen an alias. Nothing enumerated the roles, so no reader could compare them, and the codes existed only as literals at their use site.
+
+That hid a real defect for as long as it took a user to notice it. `dim` deliberately substituted ANSI 90 on light schemes, on the recorded theory that "SGR 2 lightens text on a light background." But lightening is precisely what a recessed tone must do, and ANSI 90 is a fixed hue: on a light theme whose default foreground is a soft gray, bright black is *heavier* than ordinary text. Every surface the TUI called dim — tool-card bodies, the timing footer, injected context, dialog chrome — therefore rendered as the most prominent text on screen, inverting the one relationship the role exists to express. The role named `dim` was the least dim thing in the transcript.
+
+Nothing prevented the inversion from being introduced, and nothing revealed it afterwards. There was no listing to compare tones in, and terminal captures report escape codes rather than rendered luminance, so reading `\x1b[90m` and concluding "gray, therefore recessed" is a mistake a reader repeats indefinitely without a rendered sample to check against.
+
+A second hazard was latent in the same design. SGR has no color stack: a nested span's close emits `39` (default foreground), not the enclosing color, so wrapping colored text in a second color silently drops the outer color for the remainder of the line. Only the type `(text: string) => string` guarded that, which is to say nothing guarded it.
+
+## Decision
+
+`paletteSpec(scheme)` is the single table of every SGR code the TUI may emit. Each entry carries `open`, `close`, and a `purpose` string. `createPalette` derives its wrappers by iterating `COLOR_ROLES` and `ATTRIBUTE_ROLES` over that table, and the `/palette` command prints it, so a role cannot exist in the palette without appearing in the listing or the reverse. No component writes an escape sequence of its own. The startup banner's brand gradient stays the one deliberate exception, since fixed brand color is its point.
+
+`close` MUST reset every SGR group `open` sets. This is stated on `ansi` because the roles that violated it did so silently: `dim` opened `2;39` while closing only `22`, leaking a foreground reset past its own span.
+
+Roles that resolved to the same escape are merged rather than kept as aliases. `muted` folds into `dim`, `added` into `success`, and `removed` into `error`, leaving seven colors and five attributes. `accent` becomes ANSI 95, the tone this terminal actually reads as emphasis, and the single-use `accent2` is deleted rather than kept as a second accent.
+
+`dim` is `2;39` closing `22;39` on both schemes. SGR 2 fades relative to whatever foreground the terminal is using, which is the only way to land *below* `text` on a light and a dark theme with one code; `39` pins the starting foreground to the default so the tone does not inherit a caller's color. Only `code` still varies by scheme, because ANSI 36 is genuinely hard to read on a light background.
+
+Colors and attributes are separately typed. A `ColorRole` takes `Colorable` and returns `Colored`; an `AttributeRole` is generic and preserves its argument's type. So `bold(accent(x))` and `accent(bold(x))` both compile, `accent(error(x))` does not, and — because the brand survives an attribute layer — neither does `dim(bold(success(x)))`.
+
+## Alternatives considered
+
+**Keep ANSI 90 for `dim` and adjust the surfaces that looked wrong.** Rejected: the surfaces were right and the tone was wrong. Every consumer of `dim` wanted the same thing, so the fix belongs in the one role, not in each caller.
+
+**Plain SGR 2 without the `39`.** Considered; the user compared both rendered against their own background. Both read as genuinely dim, and `2` alone is the smaller change, but `2;39` guarantees the span starts from the default foreground rather than inheriting a caller's color, which matters wherever `dim` wraps content that may already be styled.
+
+**Keep `muted` and `dim` as separate names against future differentiation.** Rejected: they resolved to one escape on one of the two supported schemes, and a name that sometimes aliases another is worse than one name. Reintroducing a second recessed tone is a new decision, to be made when a consumer needs it.
+
+**Enforce the no-nested-color rule by convention and review.** Rejected: the rule is mechanically checkable and the failure is invisible — a dropped outer color looks like a rendering quirk, not a bug. The brands cost two type aliases and caught four deliberate violations in a compile check.
+
+**A runtime guard that strips or rejects nested colors.** Rejected: it moves a statically decidable error to run time and would have to allocate on every styled span, in the render hot path.
+
+**Print the palette to stdout from a script instead of a TUI command.** Rejected: the point is to see the tones the *running* TUI produces in the *user's* terminal, under the scheme it actually resolved. A script cannot report the live scheme, and this specific bug was invisible outside the real terminal.
+
+## Consequences
+
+The listing is now the fastest way to find a palette defect: `/palette` shows every role painted by its own code beside the SGR pair it reports, so a tone that misbehaves is visible next to its neighbours instead of inferred from escape numbers. It also reports the resolved scheme, which surfaced that scheme detection is not stable across launches — an unrelated bug this change makes observable but does not fix.
+
+Four role names disappear from the palette, and `muted` leaves the public extension `TuiTheme`; an extension that wants a recessed tone uses `dim`. Merging the diff pair means `success` and `error` each carry two meanings, which is honest about there being one green and one red rather than implying a diff-specific palette.
+
+The brands introduce a small friction: an array literal seeded with a colored string infers `Colored[]`, so two call sites now annotate `string[]` explicitly. That is the cost of the guarantee, and it appears at declaration sites rather than in styling expressions.
+
+`accent` moving to 95 repaints twenty-four call sites, including Markdown headings and links, dialog borders, and the prompt. That is a visible change to surfaces beyond the reported defect, made because a single emphasis color is the point of the reduction.
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` asserts `/palette` prints every name and `purpose` in `paletteSpec` and that each row carries the spec's own open code, so a role added to the table without a listing entry, or a listing that reports one code while rendering another, fails. Verified by construction: truncating the attribute loop makes the test fail rather than pass silently.
+
+The scheme-detection test previously pinned `dim` changing between schemes, which is no longer true; it now pins scheme-independent `dim` alongside the `code` role that does vary. The blank-row and running-glyph tests carry the new SGR pairs. The no-nested-color rule is verified by compiling deliberate violations against the project's own tsconfig, where the four color-over-color expressions are rejected and the five legal attribute compositions are not.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
new file mode 100644
index 0000000000..a956a916c0
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
@@ -0,0 +1,57 @@
+# Agent Note: 单一调色板表、每种含义一个角色，并可通过 `/palette` 打印
+
+Status: implemented
+
+[English](2026-07-28-tui-palette-single-source.md) | 中文
+
+## Problem
+
+调色板原有十五个角色，其转义码直接写在 `createPalette` 中，其中三对角色解析为相同的 SGR 参数：`added`/`success` 都是 `32`，`removed`/`error` 都是 `31`，而在浅色配色方案中，`muted`/`dim` 都是 `90`。读者选择 `added` 或 `muted` 时，会以为自己选了不同的色调，实际上选到的只是别名。没有任何地方枚举这些角色，因此读者无法比较它们，而这些转义码也仅以字面量存在于使用处。
+
+这个设计一直掩盖着一个真实缺陷，直到用户亲眼发现。`dim` 在浅色配色方案中刻意改用 ANSI 90，依据是记录中「SGR 2（dim）会让浅色背景上的文本变淡」的理由。但变淡恰恰是弱化色调必须做的事，而 ANSI 90 是固定色相：如果浅色主题的默认前景色是柔和的灰色，亮黑色就会比普通文本*更重*。因此，TUI 中所有称作 dim 的界面——工具卡片正文、计时页脚、注入的上下文、对话框边框——都会渲染为屏幕上最醒目的文本，颠倒了该角色本应表达的唯一关系。名为 `dim` 的角色反而成了 transcript（文本记录）中最不弱化的内容。
+
+这个颠倒既没有防范机制，发生后也没有显现机制。没有可供比较色调的清单，而终端捕获记录的是转义码而非渲染亮度，因此看到 `\x1b[90m` 就断定「这是灰色，所以会弱化」，是读者在没有渲染样例可供核对时会不断重复的错误。
+
+同一设计中还潜藏着第二个风险。SGR 没有颜色栈：嵌套区段的关闭码会发出 `39`（默认前景色），而不是外层颜色，因此用第二种颜色包裹已经着色的文本，会悄然丢弃该行剩余部分的外层颜色。唯一的防护只是类型 `(text: string) => string`，也就是说实际上毫无防护。
+
+## Decision
+
+`paletteSpec(scheme)` 是 TUI 可以发出的所有 SGR 码的唯一表。每个条目都包含 `open`、`close` 和一个 `purpose` 字符串。`createPalette` 遍历该表的 `COLOR_ROLES` 与 `ATTRIBUTE_ROLES` 来派生包装函数，`/palette` 命令则打印该表，因此一个角色不可能只存在于调色板中却不出现在清单里，反之亦然。任何组件都不会自行写入转义序列。启动横幅的品牌渐变色是唯一的有意例外，因为固定品牌色本来就是它的目的。
+
+`close` 必须重置 `open` 设置的每一个 SGR 组。该要求在 `ansi` 上明确说明，因为此前违反要求的角色没有显露问题：`dim` 以 `2;39` 开启，却只以 `22` 关闭，导致前景色重置越过其自身区段而泄漏。
+
+解析为同一转义码的角色会合并，而不是作为别名保留。`muted` 并入 `dim`，`added` 并入 `success`，`removed` 并入 `error`，最终留下七种颜色和五种属性。`accent` 改为 ANSI 95，这是该终端中实际呈现为强调色的色调；仅使用一次的 `accent2` 则直接删除，不再作为第二种强调色保留。
+
+在两种配色方案中，`dim` 都以 `2;39` 开启、以 `22;39` 关闭。SGR 2 会相对于终端当前使用的前景色减淡，这是仅用一个代码就在浅色和深色主题中落到 `text` *之下*的唯一方式；`39` 将起始前景色固定为默认值，使该色调不会继承调用方的颜色。只有 `code` 仍然随配色方案而变化，因为 ANSI 36 在浅色背景上确实难以辨认。
+
+颜色与属性分别采用不同的类型。`ColorRole` 接受 `Colorable` 并返回 `Colored`；`AttributeRole` 是泛型，会保留实参的类型。因此 `bold(accent(x))` 和 `accent(bold(x))` 都能编译，`accent(error(x))` 不能；而且——由于品牌标记可以穿过一层属性——`dim(bold(success(x)))` 同样不能编译。
+
+## Alternatives considered
+
+**保留 ANSI 90 作为 `dim`，并调整显示异常的界面。**否决：界面没有问题，错的是色调。`dim` 的所有消费方都需要同一种效果，因此修复应落在这个角色本身，而不是每个调用方中。
+
+**不带 `39` 的纯 SGR 2。**考虑过；用户在自己的背景上比较了两者的渲染效果。两者看起来都确实弱化，单独使用 `2` 也是更小的改动，但 `2;39` 可以保证区段从默认前景色开始，而不是继承调用方的颜色；当 `dim` 包裹可能已有样式的内容时，这一点很重要。
+
+**保留 `muted` 与 `dim` 两个名称，以备日后加以区分。**否决：它们在两种受支持的配色方案之一中解析为同一个转义码，而一个有时成为其他名称别名的名称，还不如只保留一个名称。重新引入第二种弱化色调是一项新决策，应等到消费方确有需要时再作出。
+
+**通过约定和评审来执行禁止嵌套颜色的规则。**否决：这条规则可以机械检查，而且故障不可见——外层颜色丢失看起来会像渲染异常，而不是缺陷。品牌类型的代价只是两个类型别名，却在编译检查中捕获了四处刻意构造的违规。
+
+**在运行时剥离或拒绝嵌套颜色的防护。**否决：这会把一个可静态判定的错误推迟到运行时，并且必须在渲染热路径中为每个带样式的区段分配内存。
+
+**通过脚本将调色板打印到 stdout，而不是使用 TUI 命令。**否决：目的是在*运行中的* TUI 所实际解析出的配色方案下，查看它在*用户自己的*终端中产生的色调。脚本无法报告实时配色方案，而这个特定缺陷在真实终端之外不可见。
+
+## Consequences
+
+现在，清单是发现调色板缺陷最快的方式：`/palette` 会用每个角色自身的代码绘制该角色，并在旁边显示其报告的 SGR 码对，因此表现异常的色调会直接出现在邻近角色旁边，而不必根据转义码数字推断。它还会报告解析出的配色方案，由此揭示配色方案检测在多次启动之间并不稳定——这是本次变更令其可观察、但并未修复的无关缺陷。
+
+调色板中消失了四个角色名称，`muted` 也从公共扩展 `TuiTheme` 中移除；需要弱化色调的扩展应使用 `dim`。合并差异对意味着 `success` 和 `error` 各自承载两种含义，这如实反映了系统只有一种绿色和一种红色，而不会暗示另有差异专用调色板。
+
+品牌类型带来了一点不便：如果数组字面量以着色字符串开头，便会推断为 `Colored[]`，因此现在有两个调用点需要显式标注 `string[]`。这是该保证的代价，而且它出现在声明位置，而不是样式表达式中。
+
+`accent` 改为 95 后，二十四个调用点随之重新着色，包括 Markdown 标题和链接、对话框边框以及提示行。这是报告缺陷之外其他界面的可见变化；作出这一改动，是因为精简的目的正是只保留一种强调色。
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` 断言 `/palette` 会打印每个名称和 `purpose`（均来自 `paletteSpec`），并且每一行都包含规格自身的开启码，因此在表中添加角色却没有清单条目，或清单报告的代码与渲染使用的代码不同，都会导致测试失败。构造验证也已完成：截断属性循环会让测试失败，而不会静默通过。
+
+配色方案检测测试此前固定了 `dim` 会随配色方案变化的行为，但现在已不再如此；该测试现在同时固定与配色方案无关的 `dim`，以及确实会变化的 `code` 角色。空白行测试与运行状态字形测试包含新的 SGR 码对。禁止嵌套颜色的规则通过项目自身的 tsconfig 编译刻意构造的违规来验证，其中四个颜色叠加颜色的表达式会被拒绝，五个合法的属性组合则不会。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
new file mode 100644
index 0000000000..af1e8ea8d3
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
+2026-07-28-context-card-content-independent-fold.md: 7e5e6e9ed8df317b1f1ade8f6935a18903937d6f
+2026-07-28-context-card-content-independent-fold.zh.md: 48e329d4d64395e3bcfa9ecb6085474d70eddac0
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
new file mode 100644
index 0000000000..7e5e6e9ed8
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
@@ -0,0 +1,37 @@
+# Agent Note: Context-card folding is independent of whether the text parses as XML
+
+Status: implemented
+
+English | [中文](2026-07-28-context-card-content-independent-fold.zh.md)
+
+## Problem
+
+[Foldable injected-context cards](../feature/2026-07-28-tui-foldable-context-cards.md) folded only the tree-rendered body. `ContextCardComponent.render` passed `expanded` and `maxOutputLines` into `renderUnknownXml`, which returns `undefined` when the text is not one complete XML document; the `undefined` branch then rendered the whole message as a single muted blob that consulted neither field. Unparsed context was therefore permanently expanded and inert under `Ctrl+O`.
+
+The parser rejects far more real context than the fallback implied. `workspace-context` frames instructions in `<system-reminder>` and escapes only `</system-reminder>`, so any raw `&` or `<` inside the prose is an invalid entity reference or bogus tag that fails the whole document. A badge URL's `&logo=` does it, and so does any `a < b`. Observed on a live session log: two `workspace-instructions` cards rendered 254 and 85 identical rows collapsed and expanded, each with a literal `<system-reminder>` as the first body row, while a `dsh-tool-skill` card whose text happened to parse folded 113 rows to 46.
+
+The user-visible symptom read as two bugs — the frame line was back, and nothing folded — but both are this one branch.
+
+## Decision
+
+Folding is a property of the card, not of the text. `preview` is exported from `packages/ui/tui/src/components/xml-tool-output.ts` and applied to the assembled body in `ContextCardComponent.render`.
+
+`ToolCardComponent` had an inline copy of that head/tail/marker arithmetic; it now calls the same `preview`, so one function owns the fold rule for every transcript card. Where a tool card's tree body was already folded per child, re-applying the limit to the assembled rows is deliberate: the per-child budget bounds each child, not their sum, so many small children could still exceed the card's budget.
+
+This note's fix kept the parse and made the fold independent of it. The card [no longer parses context at all](2026-07-28-context-cards-render-prose-not-xml.md), which also removed the residual frame row this fix could not suppress: an unparsed body had no parsed root to drop, so its first row stayed the literal `<system-reminder>`.
+
+## Alternatives considered
+
+**Escape `&` and `<` in `workspace-context` so the document always parses.** Rejected as the fix for this defect: it makes the fold work by making the parse succeed, leaving folding contingent on content. Any other plugin injecting arbitrary text, or any escaping gap, reintroduces the same symptom. Worth doing on its own merits — it would also drop the frame row — but the card must fold regardless.
+
+**Pre-parse repair, or a lenient HTML-style parser.** Rejected: `renderUnknownXml` declines on purpose so partial or mixed text renders unchanged rather than through a guessed tree. Loosening it to satisfy a presentation budget trades a correct decline for a wrong tree, and affects unknown tool results too.
+
+**Truncate in the `undefined` branch alone.** Rejected: it fixes the symptom while leaving two fold implementations whose agreement is unverified. Exporting `preview` removes the tool card's duplicate at the same time.
+
+## Consequences
+
+Every context card folds to `maxToolOutputLines` and responds to `Ctrl+O`, whatever its text contains. Tool cards whose tree body has many children can now fold where they did not, since the card total is bounded rather than each child.
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` pins a context card whose text carries a raw `&` (a badge URL's `&logo=`, the observed real-world trigger): it is collapsed by default with the `Ctrl+O to expand` marker, hides a middle line, and reveals it on `Ctrl+O`. That test failed on this fix's parent commit, where the card emitted no marker.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
new file mode 100644
index 0000000000..48e329d4d6
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
@@ -0,0 +1,37 @@
+# Agent Note: 上下文卡片的折叠与文本能否按 XML 解析无关
+
+Status: implemented
+
+[English](2026-07-28-context-card-content-independent-fold.md) | 中文
+
+## 问题
+
+[可折叠的注入上下文卡片](../feature/2026-07-28-tui-foldable-context-cards.md)此前只折叠按树形渲染的正文。`ContextCardComponent.render` 把 `expanded` 和 `maxOutputLines` 传给 `renderUnknownXml`，而当文本不是一个完整的 XML 文档时，该函数返回 `undefined`；`undefined` 分支随后把整条消息渲染成单块暗色文本，这两个字段一个都不看。于是未能解析的上下文永久处于展开状态，且对 `Ctrl+O` 毫无反应。
+
+解析器拒绝的真实上下文远多于该回退分支所暗示的范围。`workspace-context` 用 `<system-reminder>` 包裹指令，并且只转义 `</system-reminder>`，因此正文中任何裸的 `&` 或 `<` 都构成无效实体引用或非法标签，进而让整篇文档解析失败。徽章 URL 中的 `&logo=` 会触发这一情况，任何 `a < b` 也会。在一份真实会话日志中观察到：两张 `workspace-instructions` 卡片分别渲染出 254 行和 85 行，折叠态与展开态完全一致，且每张卡片正文首行都是字面量 `<system-reminder>`；而一张文本恰好能解析的 `dsh-tool-skill` 卡片则把 113 行折叠到了 46 行。
+
+用户可见的症状看起来像两个缺陷——外框行又回来了，而且什么都折不起来——但两者都出自这同一个分支。
+
+## 决策
+
+折叠是卡片的属性，而非文本的属性。`preview` 从 `packages/ui/tui/src/components/xml-tool-output.ts` 导出，并在 `ContextCardComponent.render` 中作用于组装完成的正文。
+
+`ToolCardComponent` 此前内联复制了那套头部／尾部／标记的行数计算；它现在调用同一个 `preview`，因此所有 transcript（文本记录）卡片的折叠规则由一个函数统一持有。对于工具卡片中已经逐子项折叠过的树形正文，再对组装完成的行施加一次限额是有意为之：逐子项的限额只约束单个子项，而非它们的总和，因此大量小子项仍可能超出卡片的限额。
+
+本记录的修复保留了解析，并让折叠不再依赖解析结果。卡片[已完全不再解析上下文](2026-07-28-context-cards-render-prose-not-xml.md)，这同时也消除了本次修复无法抑制的残留外框行：未解析的正文没有可去掉的已解析根元素，因此其首行仍是字面量 `<system-reminder>`。
+
+## 考虑过的替代方案
+
+**在 `workspace-context` 中转义 `&` 与 `<`，使文档总能解析。** 作为本缺陷的修复方案不予采纳：它是靠让解析成功来让折叠生效，从而使折叠仍取决于内容。任何注入任意文本的其他插件，或任何转义遗漏，都会重新引入同一症状。这件事本身值得做——它还会顺带去掉外框行——但卡片无论如何都必须能折叠。
+
+**先做预解析修复，或改用宽松的 HTML 式解析器。** 不予采纳：`renderUnknownXml` 是有意拒绝的，这样部分或混合文本才会原样渲染，而不是走一棵猜出来的树。为了满足呈现限额而放宽它，等于用一次正确的拒绝换来一棵错误的树，并且会连未知工具结果一起波及。
+
+**只在 `undefined` 分支里做截断。** 不予采纳：它修掉了症状，却留下两份彼此一致性未经验证的折叠实现。导出 `preview` 同时消除了工具卡片中的那份重复。
+
+## 后果
+
+每张上下文卡片都会折叠到 `maxToolOutputLines`，并响应 `Ctrl+O`，无论其文本包含什么。树形正文含大量子项的工具卡片现在可能在原先不折叠的情况下折叠，因为受约束的是卡片总行数而非每个子项。
+
+## 测试
+
+`packages/ui/tui/tests/tui.spec.ts` 固定了一张文本带有裸 `&` 的上下文卡片（徽章 URL 中的 `&logo=`，即观察到的真实触发条件）：它默认处于折叠态并带有 `Ctrl+O to expand` 标记，隐藏了中间某一行，按下 `Ctrl+O` 后将其显示出来。该测试在本次修复的父提交上曾失败，当时的卡片不会输出标记。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
new file mode 100644
index 0000000000..417d09e167
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
+2026-07-28-context-cards-render-prose-not-xml.md: 0b87e6b5e20648dc40ce1cde7a6d4c23843f478f
+2026-07-28-context-cards-render-prose-not-xml.zh.md: 461466be148ffce6ebc5e7188f88014bf6bac69e
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
new file mode 100644
index 0000000000..0b87e6b5e2
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
@@ -0,0 +1,49 @@
+# Agent Note: Context cards render injected context as prose, not as XML
+
+Status: implemented
+
+English | [中文](2026-07-28-context-cards-render-prose-not-xml.zh.md)
+
+## Problem
+
+`ContextCardComponent` rendered injected context through `renderUnknownXml`, the strict single-document XML tree renderer. That made two user-visible properties depend on whether the payload happened to be well-formed XML: the redundant frame row was dropped only via `xml.slice(1)` on a successful parse, and — before the [content-independent fold](2026-07-28-context-card-content-independent-fold.md) — so was folding.
+
+Injected context is not XML. Three facts establish it:
+
+- `<system-reminder>` is a prompting convention, not markup. No model is trained on the tag ([envelope rationale](../simplification/2026-07-20-unwrap-injected-content-envelopes.md)); it signals "injected, not the user speaking".
+- Real instruction bodies contain characters that are fatal to a strict parse but ordinary in prose. A raw `&` in a badge URL's `&logo=` is an invalid entity reference; measured on a live session, one `workspace-instructions` payload carried four.
+- The angle brackets inside those bodies are not elements. Every inner "tag" in this repository's own instructions is a placeholder in a path or command template — `packages/<group>/<pkg>/`, `-t <name>`, `Branded<B>`. Tree-rendering them as elements misrepresents the text.
+
+The fragility was never workspace-specific: `dsh-tool-skill` builds the same frame and parses today only because no skill description has yet contained an `&`.
+
+## Decision
+
+The card does not parse. It strips a producer's outer frame by exact line match and renders the remaining text as muted prose rows, folded by the shared `preview`.
+
+`stripReminderFrame` removes the first and last lines only when they are a matched open/close pair, each alone on its line (`REMINDER_FRAME_LINE`). An unpaired tag line, a mismatched pair, or a tag mentioned mid-prose is left intact, so no body is silently truncated by a tag-like first line. Producers emit the frame as whole lines, which is what makes an exact match sufficient.
+
+Model-facing text is untouched. The rejected alternative — escaping at the producer so the document parses — would have changed what the model reads.
+
+Emptiness is decided on the stripped text rather than the styled rows. A palette wraps every row in escapes, so a blank body styled first yields one escape-only row that reads as a stray blank line under the header; testing `stripped === ''` renders the card header-only instead.
+
+Removing the parse also removes the C1-expansion hazard it carried. `renderUnknownXml` had to escape parsed text because a character reference like `&#155;` expands to a control character the raw-source escaping never saw. Unparsed text cannot expand, so `&#155;` now renders literally and terminal-injection safety rests solely on `displayText`, which the `untrusted-controls` snapshot pins.
+
+`renderUnknownXml` keeps its one remaining consumer: unknown tool results, where a genuine XML result is plausible and the root element is meaningful. Only `preview` is shared with the context card.
+
+## Alternatives considered
+
+**XML-escape `&` and `<` in every producer so the frame parses.** Rejected: it corrupts a model-facing contract to satisfy a presentation detail. The model would read `packages/&lt;group&gt;/&lt;pkg&gt;/` and `&amp;logo=deepseek` — and that badge URL is an instruction the model is told to copy verbatim into a pull request description. It also needs repeating in every current and future producer with nothing keeping them in sync.
+
+**Escape only for display, keeping the model text intact.** Rejected: escaping display-side to make a parse succeed, then rendering the parse as a tree, reintroduces the placeholders-as-elements misreading. The text is prose either way, so parsing it buys nothing.
+
+**A lenient HTML-style parser.** Rejected: `renderUnknownXml` declines by design so partial or mixed text renders unchanged rather than as a guessed tree. Loosening it trades a correct decline for a wrong tree, and would affect unknown tool results too.
+
+## Consequences
+
+Context cards render identically whatever their text contains: the frame row is gone in every case, prose survives verbatim, and the fold depends only on row count. Bodies lose the tree's two-space indentation and nested-element structure, which the re-recorded `surface-after-compaction-{narrow,wide}` snapshots show; a nested block such as `<available_skills>` now appears as the literal text it is in the model-facing payload. An empty frame renders header-only rather than leaving a blank row.
+
+A character reference in context is no longer decoded for display, which is the correct reading of a payload the model receives literally.
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` pins the frame stripped for a multi-line reminder, prose preserved for an unpaired tag pair (`<available_skills>` … `</other-tag>`), header-only rendering for an empty frame, and a body carrying both a raw `&logo=` and `packages/<group>/<pkg>/` that folds and survives verbatim through a `Ctrl+O` round trip. The one-line frame case pins that `&#155;` stays literal while a raw C1 byte never reaches the terminal. The `surface-after-compaction-{narrow,wide}` keyless snapshots were re-recorded for the lost indentation and the now-recorded muted styling; `untrusted-controls` is unchanged, holding the escaping contract. `examples/tui-agent`'s `multi-turn-conversation` terminal snapshot was refreshed too: it had been failing since the original foldable-context change on an unrelated stale row, where it still expected a width-padded `Context · plan-mode` header that no card has emitted since the header stopped passing through `Text`. Both changed files keep 100% statement and branch coverage.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
new file mode 100644
index 0000000000..461466be14
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
@@ -0,0 +1,49 @@
+# Agent Note: 上下文卡片把注入上下文渲染为文本，而非 XML
+
+Status: implemented
+
+[English](2026-07-28-context-cards-render-prose-not-xml.md) | 中文
+
+## 问题
+
+`ContextCardComponent` 此前通过 `renderUnknownXml` 渲染注入上下文，而该函数是严格的单文档 XML 树形渲染器。这使得两个用户可见的属性取决于载荷是否恰好是格式良好的 XML：冗余的外框行只有在解析成功时才会经 `xml.slice(1)` 去掉，而在[与内容无关的折叠](2026-07-28-context-card-content-independent-fold.md)之前，折叠同样如此。
+
+注入上下文并不是 XML。三个事实可以确立这一点：
+
+- `<system-reminder>` 是一种提示词约定，而非标记语言。没有任何模型是针对该标签训练的（[外框设计依据](../simplification/2026-07-20-unwrap-injected-content-envelopes.md)）；它传达的是「这是注入内容，不是用户在说话」。
+- 真实的指令正文包含一些对严格解析致命、但在普通文本中再正常不过的字符。徽章 URL 中 `&logo=` 里的裸 `&` 就是一个无效实体引用；在一次真实会话上测得，某个 `workspace-instructions` 载荷携带了四个。
+- 这些正文里的尖括号并不是元素。本仓库自身指令中的每一个内层「标签」都是路径或命令模板中的占位符——`packages/<group>/<pkg>/`、`-t <name>`、`Branded<B>`。把它们按元素做树形渲染会曲解这段文本。
+
+这种脆弱性从来不局限于工作区：`dsh-tool-skill` 构造的是同一套外框，它今天还能解析成功，仅仅因为至今没有哪个 skill（技能）描述里出现过 `&`。
+
+## 决策
+
+卡片不做解析。它按整行精确匹配剥掉生产方的外层外框，把剩余文本渲染为暗色文本行，并交由共享的 `preview` 折叠。
+
+`stripReminderFrame` 只在首行与末行构成一对匹配的开闭标签、且各自独占一行（`REMINDER_FRAME_LINE`）时才将其移除。落单的标签行、不匹配的标签对、以及在文本中间提及的标签都原样保留，因此不会有正文因为首行形似标签而被静默截断。生产方以整行形式输出外框，这正是精确匹配足够可靠的原因。
+
+面向模型的文本不受影响。被否决的替代方案（在生产方做转义以使文档可解析）会改变模型读到的内容。
+
+是否为空由剥离后的文本判定，而不是由已套样式的行判定。调色板会给每一行都包上转义序列，因此空正文若先套样式，就会产出一行只含转义序列的行，看上去像标题下方多出一条无端的空行；改为检测 `stripped === ''` 后，卡片只渲染标题。
+
+去掉解析同时也去掉了它带来的 C1 展开隐患。`renderUnknownXml` 必须对解析出的文本做转义，因为形如 `&#155;` 的字符引用会展开为一个控制字符，而针对原始源文本的转义根本看不到它。未经解析的文本无法展开，因此 `&#155;` 现在按字面渲染，终端注入安全性完全由 `displayText` 承担，并由 `untrusted-controls` 快照固定。
+
+`renderUnknownXml` 保留了它唯一剩下的消费方：未知工具结果。在那里真正的 XML 结果是有可能出现的，根元素也确有含义。与上下文卡片共享的只有 `preview`。
+
+## 考虑过的替代方案
+
+**在每个生产方中把 `&` 与 `<` 做 XML 转义，使外框可解析。** 不予采纳：它为了迁就一个呈现细节而破坏面向模型的契约。模型会读到 `packages/&lt;group&gt;/&lt;pkg&gt;/` 和 `&amp;logo=deepseek`——而那个徽章 URL 正是一条要求模型逐字复制到 PR（Pull Request）描述里的指令。它还需要在每个现有和未来的生产方中重复实现，且没有任何机制保证它们彼此一致。
+
+**只在展示侧转义，保持模型文本不变。** 不予采纳：为让解析成功而在展示侧转义、再把解析结果渲染成树，会重新引入把占位符当作元素的误读。这段文本无论如何都是普通文本，解析它换不来任何收益。
+
+**改用宽松的 HTML 式解析器。** 不予采纳：`renderUnknownXml` 是有意拒绝的，这样部分或混合文本才会原样渲染，而不是走一棵猜出来的树。放宽它等于用一次正确的拒绝换来一棵错误的树，并且会连未知工具结果一起波及。
+
+## 后果
+
+上下文卡片无论文本包含什么都渲染一致：外框行在所有情形下都消失，普通文本逐字保留，折叠只取决于行数。正文失去了树形渲染的两空格缩进与嵌套元素结构，重新录制的 `surface-after-compaction-{narrow,wide}` 快照体现了这一点；诸如 `<available_skills>` 这类嵌套块，现在按它在面向模型载荷中的字面文本出现。空外框只渲染标题，而不是留下一条空行。
+
+上下文中的字符引用不再为展示而解码，这才是对模型逐字接收到的载荷的正确读法。
+
+## 测试
+
+`packages/ui/tui/tests/tui.spec.ts` 固定了以下几点：多行提醒的外框被剥掉；标签对落单（`<available_skills>` … `</other-tag>`）时普通文本得以保留；空外框只渲染标题；以及一段同时含有裸 `&logo=` 和 `packages/<group>/<pkg>/` 的正文会折叠，并在 `Ctrl+O` 的一次往返中逐字存活。单行外框的用例固定了 `&#155;` 保持字面量，同时裸的 C1 字节永远不会到达终端。`surface-after-compaction-{narrow,wide}` 无密钥快照因缩进丢失和现已录制的暗色样式而被重新录制；`untrusted-controls` 未变，继续持有转义契约。`examples/tui-agent` 的 `multi-turn-conversation` 终端快照也一并刷新：自最初的可折叠上下文改动以来，它一直因一行无关的陈旧内容而失败——那里它仍期望一个按宽度补齐的 `Context · plan-mode` 标题，而自标题不再经由 `Text` 渲染之后，就没有卡片再输出过这种标题。两个改动文件都保持 100% 的语句与分支覆盖率。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
new file mode 100644
index 0000000000..9ac8345ba9
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
+2026-07-28-terminal-card-double-exit-status.md: e082308a9a3bd6071753993572bfca518bd89de5
+2026-07-28-terminal-card-double-exit-status.zh.md: dc8aa0a6c26958c1cfe7e4d20b7228260f7a1bff
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
new file mode 100644
index 0000000000..e082308a9a
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
@@ -0,0 +1,46 @@
+# Agent Note: The terminal card reported a non-zero exit twice
+
+Status: implemented
+
+English | [中文](2026-07-28-terminal-card-double-exit-status.zh.md)
+
+## Problem
+
+A failing `bash` call rendered its exit status twice:
+
+```
+● Tool / bash / Check merge lock and flock availability
+$ … ; grep -n "merge.lock" .gitignore
+/opt/homebrew/bin/flock
+[exit code: 1]
+[exit 1]
+```
+
+`renderResult` appends `[exit code: N]` to the model-facing text because the model reads a single string and must see the exit. `presentBashResult` then returned that same string verbatim as the terminal card's `output` while also parsing the marker into `exitCode`, and the TUI renders `output` followed by its own dim `[exit N]` pill. Every non-zero exit and every signal kill therefore printed both forms.
+
+Neither producer was individually wrong: `TerminalResultView` documents `output` as the captured command output and `exitCode`/`signal` as separate structured fields precisely so a capable UI can show a pill. The bug was that `presentBashResult` put the consumed marker in both places. The TUI's own snapshot fixtures hid it — the hand-built card fixture supplies a marker-free `output`, and the one real recorded bash journey (`bash-terminal-card`) runs `echo TERMINAL_OK`, which exits 0 and so emits no marker at all.
+
+## Decision
+
+`parseExitStatus` now returns `{ body, …exit }`: it splits the rendered text at the marker it anchors on, so the caller receives the output body without the status line it consumed. `presentBashResult` passes that body as the card's `output`. Only the exit/signal marker leaves the output; `[output truncated: …]`, `[timed out after Nms]`, and the sandbox denial and escalation lines stay in the body because they carry facts no exit pill shows.
+
+The split lives in `render.ts` next to the marker emission it inverts. Emission, parse, and strip already had to co-evolve in one file, and a round-trip test pins the trio.
+
+## Alternatives considered
+
+- **Drop the `[exit N]` pill in the TUI.** Rejected: the pill is the scannable status, styled and placed independently of command output, and it is the only exit signal a card gets for a `TerminalResultView` produced by a tool other than `bash`.
+- **Strip the marker in the TUI renderer.** Rejected: the renderer would have to know `dsh-tool-bash`'s marker vocabulary, and the strip belongs with the parse that already consumes it. A tool's render intent is the tool's to define.
+- **Stop emitting the marker from `renderResult`.** Rejected: the marker is the model's only exit signal in a single text result, and the `tool:bash` prompt section teaches the model to check it.
+- **Have `execute` return a structured exit alongside the text.** Rejected: `presentResult(args, result)` is deliberately pure over content blocks so it replays from the session log, which retains only the rendered text.
+
+## Consequences
+
+A card body no longer ends in the marker, so a session replayed from the log renders the same single pill as a live run. The pre-existing display-only residual is now slightly larger and is recorded in the package README: output whose final line happens to be exactly `[exit code: N]` or `[killed by signal: …]` is read as the marker, which both shows a wrong pill and drops that line from the card body.
+
+The deliberate treatments in [the tool-card header note](../feature/2026-07-27-tui-tool-card-header.md) are unchanged: terminal exit keeps its existing dim `[exit N]` line rather than moving into a uniform footer.
+
+## Testing
+
+`tools.spec.ts` pins the marker-free body for a non-zero exit, a signal kill, and a clean run; asserts a timeout marker survives alongside the stripped exit; and extends the `renderResult`/`parseExitStatus` round-trip to assert no consumed marker remains in the body.
+
+The defect was invisible to every existing snapshot, so `tui-keyless-smoke.e2e.ts` adds a real-PTY scenario: the scripted adapter calls the real `bash` tool with `printf …; exit 3`, and the test asserts the terminal output contains the command's stdout and `[exit 3]` but never `[exit code: 3]`. It reproduces the double render when the presenter fix is reverted.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
new file mode 100644
index 0000000000..dc8aa0a6c2
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
@@ -0,0 +1,46 @@
+# Agent Note: terminal 卡片把非零退出状态报告了两次
+
+Status: implemented
+
+[English](2026-07-28-terminal-card-double-exit-status.md) | 中文
+
+## Problem
+
+失败的 `bash` 调用会把退出状态渲染两次：
+
+```
+● Tool / bash / Check merge lock and flock availability
+$ … ; grep -n "merge.lock" .gitignore
+/opt/homebrew/bin/flock
+[exit code: 1]
+[exit 1]
+```
+
+`renderResult` 会把 `[exit code: N]` 追加到面向模型的文本上，因为模型读到的是单个字符串，必须能看到退出状态。而 `presentBashResult` 随后把同一个字符串原样作为 terminal 卡片的 `output` 返回，同时又把该标记解析进 `exitCode`，TUI 则在 `output` 之后再渲染自己的暗色 `[exit N]` 徽标。于是每一次非零退出、每一次信号终止都会同时打印两种形式。
+
+两个产出方各自都没有错：`TerminalResultView` 明确约定 `output` 是捕获的命令输出，`exitCode`/`signal` 是独立的结构化字段，正是为了让有能力的 UI 能显示徽标。缺陷在于 `presentBashResult` 把已被消费的标记同时放进了两个位置。TUI 自己的快照 fixture（测试前置数据）掩盖了它：手工构造的卡片 fixture 提供的 `output` 不含标记，而唯一真实录制的 bash 流程（`bash-terminal-card`）执行 `echo TERMINAL_OK`，退出码为 0，因此根本不会发出标记。
+
+## Decision
+
+`parseExitStatus` 现在返回 `{ body, …exit }`：它在自己锚定的标记处切分渲染后的文本，于是调用方拿到的输出正文不再包含它消费掉的那行状态。`presentBashResult` 把该正文作为卡片的 `output` 传出。只有退出／信号标记会离开输出；`[output truncated: …]`、`[timed out after Nms]` 以及沙箱拒绝与升权提示行仍留在正文中，因为它们携带的事实是退出徽标无法体现的。
+
+切分逻辑放在 `render.ts` 中、紧邻它所反演的标记发出处。发出、解析与剥除本就必须在同一个文件里协同演进，一个往返测试把这三者钉在一起。
+
+## Alternatives considered
+
+- **在 TUI 中去掉 `[exit N]` 徽标。** 已否决：该徽标是可快速扫读的状态，其样式与位置独立于命令输出，而且对于由 `bash` 之外的工具产出的 `TerminalResultView`，它是卡片能拿到的唯一退出信号。
+- **在 TUI 渲染器中剥除该标记。** 已否决：渲染器将不得不知晓 `dsh-tool-bash` 的标记词汇，而剥除应当与已经消费它的那次解析放在一起。工具的渲染意图应由工具自己定义。
+- **不再从 `renderResult` 发出该标记。** 已否决：在单个文本结果中，该标记是模型唯一的退出信号，而且 `tool:bash` 提示词章节会教模型去检查它。
+- **让 `execute` 在文本之外一并返回结构化的退出状态。** 已否决：`presentResult(args, result)` 刻意设计为对内容块的纯函数，从而可以从会话日志回放，而日志只保留渲染后的文本。
+
+## Consequences
+
+卡片正文不再以标记结尾，因此从日志回放的会话与实时运行渲染出同样的单个徽标。既有的仅影响展示的残留问题现在稍微扩大，并已记录在包（package）的 README 中：如果输出的最后一行恰好正是 `[exit code: N]` 或 `[killed by signal: …]`，它会被读成标记，既显示错误的徽标，也会把该行从卡片正文中丢掉。
+
+[工具卡片标题 note](../feature/2026-07-27-tui-tool-card-header.md) 中的刻意处理保持不变：terminal 的退出状态仍沿用既有的暗色 `[exit N]` 行，而不是并入统一的页脚。
+
+## Testing
+
+`tools.spec.ts` 针对非零退出、信号终止与正常运行三种情形钉住不含标记的正文；断言超时标记会与被剥除的退出标记并存；并扩展 `renderResult`/`parseExitStatus` 往返测试，断言正文中不再残留被消费的标记。
+
+该缺陷对所有既有快照都不可见，因此 `tui-keyless-smoke.e2e.ts` 新增了一个真实 PTY 场景：脚本化适配器以 `printf …; exit 3` 调用真实的 `bash` 工具，测试断言终端输出包含该命令的 stdout 与 `[exit 3]`，但绝不出现 `[exit code: 3]`。若回退 presenter 的修复，它能复现重复渲染。
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
new file mode 100644
index 0000000000..60285a26b0
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
+2026-07-28-cross-workspace-resume.md: 09b638398ea9379d39df94fcb42da3395cdd70df
+2026-07-28-cross-workspace-resume.zh.md: 5a2e7d2535c07b4ace0416b234dc28b32cbcd2fc
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
new file mode 100644
index 0000000000..09b638398e
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
@@ -0,0 +1,52 @@
+# Agent Note: Cross-workspace session resume
+
+Status: implemented
+
+English | [中文](2026-07-28-cross-workspace-resume.zh.md)
+
+## Problem
+
+`/resume` could only reach sessions started in the launch directory, so returning to yesterday's work in another project meant remembering its path, leaving the TUI, and relaunching there. Two independent causes produced that limit, and fixing either alone changes nothing.
+
+Storage was the binding one. The shipped `tui-demo` bundle defaulted `persistenceRoot` to a relative `./.sessions`, so each launch directory owned a disjoint JSONL root and a disjoint derived `session-query.db`. Sessions from another project were not filtered out of the listing — they were absent from the store the listing reads. The JSONL backend already partitions per-cwd *inside* one root, so the partitioning was doubled: once by root, once within it.
+
+The picker then filtered again. It dropped records whose `cwd` differed from the current session before display, and `summarizeResumeCandidate` independently marked a differing `cwd` as `disabledReason: 'different workspace'`, so a foreign session that did reach the store was both hidden and refused.
+
+Finally, resume never changed directory. The host re-execs `dsh --resume=<id>` through `process.execve`, which inherits the cwd. Session *header* cwd is restored from the log, but process cwd is what `dsh-fs-local`, the bash executor, and glob/grep resolve against, so resuming a foreign session would have replayed its transcript while acting on the wrong project.
+
+## Decision
+
+The dsh launcher supplies one session root under its Harness home through a boot slot, the picker gains a workspace scope, and the handoff carries the target directory.
+
+**Storage.** `dsh-paths` owns the location as `resolveSessionsRoot()` (`sessions` under the Harness home, by `resolveDshHome`'s precedence), but only the launcher assumes it: shared-store policy is the dsh CLI's, never a plugin's. The TUI surface provides the root through the `SESSIONS_ROOT_KEY` boot slot (`ctx.provide` before Loader entries mount) and `dsh web` patches the same root in `apps/cli/src/app-cli-entry.ts`. Two CLI surfaces computing that path independently is exactly the failure this change fixes — disjoint stores — so the fact gets one home rather than a `join` per caller, alongside the existing `registryRoot()` precedent for `run`.
+
+`tui-demo` itself keeps a project-local `./.sessions` default and reads the launcher slot between explicit config and that default (`config.persistenceRoot ?? ctx.get(SESSIONS_ROOT_KEY) ?? './.sessions'`). The precedence lives in `composeTuiApp`, not as a schemastery `.default()`, because a schema default would materialize before the compose function runs and shadow the slot for every Loader mount. `examples/tui-agent/cordis.yml` omits `persistenceRoot` so the launcher slot (or, for a bare example boot, the project-local default) applies. Configuring an explicit root always wins, which remains the correct choice for a hermetic deployment.
+
+**Scope, not exclusion.** A workspace other than the current one is a display scope rather than a disabled reason. `showResume()` summarizes every record and the `ResumePicker` owns a `scope` of `'workspace' | 'all'`, defaulting to the current workspace so the common case is unchanged. Tab toggles; the scope line names the active scope and the count the other holds; each row in the all-workspaces scope reports its own workspace, and that label joins the searchable text only in the scope that shows it. A toggle clears the query and selection so the highlighted row always belongs to the visible list, and the per-row workspace line makes a row one terminal row taller in that scope, which the visible-count budget accounts for.
+
+`summarizeResumeCandidate` therefore drops `'different workspace'` and gains `'session has no recorded workspace'`. That is a real new refusal rather than a rename: a header without `cwd` names no directory for the host to enter, so it cannot be handed off even though its log is intact.
+
+**Handoff.** `TuiResumeHost.handoff` takes the target `cwd` beside the `SessionId`. `preflightResume` resolves both together and returns them, so the caller cannot re-derive a stale directory from the row it displayed — a record whose `cwd` moved between listing and preflight is resumed in the *re-read* directory, which is why the former "reject a moved cwd" behavior is now a handoff with the new path. The shipped host chdirs before disposing the app: an unreachable directory must reject while the caller can still restore the terminal, because after teardown no owner remains to report to. `resumeArgs` keeps the `meta` subcommand form only when the target is this checkout, since `dsh meta` chdirs to the harness source itself and would override any other workspace.
+
+## Alternatives considered
+
+**Patch `persistenceRoot` from the `dsh` launcher instead of changing the bundle default.** Rejected after finding that a loader patch assigns `config` wholesale. The personal `~/.dsh/config.yaml` overlay already patches the `tui-agent` row with a partial config, which is exactly why `persistenceRoot` was falling back to the bundle default in the first place; a launcher patch would either be erased by that overlay or have to win over it and make the overlay unable to set the field. Owning the default in the bundle survives any partial patch and keeps one home for the fact.
+
+**Keep `./.sessions` and additionally scan the Harness-home root.** Rejected: two roots means two SQLite indexes and a merged listing whose rows have different liveness and revision authorities, to preserve visibility of logs that the no-migration decision already gives up.
+
+**Migrate existing project-local logs into the shared root.** Rejected by the requester. Sessions under a project's `./.sessions` stay on disk and stay resumable by explicit `dsh --resume <id>` from that directory, but no longer appear in `/resume`.
+
+**One flat list of every workspace.** Rejected: it loses the "this project" default that the overwhelmingly common case wants, and in a busy home directory the current project's sessions would compete with unrelated ones.
+
+**Let the host infer the directory from the restored session header.** Rejected: the header is model- and prompt-facing state restored *after* boot, while the directory must be entered *before* `execve`. Passing it explicitly keeps the ordering visible at the seam.
+
+## Consequences
+
+- Sessions already stored under a project-local `./.sessions` disappear from `/resume`. This is the accepted cost of no migration.
+- One shared root makes the pre-existing absence of a cross-process session lock reachable in one step: colliding used to require two terminals in the same directory, and is now one Tab away. `record.live` comes from the in-process `SessionQueryService`, so preflight rejects only sessions live in *this* runtime, while the JSONL backend takes no lock and two processes appending one log with independent `seq` counters would interleave. Closing this is no longer speculative hardening: `SessionRegistry.list()` already publishes live sessions cross-process under the same Harness home for `dsh list-sessions`, so consulting it in `summarizeResumeCandidate` is a small follow-up. It stays out of this change as pre-existing scope.
+- A resumed session can change the process's working directory, so a foreign resume is not a pure transcript restoration — every path-resolving tool moves with it.
+- The Harness home now holds session logs for every project on the machine. Its growth is no longer bounded by one checkout, and no retention policy is introduced here.
+
+## Testing
+
+TUI tests cover the default scope hiding other workspaces while reporting their count, Tab revealing them with per-row workspace labels, Tab back clearing the query and selection, searching by workspace label, a cwd-less record staying visible but disabled, and the handoff receiving both the id and the workspace re-read at preflight. The former "reject a moved cwd" case now asserts the handoff carries the new directory. `dsh-paths` tests pin `resolveSessionsRoot`'s precedence against `resolveDshHome`'s. `tui-demo` composition tests pin the project-local default and the derived `session-query.db` path. The keyless TUI snapshot pins both scopes of the selector, including the scope line, the per-row workspace lines, and the Tab hint in the footer. A manual cross-workspace resume verified at the process level that the replacement's working directory became the target workspace.
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
new file mode 100644
index 0000000000..5a2e7d2535
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
@@ -0,0 +1,52 @@
+# Agent Note: 跨 workspace 会话恢复
+
+Status: implemented
+
+[English](2026-07-28-cross-workspace-resume.md) | 中文
+
+## Problem
+
+`/resume` 只能触达在启动目录中创建的会话，因此要回到昨天在另一个项目里的工作，就得记住它的路径、退出 TUI、再到那里重新启动。造成这一限制的原因有两个，彼此独立，只修其中一个都不会有任何变化。
+
+存储是那个决定性的原因。已交付的 `tui-demo` 组合包把 `persistenceRoot` 默认成相对路径 `./.sessions`，于是每个启动目录都独占一份互不相交的 JSONL 根目录，以及一份互不相交的派生 `session-query.db`。来自另一个项目的会话并不是在列表中被过滤掉的——它们根本不存在于列表读取的存储中。JSONL 后端本来就会在*同一个*根目录*内部*按 cwd 分区，所以分区被叠加了两层：一层按根目录，一层在根目录内部。
+
+接着选择器又过滤了一次。它在展示前丢弃 `cwd` 与当前会话不同的记录，而 `summarizeResumeCandidate` 又独立地把不同的 `cwd` 标记为 `disabledReason: 'different workspace'`，于是一个确实进入了存储的外部会话既被隐藏，也会被拒绝。
+
+最后，恢复流程从不切换目录。宿主通过 `process.execve` 重新执行 `dsh --resume=<id>`，而它会继承 cwd。会话*头部*的 cwd 会从日志中还原，但 `dsh-fs-local`、bash 执行器以及 glob／grep 解析路径时依据的是进程 cwd，所以恢复一个外部会话会在回放它的 transcript（文本记录）的同时，作用到错误的项目上。
+
+## Decision
+
+dsh 启动器通过启动槽位提供其 Harness home 下的同一个会话根目录，选择器获得 workspace 范围，交接过程携带目标目录。
+
+**存储。** `dsh-paths` 以 `resolveSessionsRoot()` 拥有该位置（按 `resolveDshHome` 的优先级，取 Harness home 下的 `sessions`），但只有启动器假定它：共享存储策略属于 dsh CLI，绝不属于插件。TUI 界面通过 `SESSIONS_ROOT_KEY` 启动槽位（在 Loader 条目挂载前 `ctx.provide`）提供该根目录，`dsh web` 则在 `apps/cli/src/app-cli-entry.ts` 中为同一根目录打补丁。CLI 的两处界面各自独立计算该路径，正是本次改动所修复的那种失败——互不相交的存储——因此这项事实只有一个归属，而不是每个调用方各做一次 `join`，这与 `run` 已有的 `registryRoot()` 先例一致。
+
+`tui-demo` 自身保持项目本地的 `./.sessions` 默认值，并在显式配置与该默认值之间读取启动器槽位（`config.persistenceRoot ?? ctx.get(SESSIONS_ROOT_KEY) ?? './.sessions'`）。这一优先级放在 `composeTuiApp` 内，而不是写成 schemastery 的 `.default()`，因为 schema 默认值会在 compose 函数运行前物化，使每次 Loader 挂载都遮蔽该槽位。`examples/tui-agent/cordis.yml` 不写 `persistenceRoot`，因此启动器槽位（裸示例启动时则为项目本地默认值）生效。显式配置的根目录总是获胜，对于封闭部署来说这仍然是正确的选择。
+
+**是范围，不是排除。** 当前 workspace 之外的 workspace 是一种展示范围，而不是禁用理由。`showResume()` 汇总每一条记录，`ResumePicker` 持有一个 `'workspace' | 'all'` 的 `scope`，默认为当前 workspace，因此常见场景毫无变化。Tab 切换范围；范围行会说明当前生效的范围，以及另一个范围下的数量；在全 workspace 范围中每一行都报告自己的 workspace，而该标签只在展示它的范围里才加入可搜索文本。切换范围会清空查询和选中项，使高亮行始终属于可见列表；而逐行的 workspace 行会让该范围下的每一行在终端里多占一行，可见条数预算已经把这一点计入。
+
+因此 `summarizeResumeCandidate` 去掉了 `'different workspace'`，并新增 `'session has no recorded workspace'`。这是一条真正新增的拒绝理由，而不是改名：没有 `cwd` 的头部没有指明任何目录供宿主进入，所以即便它的日志完好也无法完成交接。
+
+**交接。** `TuiResumeHost.handoff` 在 `SessionId` 之外还接收目标 `cwd`。`preflightResume` 把两者一起解析并一起返回，因此调用方无法从它展示过的那一行里重新推导出一个陈旧目录——在列表展示与预检之间 `cwd` 发生了移动的记录，会在*重新读取到的*目录中恢复，这也是原先「拒绝已移动的 cwd」的行为如今变成携带新路径完成交接的原因。已交付的宿主在释放应用之前切换目录：不可达的目录必须在调用方还能恢复终端时就拒绝，因为拆卸之后已经没有任何所有者可供汇报。`resumeArgs` 只在目标就是本 checkout 时才保留 `meta` 子命令形式，因为 `dsh meta` 会切换到 harness 源码本身，从而覆盖任何其他 workspace。
+
+## Alternatives considered
+
+**从 `dsh` 启动器给 `persistenceRoot` 打补丁，而不是改动组合包默认值。** 在发现 loader 补丁会整体赋值 `config` 之后否决。个人的 `~/.dsh/config.yaml` 覆盖层已经用一份局部配置给 `tui-agent` 那一项打了补丁，这恰恰就是 `persistenceRoot` 一开始会退回到组合包默认值的原因；启动器补丁要么会被该覆盖层擦除，要么必须压过它，从而让覆盖层再也无法设置这个字段。把默认值放在组合包里能经受任何局部补丁，并让这项事实只有一个归属。
+
+**保留 `./.sessions`，并额外扫描 Harness home 根目录。** 否决：两个根目录意味着两份 SQLite 索引，以及一份合并列表——其中各行的活跃状态与版本权威来源并不相同，而这一切只是为了保住不做迁移的决策本就已经放弃的那部分日志可见性。
+
+**把现有的项目本地日志迁移到共享根目录。** 被需求方否决。项目 `./.sessions` 下的会话仍留在磁盘上，从该目录显式执行 `dsh --resume <id>` 仍可恢复，只是不再出现在 `/resume` 中。
+
+**把所有 workspace 铺成一个扁平列表。** 否决：这会丢掉绝大多数场景想要的「本项目」默认值，而在一个繁忙的 home 目录里，当前项目的会话会和无关会话争夺注意力。
+
+**让宿主从还原后的会话头部推断目录。** 否决：会话头部是面向模型与提示词的状态，在启动*之后*才还原，而目录必须在 `execve` *之前*进入。显式传递它能让这个顺序在边界处保持可见。
+
+## Consequences
+
+- 已经存放在项目本地 `./.sessions` 下的会话会从 `/resume` 中消失。这是不做迁移所接受的代价。
+- 同一个共享根目录让原本就缺失的跨进程会话锁一步之内即可触达：过去要造成冲突需要在同一个目录里开两个终端，如今只差一次 Tab。`record.live` 来自进程内的 `SessionQueryService`，因此预检只会拒绝在*本*运行时中处于活跃状态的会话，而 JSONL 后端不加任何锁，两个进程用各自独立的 `seq` 计数器追加同一份日志会互相交错。解决这一点已不再是投机性加固：`SessionRegistry.list()` 已经为 `dsh list-sessions` 在同一个 Harness home 下跨进程发布活跃会话，因此在 `summarizeResumeCandidate` 中查询它是一项小的后续工作。它作为既有范围之外的问题不纳入本次改动。
+- 恢复一个会话可以改变进程的工作目录，因此恢复外部会话不是单纯的 transcript 还原——每个解析路径的工具都会随之移动。
+- Harness home 现在保存着这台机器上每个项目的会话日志。它的增长不再受单个 checkout 约束，而本记录也没有引入任何保留策略。
+
+## Testing
+
+TUI 测试覆盖默认范围隐藏其他 workspace 但报告其数量、Tab 显示它们并带上逐行 workspace 标签、再按 Tab 返回时清空查询与选中项、按 workspace 标签搜索、无 cwd 的记录仍可见但不可选，以及交接同时收到 id 和在预检时重新读取到的 workspace。原先「拒绝已移动的 cwd」的用例现在断言交接携带新目录。`dsh-paths` 测试固定 `resolveSessionsRoot` 的优先级与 `resolveDshHome` 的一致。`tui-demo` 组合测试固定项目本地默认值以及派生出的 `session-query.db` 路径。无密钥 TUI 快照固定选择器的两个范围，包括范围行、逐行 workspace 行，以及页脚中的 Tab 提示。手动执行的一次跨 workspace 恢复在进程层面验证了替换后进程的工作目录变为目标 workspace。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
new file mode 100644
index 0000000000..07fbaed171
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
+2026-07-28-tui-dim-tool-result-output.md: 3eab3e57158c1bbcbadf233e27e50360601c84d5
+2026-07-28-tui-dim-tool-result-output.zh.md: cac06245f6c9d71a358f789099512a5a4a84eb49
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
new file mode 100644
index 0000000000..3eab3e5715
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
@@ -0,0 +1,39 @@
+# Agent Note: Dim tool-result output inside TUI tool cards
+
+Status: implemented
+
+English | [中文](2026-07-28-tui-dim-tool-result-output.zh.md)
+
+## Problem
+
+After the [fixed `Tool / <name>` header](2026-07-27-tui-tool-card-header.md) moved every tool-specific detail into the card body, that body became a flat block at the terminal's default foreground: a presenter title, a terminal `$` command, its cwd, and the tool's own output all read as one undifferentiated run of text. A transcript of several calls gave no visual cue for where the card's framing ended and what the tool actually produced began, and long command output competed with the surrounding conversation for attention even though it is reference material a reader skims rather than reads.
+
+## Decision
+
+The framing/output split below is superseded by [one dim tone for the whole card body](2026-07-28-tui-uniform-dim-card-body.md), which keeps dim output but extends it over the framing rows; that note owns the current rule and the reason the split read as scatter. What remains current here is why tool output is recessed at all, and the diff-card and blank-row carve-outs both notes share.
+
+Inside a tool card, the tool's own output renders in the `dim` palette role while the card's framing keeps its existing color. Framing is the presenter title, a terminal card's `$` command line and cwd row, and a diff card's per-file path headers and `+`/`-` lines; output is a terminal card's captured stdout/stderr and a generic card's result text.
+
+`ToolCardComponent.renderBody` in `packages/ui/tui/src/components/transcript.ts` returns a `CardBody` of `{ prelude, lines }` instead of one flat string array. `prelude` holds already-styled framing rows that render verbatim; `lines` holds the tool's text. A terminal card dims its output rows through `dimOutput`, which leaves a blank row as the empty string so the branch's existing blank-row filter still drops it rather than keeping an ANSI-wrapped empty value. A diff card returns its hunks and change footer entirely as `prelude`: the `+`/`-` colors already carry the diff's meaning, and dimming them would fight that signal.
+
+A generic card renders its title and result as one Markdown document and dims only the rows past the title's, in `dimPastPrelude`. Rendering the title alone at the same width yields its row count, so the split survives wrapping and the document keeps its own block spacing — notably the blank row pi-tui's Markdown places between a leading paragraph and a following heading, which a two-document split would drop. A whitespace-only row is left unwrapped so Markdown's line padding stays out of the styled ranges. Markdown role colors (headings, inline code) still apply over the dim base, so a dim result keeps its internal structure.
+
+Exit and signal markers keep their existing roles (`dim [exit N]`, `error [signal …]`), and the collapsed-preview marker stays dim, so the change adds no new palette role and no configuration.
+
+## Alternatives considered
+
+**Dim the whole card body.** Rejected: it flattens a diff card's `+`/`-` green and red, which is the one place color carries meaning rather than emphasis, and it dims the `$` command a reader scans for to identify what ran.
+
+**Change the generic card's Markdown base color and keep the title inside the same document.** Rejected: `DefaultTextStyle.color` applies uniformly to every row, so the title would dim along with the result. Splitting the title into its own document instead loses the blank row Markdown inserts before a heading, which visibly closed the gap between title and result in the `run_code` and `cordis_inspect` cards.
+
+**Introduce a dedicated `toolOutput` palette role.** Rejected: no consumer needs it distinct from `dim`, and the palette's role set is the contract other components read; adding a role that resolves to the same SGR pair buys nothing.
+
+**Dim every row unconditionally in `dimOutput`.** Rejected: wrapping an empty string yields a non-empty ANSI value, which defeats the terminal branch's `filter(Boolean)` and adds a blank row to every card whose output ends in a newline — that is, nearly every real bash result.
+
+## Consequences
+
+A card now reads as framing plus output at a glance, and a transcript of many calls scans as a column of headers with recessed detail beneath each. The cost is that `dimPastPrelude` renders a generic card's Markdown twice per frame — once for the prelude alone to count its rows, once for the whole document — which is acceptable at card scale and keeps the row split correct under wrapping. Because dim is an SGR attribute rather than a color, a result's Markdown role colors survive underneath it, so a dim body is still structured rather than uniformly gray. The treatment is TUI-local: ACP and JSON-RPC bridges keep their own tool-call presentation, and no presenter or `presentation.ts` type changed.
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` pins the blank-row guard with color enabled, where the dim wrapper is what makes an empty row non-empty; the assertion fails if `dimOutput` wraps unconditionally. The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` and `examples/tui-agent/tests/snapshots/` were re-recorded and carry the new `dim` style ranges for bash output, read output, `run_code`, `workflow`, `subagent`, `todo_write`, and `cordis_*` results, while the diff cards' `+`/`-` ranges and the `$` command rows are unchanged.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
new file mode 100644
index 0000000000..cac06245f6
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
@@ -0,0 +1,39 @@
+# Agent Note: Dim tool-result output inside TUI tool cards
+
+Status: implemented
+
+[English](2026-07-28-tui-dim-tool-result-output.md) | 中文
+
+## Problem
+
+[固定的 `Tool / <name>` 表头](2026-07-27-tui-tool-card-header.md)把每一项工具专属的细节都移入卡片正文后，正文成为使用终端默认前景色的扁平文本块：presenter 标题、终端的 `$` 命令及其 cwd，以及工具自身的输出都成了一段无法区分的文本。包含多次调用的 transcript（文本记录）无法在视觉上区分卡片框架到哪里结束、工具实际产生的内容从哪里开始；而且命令输出较长时会与周围的对话争夺注意力，尽管它只是供读者扫读而非细读的参考资料。
+
+## Decision
+
+下文所述的框架/输出划分已由[整个卡片正文统一使用一种暗色调](2026-07-28-tui-uniform-dim-card-body.md)取代：后者保留输出的暗色样式，并将其扩展到框架行；当前规则以及这种划分为何呈现为颜色散乱，均由该说明负责记录。本文仍然有效的是工具输出为何需要弱化，以及两篇说明共同保留的 diff 卡片和空白行例外。
+
+在工具卡片中，工具自身的输出使用调色板的 `dim` 角色渲染，而卡片框架保留既有颜色。框架包括 presenter 标题、终端卡片的 `$` 命令行与 cwd 行，以及 diff 卡片各文件的路径表头和 `+`/`-` 行；输出包括终端卡片捕获的 stdout/stderr，以及 generic 卡片的结果文本。
+
+`ToolCardComponent.renderBody` 在 `packages/ui/tui/src/components/transcript.ts` 中返回 `CardBody`，其内容为 `{ prelude, lines }`，而非单一的扁平字符串数组。`prelude` 保存已设置样式并按原样渲染的框架行；`lines` 保存工具文本。终端卡片通过 `dimOutput` 将输出行变暗；该函数会把空白行保留为空字符串，使此分支既有的空白行过滤逻辑仍会丢弃它，而不会保留一个带 ANSI 包装的空值。diff 卡片将其变更块与变更页脚全部作为 `prelude` 返回：`+`/`-` 的颜色已经承载了 diff 的含义，再将它们变暗会干扰这一信号。
+
+对于 generic 卡片，标题与结果作为同一个 Markdown 文档渲染，再由 `dimPastPrelude` 仅将标题之后的行变暗。以相同宽度单独渲染标题即可得到它的行数，因此即使发生折行，也能正确划分两部分，同时文档仍可保留自身的块间距，尤其是 pi-tui 的 Markdown 在开头段落与后续标题之间插入的空白行；拆成两个文档会丢失该空白行。仅含空白字符的行不会添加样式包装，因此 Markdown 的行填充不会进入样式范围。Markdown 的角色颜色（标题、内联代码）仍会叠加于暗色基础样式之上，因此变暗的结果仍保留内部结构。
+
+退出和信号标记保留既有角色（`dim [exit N]`、`error [signal …]`），折叠预览标记也保持变暗，因此此变更没有新增调色板角色或配置。
+
+## Alternatives considered
+
+**将整个卡片正文变暗。** 已否决：这会削弱 diff 卡片中 `+`/`-` 的绿色和红色，而这里的颜色承载的是含义而非强调；同时还会把读者用来确认所运行命令的 `$` 命令变暗。
+
+**更改 generic 卡片的 Markdown 基础颜色，并将标题留在同一个文档中。** 已否决：`DefaultTextStyle.color` 会统一应用于每一行，因此标题会随结果一起变暗。改为把标题拆成单独的文档，又会丢失 Markdown 在标题前插入的空白行，从视觉上消除 `run_code` 和 `cordis_inspect` 卡片中标题与结果之间的间隔。
+
+**引入专用的 `toolOutput` 调色板角色。** 已否决：没有消费方需要将其与 `dim` 区分，而调色板的角色集合是其他组件读取的契约；新增一个解析为相同 SGR 组合的角色没有收益。
+
+**在 `dimOutput` 中无条件将每一行变暗。** 已否决：包装空字符串会得到一个非空的 ANSI 值，使终端分支的 `filter(Boolean)` 失效，并为输出以换行符结尾的每张卡片都增加一个空白行，而几乎每条真实 bash 结果都以换行符结尾。
+
+## Consequences
+
+卡片现在一眼就能看出框架与输出，包含大量调用的 transcript 也呈现为一列表头，每个表头下方是弱化的细节。代价是 `dimPastPrelude` 每帧会渲染 generic 卡片的 Markdown 两次：第一次只渲染 prelude 以统计行数，第二次渲染整个文档；在卡片规模下，这一开销可以接受，并能在折行时保持正确的行划分。由于变暗效果是 SGR 属性而非颜色，结果中的 Markdown 角色颜色仍能在其下保留，因此变暗的正文仍有结构，而不是统一的灰色。此处理仅限 TUI：ACP 和 JSON-RPC 桥接层保留各自的工具调用呈现方式，所有 presenter 与 `presentation.ts` 类型均未改变。
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` 在启用颜色的情况下固定了空白行守卫，此时正是 dim 包装层使空白行成为非空值；如果 `dimOutput` 无条件包装，该断言就会失败。`packages/ui/tui/tests/snapshots/` 与 `examples/tui-agent/tests/snapshots/` 下的无密钥终端快照已重新录制，并加入新的 `dim` 样式范围，覆盖 bash 输出、read 输出、`run_code`、`workflow`、`subagent`、`todo_write` 和 `cordis_*` 结果，同时 diff 卡片的 `+`/`-` 范围与 `$` 命令行保持不变。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
new file mode 100644
index 0000000000..506e343d61
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
+2026-07-28-tui-foldable-context-cards.md: ff96c30db231c682a5a4d6a9aa3b94a283b8501b
+2026-07-28-tui-foldable-context-cards.zh.md: ceb9f28834d26abc5717174dd34ab316e3754284
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
new file mode 100644
index 0000000000..ff96c30db2
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
@@ -0,0 +1,35 @@
+# Agent Note: Foldable injected-context cards in the TUI
+
+Status: implemented
+
+English | [中文](2026-07-28-tui-foldable-context-cards.zh.md)
+
+## Problem
+
+The TUI rendered every injected-context message (a non-`user` `user/message` source: `workspace-context`, `goal`, and other plugins) as three loose transcript children — a dim `Context · <label>` header, the message's XML root element name (`system-reminder`), and the body — always fully expanded. Two things read badly. First, unlike tool-call cards, a context card could not be collapsed, so a large `workspace-context` reminder occupied the transcript permanently with no `Ctrl+O` fold. Second, the XML root element rendered as its own literal line (`system-reminder`) directly under the `Context · workspace-context` header that already names the source, so the frame element read as raw-XML noise duplicating the header.
+
+## Decision
+
+Injected context renders as a `ContextCardComponent` (`packages/ui/tui/src/components/transcript.ts`), a collapsible dim card that shares the tool-card `Ctrl+O` toggle and starts collapsed. Its header is the same dim `Context · <label>` line. Its body is the message text as muted prose rows with the redundant frame lines stripped: the source label already names the context, so the body starts at the instruction content and the `system-reminder` line is gone. The body folds to the card's `maxToolOutputLines` budget through the shared `preview` helper, showing the `… +N lines (Ctrl+O to expand)` marker. Neither the fold nor the frame stripping depends on the payload's syntax ([content-independent fold](../bug-fix/2026-07-28-context-card-content-independent-fold.md), [prose rendering](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)); this note's original implementation routed both through `renderUnknownXml`.
+
+`Ctrl+O` cycles the shared `toggleTools` handler through three states — collapsed preview, expanded, hidden — matching Codex's behavior: the hidden phase removes tool cards (and their leading gap, which the card renders itself) from the transcript entirely. Context cards carry injected instructions rather than tool traffic, so they never hide; the hidden phase reads as their collapsed preview. The notice names the state (`Tool and context cards {collapsed|expanded}.` / `Tool cards hidden.`) and the `/help` shortcut line reads `Ctrl+O cycle cards (collapse/expand/hide)`. `renderEvent` tracks each card in a `contextCards` set alongside `allToolCards`, cleared by `rebuildTranscript`.
+
+The label derivation tolerates a non-object source shape (an invalid injected source that is neither a session-reference card nor an object): it falls back to the generic `context` heading rather than dereferencing `plugin`/`kind` off a non-object. The `sessionReferenceCard` branch (the single-line referenced-sessions row) is unchanged — it has nothing to fold.
+
+The change is TUI-only. It touches `ContextCardComponent`/`ToolCardComponent` wiring in `transcript.ts` and the `renderEvent`/`toggleTools`/help paths in `packages/ui/tui/src/index.ts`. No producer, session event, or other UI bridge (ACP, JSON-RPC) changes; the fold shape is TUI-local and not a cross-package contract.
+
+## Alternatives considered
+
+**Keep context cards fully expanded, only drop the root line.** Rejected: the primary complaint was that a large `workspace-context` reminder cannot be folded like a tool card. Dropping the redundant frame line alone leaves the transcript-occupancy problem unsolved.
+
+**A dedicated shortcut for context cards, independent of tool cards.** Rejected in favor of sharing `Ctrl+O`: one key matches the existing mental model and adds nothing to learn or document, and the two card kinds fold for the same reason (transcript noise). The cycle's hidden phase applies only to tool cards for the same reason a shared key works: hiding injected instructions would remove content the user cannot recover from any other card.
+
+**Suppress the root line generically inside `renderUnknownXml`.** Rejected: `renderUnknownXml` also renders unknown tool results, where the root element is meaningful. Root suppression is a context-card presentation choice and lives in `ContextCardComponent`, keeping the tool-card path unchanged.
+
+## Consequences
+
+A `workspace-context` reminder now collapses with the same `Ctrl+O` that folds tool cards, and its body no longer prints the redundant `system-reminder` frame line under the header. The cost is a second card kind tracked for the shared cycle and a small label-shape fallback for invalid injected sources. Because the change is confined to the TUI transcript, ACP and JSON-RPC bridges keep their own injected-context presentation.
+
+## Testing
+
+`packages/ui/tui/tests/tui.spec.ts` pins that a context card is collapsed by default with the `Ctrl+O to expand` marker, expands on `Ctrl+O` with the `Tool and context cards expanded.` notice, survives the hidden phase at its collapsed preview while tool cards disappear from a repaint, returns to `collapsed` on the fourth press, drops the `system-reminder` frame line, renders unframed context as muted prose, and renders an empty frame header-only. The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` — rendered through the real assembled TUI and a pseudo-terminal — were re-recorded and show the frame-less context card, the updated toggle notice, and the updated `/help` shortcut line.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
new file mode 100644
index 0000000000..ceb9f28834
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
@@ -0,0 +1,35 @@
+# Agent Note: TUI 中的可折叠注入上下文卡片
+
+Status: implemented
+
+[English](2026-07-28-tui-foldable-context-cards.md) | 中文
+
+## 问题
+
+TUI 会将每条注入上下文消息（即一条来源不是 `user` 的 `user/message`：`workspace-context`、`goal` 及其他插件）渲染为 transcript（文本记录）中的三个零散子项：暗色的 `Context · <label>` 标题、消息的 XML 根元素名称（`system-reminder`）和正文，并且始终完全展开。这种呈现有两处影响阅读。第一，与工具调用卡片不同，上下文卡片无法折叠，因此较大的 `workspace-context` 提醒会一直占据 transcript，无法通过 `Ctrl+O` 折叠。第二，XML 根元素会直接显示在已经注明来源的 `Context · workspace-context` 标题下方，单独形成一行字面值（`system-reminder`）；这使外框元素成为重复标题信息的原始 XML 噪声。
+
+## 决策
+
+注入上下文渲染为 `ContextCardComponent`（`packages/ui/tui/src/components/transcript.ts`）。这是一个可折叠的暗色卡片，与工具卡片共用 `Ctrl+O` 切换操作，初始状态为折叠。其标题仍是暗色的 `Context · <label>` 行。正文是去掉多余外框行后、以暗色文本按行渲染的消息内容：来源标签已经指明上下文，因此正文直接从指令内容开始，不再显示 `system-reminder` 行。正文通过共用的 `preview` 辅助函数折叠到卡片的 `maxToolOutputLines` 行数限额，并显示 `… +N lines (Ctrl+O to expand)` 标记。折叠与去外框都不依赖载荷的语法（[与内容无关的折叠](../bug-fix/2026-07-28-context-card-content-independent-fold.md)、[渲染为文本](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)）；本记录最初的实现是把两者都走 `renderUnknownXml`。
+
+`Ctrl+O` 让共享的 `toggleTools` 处理器在三种状态间循环——折叠预览、展开、隐藏——与 Codex 的行为一致：隐藏阶段把工具卡片（连同卡片自渲染的前导空行）从 transcript 中完全去掉。上下文卡片承载的是注入指令而非工具流量，因此从不隐藏；隐藏阶段对它们呈现为折叠预览。通知文本按状态命名（`Tool and context cards {collapsed|expanded}.` / `Tool cards hidden.`），`/help` 中的快捷键说明为 `Ctrl+O cycle cards (collapse/expand/hide)`。`renderEvent` 将每张上下文卡片记录在 `contextCards` 集合中，与 `allToolCards` 并列；`rebuildTranscript` 会清空该集合。
+
+标签派生逻辑可以处理非对象形态的来源（既不是会话引用卡片也不是对象的无效注入来源）：系统会回退到通用的 `context` 标题，而不会从非对象值中解引用 `plugin`／`kind`。`sessionReferenceCard` 分支（引用会话的单行条目）保持不变，其中没有可折叠内容。
+
+此变更仅限于 TUI。它涉及 `transcript.ts` 中 `ContextCardComponent`／`ToolCardComponent` 的连接，以及 `packages/ui/tui/src/index.ts` 中的 `renderEvent`／`toggleTools`／帮助信息路径。生产方、会话事件和其他 UI 桥接层（ACP、JSON-RPC）均无需变更；折叠方式属于 TUI 的局部实现，并非跨包契约。
+
+## 考虑过的替代方案
+
+**保持上下文卡片完全展开，仅去掉根元素行。** 不予采纳：最主要的问题是较大的 `workspace-context` 提醒无法像工具卡片一样折叠。只去掉多余的外框行，仍无法解决 transcript 占用问题。
+
+**为上下文卡片设置独立快捷键，与工具卡片分开。** 不予采纳，选择共享 `Ctrl+O`：统一按键符合现有认知模式，无需学习或记录新的按键；两类卡片的折叠目的相同，都是减少 transcript 噪声。循环的隐藏阶段只作用于工具卡片，理由与共享按键成立的理由相同：隐藏注入指令会移除用户无法从其他卡片找回的内容。
+
+**在 `renderUnknownXml` 内统一隐藏根元素行。** 不予采纳：`renderUnknownXml` 还用于渲染未知的工具结果，此时根元素具有实际意义。隐藏根元素是上下文卡片的呈现选择，应由 `ContextCardComponent` 负责，从而保持工具卡片路径不变。
+
+## 后果
+
+`workspace-context` 提醒可以通过折叠工具卡片的同一个 `Ctrl+O` 折叠，其正文也不再在标题下方显示多余的 `system-reminder` 外框行。代价是共享循环逻辑需要额外跟踪第二种卡片，并为无效注入来源增加一小段标签形态回退逻辑。由于此变更仅限于 TUI transcript，ACP 和 JSON-RPC 桥接层会保留各自的注入上下文呈现方式。
+
+## 测试
+
+`packages/ui/tui/tests/tui.spec.ts` 固定以下行为：上下文卡片默认折叠并显示 `Ctrl+O to expand` 标记；按下 `Ctrl+O` 后展开，并显示 `Tool and context cards expanded.` 通知；在隐藏阶段以折叠预览存活、而工具卡片在重绘后消失；第四次按键回到 `collapsed`；不显示 `system-reminder` 外框行；将不带外框的上下文渲染为暗色文本；空外框只渲染标题。`packages/ui/tui/tests/snapshots/` 下的无密钥终端快照通过实际组装的 TUI 和伪终端渲染，并已重新录制；其中展示了不带外框元素的上下文卡片、更新后的切换通知，以及更新后的 `/help` 快捷键说明。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
new file mode 100644
index 0000000000..9c59295fa9
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
+2026-07-28-tui-uniform-dim-card-body.md: 571ae517b508e0ca49571237dfe96d9b710f8721
+2026-07-28-tui-uniform-dim-card-body.zh.md: 4b776d3ade411e1ef6e18c527907457ea719bfba
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
new file mode 100644
index 0000000000..571ae517b5
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
@@ -0,0 +1,51 @@
+# Agent Note: One dim tone for the whole TUI tool-card body
+
+Status: implemented
+
+English | [中文](2026-07-28-tui-uniform-dim-card-body.zh.md)
+
+## Problem
+
+[Dimming tool-result output](2026-07-28-tui-dim-tool-result-output.md) split a tool card into framing that keeps its own color and output that renders dim. In a real transcript that split read as scatter rather than structure, because the framing rows are not one color: a generic card's presenter title (`Read src/foo.ts (95 - 149)`, `Update todo list`) stayed at the terminal's default foreground, a terminal card's `$` command was cyan, its cwd was dim, and the output below was dim. Three tones in four consecutive rows, and the brightest one — plain default foreground, which reads as solid black on a light scheme — sat on the least informative row.
+
+An unknown tool's XML tree was worse, and is what surfaced the problem. `renderUnknownXml` styled element names through its `label` callback but emitted text content with no styling at all, while the card's collapsed `… +N lines (Ctrl+O to expand)` marker was dim. The card body therefore mixed unstyled black content rows with a dim fold hint, so the hint looked like it belonged to a different element than the text it summarized. The same undifferentiated-body complaint the earlier note set out to fix had reappeared one level down, inside the body.
+
+The underlying reason is that the two roles are indistinguishable on one of the two supported schemes. `dim` is SGR 2 on a dark scheme but ANSI 90 on a light one, exactly what `muted` always is, so a body that mixes `dim`, `muted`, and unstyled rows collapses to two tones on light terminals and three on dark — a difference that reads as inconsistency rather than as meaning.
+
+## Decision
+
+A tool card's body is one dim tone end to end. The card's only colored row is its `Tool / <name>` header, which carries call status (warning pending, success ok, error). The presenter title, a terminal card's `$` command line and its cwd, the tool's own output, an XML tree's text content, and the collapsed fold marker all render through the `dim` role.
+
+Two exceptions keep color where color is the meaning rather than emphasis: a diff card's `+`/`-` lines and per-file path headers, whose red and green *are* the diff, and a terminal card's `[signal …]` marker, which reports abnormal termination. An XML tree's element names stay `muted`, one shade off body text, because they are structure a reader navigates by rather than content.
+
+`renderUnknownXml` takes a `body` styler beside its existing `label` styler and applies it to every text row — `textBlock`'s lines and the single-line `<tag>: value` form's value. Its one caller, the unknown-tool card, passes the card's body tone (`dim`), so tree content matches the rows around it instead of falling back to the default foreground.
+
+`ContextCardComponent` renders [injected context as prose](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md) rather than parsing it, and its body moves from `muted` to `dim` for the same reason the tool cards changed: the card's header and fold marker are already `dim`, so a `muted` body was the one row group that did not match.
+
+`ToolCardComponent.dimPastPrelude` becomes `dimBody`: it still renders prelude and result as one Markdown document so the document's own block spacing survives, but dims every row rather than only those past the prelude's row count. That deletes the second Markdown render the old row-counting split needed, since there is no longer a boundary to locate. A whitespace-only row stays unwrapped, keeping Markdown's padding out of the styled ranges, and the terminal branch's blank rows stay the empty string so its `filter(Boolean)` still drops them.
+
+## Alternatives considered
+
+**Keep the framing/output split and just fix the XML tree.** Rejected: it addresses the reported symptom and leaves the cause. The split's premise is that framing shares one color, which was never true — the presenter title, the cyan `$` command, and the dim cwd are three tones — so every future framing row reopens the same question.
+
+**Give the presenter title its own role (bold, or accent).** Rejected: it adds a fourth tone to the row the user identified as noise. The header already names the tool, so the title is a detail line, not a heading; emphasizing it competes with the status color directly above it.
+
+**Keep the `$` command cyan as a scan anchor.** Considered and explicitly declined by the user in favor of a uniform body. The `$ ` prefix and the header's `/ <description>` segment already locate the command, so the color was redundant with two other cues.
+
+**Make `dim` and `muted` visually distinct on light schemes so the existing three-tone body reads as structure.** Rejected: the palette is built from the 16-color ANSI set precisely so terminals remap it, and the only tones reliably dimmer than default foreground on both schemes are the two that already collapse. Manufacturing a third would mean fixed shades, which the palette contract forbids.
+
+**Dim diff `+`/`-` lines too, for a fully monochrome transcript.** Rejected: a diff's colors carry its semantics, and the leading `+`/`-` character alone is a weaker signal that a reader must parse rather than see.
+
+## Consequences
+
+A card now reads as one colored header over a recessed block, and a transcript of many calls scans as a column of status headers. The user-visible change is that presenter titles, `$` commands, and XML tree content lost their distinct tones; the reported scatter goes with them.
+
+`dimBody` renders a generic card's Markdown once per frame instead of twice, so the earlier note's stated cost is gone. Because `dim` is an SGR attribute on dark schemes rather than a color, a result's Markdown role colors (headings, inline code) still show through underneath it, so a dim body keeps its internal structure on dark terminals; on light schemes `dim` resolves to ANSI 90 and those roles read against gray instead.
+
+The `renderUnknownXml` signature gained a required parameter, so its caller and its unit test pass a body styler; there is no default, because a caller that forgets one is exactly the bug this note fixes. The treatment stays TUI-local: no presenter, palette role, or `presentation.ts` type changed, and the ACP and JSON-RPC bridges keep their own tool-call presentation.
+
+## Testing
+
+`packages/ui/tui/tests/xml-tool-output.spec.ts` asserts the body tone through a distinct `[body]…[/body]` marker on every text row, so a regression that drops the styler fails rather than silently rendering unstyled text. It also pins that an interior blank line stays the empty string, since styling it would emit an escape-only row that reads as a stray indented blank.
+
+The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` and `examples/tui-agent/tests/snapshots/` were refreshed from committed replay scripts. Their diffs are style ranges only: `fg=cyan` and `fg=bright-black` rows become `dim`, and rows that previously carried no style gain it — covering bash output, read output, `run_code`, `workflow`, `subagent`, `todo_write`, `cordis_*`, and injected-context prose, while the diff cards' `+`/`-` ranges are unchanged.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md
new file mode 100644
index 0000000000..4b776d3ade
--- /dev/null
+++ b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md
@@ -0,0 +1,51 @@
+# Agent Note: TUI 工具卡片正文统一使用暗色调
+
+Status: implemented
+
+[English](2026-07-28-tui-uniform-dim-card-body.md) | 中文
+
+## Problem
+
+[将工具结果输出变暗](2026-07-28-tui-dim-tool-result-output.md)把工具卡片划分为保留自身颜色的框架和以暗色渲染的输出。在真实 transcript（文本记录）中，这种划分呈现的是颜色散乱而非结构层次，因为各框架行并非同一种颜色：generic 卡片的 presenter 标题（`Read src/foo.ts (95 - 149)`、`Update todo list`）保留终端的默认前景色，终端卡片的 `$` 命令为青色，cwd 为暗色，下方输出也是暗色。连续四行中出现三种色调，而最亮的默认前景色在浅色方案中呈现为纯黑色，却落在信息量最少的一行。
+
+未知工具的 XML 树问题更为明显，也正是它暴露了这个缺陷。`renderUnknownXml` 通过 `label` 回调设置元素名的样式，却完全不为文本内容设置样式，而卡片折叠后的 `… +N lines (Ctrl+O to expand)` 标记为暗色。因此，卡片正文混合了无样式的黑色内容行和暗色的折叠提示，使提示看起来与它所概括的文本不属于同一个元素。此前说明要解决的正文无法区分问题又在正文内部重现了一层。
+
+根本原因在于，这两种角色在两套受支持的方案之一中无法区分。在深色方案中，`dim` 是 SGR 2；在浅色方案中则是 ANSI 90，与 `muted` 始终使用的样式完全相同。因此，混合 `dim`、`muted` 和无样式行的正文在浅色终端上呈现两种色调，在深色终端上呈现三种色调；这种差异体现为不一致，而非含义。
+
+## Decision
+
+工具卡片的正文从头到尾统一使用一种暗色调。卡片中唯一带颜色的行是 `Tool / <name>` 表头，它承载调用状态：挂起时为 warning、成功时为 success、错误时为 error。presenter 标题、终端卡片的 `$` 命令行及 cwd、工具自身的输出、XML 树的文本内容和折叠标记均通过 `dim` 角色渲染。
+
+有两项例外会保留颜色，因为颜色在这些位置承载含义，而非强调：diff 卡片的 `+`/`-` 行和各文件路径表头，其红色与绿色本身就是 diff；终端卡片的 `[signal …]` 标记则报告异常终止。XML 树的元素名保持 `muted`，与正文文本相差一档，因为它们是供读者定位的结构，而非内容。
+
+`renderUnknownXml` 接收一个 `body` 样式函数，与既有的 `label` 样式函数并列，并将其应用于每一个文本行，包括 `textBlock` 的各行以及单行 `<tag>: value` 形式中的值。它唯一的调用方——未知工具卡片——传入卡片的正文色调（`dim`），使树的内容与周围各行保持一致，而不会回退到默认前景色。
+
+`ContextCardComponent` 将[注入上下文渲染为散文](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)而不对其解析，其正文也从 `muted` 改为 `dim`，原因与工具卡片相同：该卡片的表头与折叠标记本已是 `dim`，因此 `muted` 正文是卡片中唯一不匹配的行组。
+
+`ToolCardComponent.dimPastPrelude` 更名为 `dimBody`：它仍将 prelude 与结果作为同一个 Markdown 文档渲染，使文档自身的块间距得以保留，但现在会将每一行变暗，而非只处理 prelude 行数之后的内容。由于不再需要定位边界，旧的行数划分所需的第二次 Markdown 渲染也随之删除。仅含空白字符的行仍不添加样式包装，使 Markdown 的填充不会进入样式范围；终端分支的空白行仍为空字符串，因此其 `filter(Boolean)` 仍会将其丢弃。
+
+## Alternatives considered
+
+**保留框架/输出划分，只修复 XML 树。** 已否决：这只处理了报告的症状，未解决根因。该划分的前提是框架共用一种颜色，但实际从来不是如此：presenter 标题、青色的 `$` 命令和暗色的 cwd 使用三种色调，因此以后每增加一种框架行都会再次引出同一个问题。
+
+**为 presenter 标题设置专属角色（粗体或强调色）。** 已否决：这会在用户认为形成噪声的行上增加第四种色调。表头已经给出工具名称，因此标题是细节行而非标题行；强调它会与正上方的状态色争夺注意力。
+
+**保留青色的 `$` 命令，将其作为扫读定位点。** 用户考虑过此方案，但明确选择统一正文并否决了它。`$ ` 前缀和表头中的 `/ <description>` 段已经可以定位命令，因此该颜色与另外两个提示重复。
+
+**使 `dim` 和 `muted` 在浅色方案中呈现明显差异，让既有的三色正文体现结构。** 已否决：调色板特意基于 16 色 ANSI 色集构建，以便终端重新映射颜色；在两种方案中都能可靠弱于默认前景色的只有目前已经重合的两种色调。制造第三种色调需要使用固定色值，而调色板契约禁止这样做。
+
+**也将 diff 的 `+`/`-` 行变暗，使 transcript 完全单色。** 已否决：diff 的颜色承载其语义，而仅依靠开头的 `+`/`-` 字符是更弱的信号，读者必须解析字符才能理解，无法直接从颜色识别。
+
+## Consequences
+
+卡片现在呈现为一行带颜色的表头，下接一个弱化的正文块；包含大量调用的 transcript 扫读起来则是一列状态表头。用户可见的变化是 presenter 标题、`$` 命令和 XML 树内容不再使用各自独立的色调，此前报告的颜色散乱也随之消失。
+
+`dimBody` 每帧只渲染一次 generic 卡片的 Markdown，而非两次，因此此前说明中记录的代价已经消除。由于深色方案中的 `dim` 是 SGR 属性而非颜色，结果中的 Markdown 角色颜色（标题、内联代码）仍能在其下显示，所以暗色正文在深色终端上仍保留内部结构；在浅色方案中，`dim` 解析为 ANSI 90，这些角色则以灰色为基础呈现。
+
+`renderUnknownXml` 的签名新增了一个必需参数，因此其调用方及其单元测试均传入正文样式函数；这里不提供默认值，因为调用方忘记传入该参数，正是本文要修复的缺陷。此处理仍仅限 TUI：没有更改任何 presenter、调色板角色或 `presentation.ts` 类型，ACP 和 JSON-RPC 桥接层继续使用各自的工具调用呈现方式。
+
+## Testing
+
+`packages/ui/tui/tests/xml-tool-output.spec.ts` 通过每个文本行上的 `[body]…[/body]` 专用标记断言正文色调，因此遗漏样式函数的回归会导致测试失败，而不会静默渲染为无样式文本。它还固定了内部空行仍为空字符串，因为为其设置样式会产生一个只含转义序列的行，读起来像一个多余的缩进空行。
+
+`packages/ui/tui/tests/snapshots/` 和 `examples/tui-agent/tests/snapshots/` 下的无密钥终端快照已通过提交到仓库的回放脚本刷新。差异仅涉及样式范围：将 `fg=cyan` 和 `fg=bright-black` 行改为 `dim`，并为之前没有样式的行添加 `dim`；覆盖 bash 输出、read 输出、`run_code`、`workflow`、`subagent`、`todo_write`、`cordis_*` 以及注入上下文散文，而 diff 卡片的 `+`/`-` 范围保持不变。
diff --git a/apps/cli/src/tui.ts b/apps/cli/src/tui.ts
index a87812ce00..0d402c1c51 100644
--- a/apps/cli/src/tui.ts
+++ b/apps/cli/src/tui.ts
@@ -24,7 +24,10 @@ import {
 } from '@deepseek-ai/dsh-app-boot'
 import { resolveDshHome } from '@deepseek-ai/dsh-paths'
 import type { Context } from 'cordis'
-import type { TuiResumeHost } from '@deepseek-ai/dsh-tui'
+import {
+  TUI_GOODBYE_MESSAGE_KEY,
+  type TuiResumeHost,
+} from '@deepseek-ai/dsh-tui'
 
 const NAME = 'dsh'
 
@@ -70,8 +73,10 @@ export async function runTui(config: string | undefined, resumeSessionId: string
   const entry = process.argv[1]
   const execve = process.execve?.bind(process)
   const app: { current?: Context } = {}
+  const resumeCommand = (sessionId: string): string =>
+    `${NAME} --resume=${sessionId}${config === undefined ? '' : ` --config ${config}`}`
   const resumeHost: TuiResumeHost | undefined = entry === undefined || execve === undefined ? undefined : {
-    async handoff(sessionId): Promise<never> {
+    async handoff(sessionId, cwd): Promise<never> {
       const current = app.current
       if (current === undefined) throw new Error(`${NAME}: app boot has not completed`)
       // Rebuild argv from the parsed config plus the selected id: TUI mode's
@@ -83,6 +88,11 @@ export async function runTui(config: string | undefined, resumeSessionId: string
         `--resume=${sessionId}`,
         ...config !== undefined ? ['--config', config] : [],
       ]
+      try {
+        process.chdir(cwd)
+      } catch (error) {
+        throw new Error(`${NAME}: cannot resume in "${cwd}": ${String(error)}`)
+      }
       try {
         await current.fiber.dispose()
         execve(process.execPath, nextArgv, process.env)
@@ -101,6 +111,9 @@ export async function runTui(config: string | undefined, resumeSessionId: string
       // Inject the resume id (or undefined) so the shipped config's `!!js`
       // reads it as a bare identifier; then offer the in-place handoff host.
       hostCtx.provide(RESUME_SESSION_ID_KEY, resumeSessionId)
+      if (resumeSessionId !== undefined) {
+        hostCtx.provide(TUI_GOODBYE_MESSAGE_KEY, `To resume this session: ${resumeCommand(resumeSessionId)}`)
+      }
       if (resumeHost !== undefined) hostCtx.provide('tuiResumeHost', resumeHost)
     },
   )

From 7a3295e0bf28190b4077491690a43f7d504d3fab Mon Sep 17 00:00:00 2001
From: Turtle <turtle1999@deepseek.com>
Date: Wed, 29 Jul 2026 10:30:27 +0800
Subject: [PATCH 16/16] docs: consolidate TUI Agent Notes

---
 ...8-consolidated-tui-presentation.i18n.yaml} |  6 +-
 ...026-07-28-consolidated-tui-presentation.md | 63 +++++++++++++++++++
 ...-07-28-consolidated-tui-presentation.zh.md | 63 +++++++++++++++++++
 .../2026-07-28-tui-palette-single-source.md   | 57 -----------------
 ...2026-07-28-tui-palette-single-source.zh.md | 57 -----------------
 ...xt-card-content-independent-fold.i18n.yaml |  6 --
 ...8-context-card-content-independent-fold.md | 37 -----------
 ...ontext-card-content-independent-fold.zh.md | 37 -----------
 ...ntext-cards-render-prose-not-xml.i18n.yaml |  6 --
 ...7-28-context-cards-render-prose-not-xml.md | 49 ---------------
 ...8-context-cards-render-prose-not-xml.zh.md | 49 ---------------
 ...terminal-card-double-exit-status.i18n.yaml |  6 --
 ...-07-28-terminal-card-double-exit-status.md | 46 --------------
 ...-28-terminal-card-double-exit-status.zh.md | 46 --------------
 ...026-07-28-cross-workspace-resume.i18n.yaml |  6 --
 .../2026-07-28-cross-workspace-resume.md      | 52 ---------------
 .../2026-07-28-cross-workspace-resume.zh.md   | 52 ---------------
 ...07-28-tui-dim-tool-result-output.i18n.yaml |  6 --
 .../2026-07-28-tui-dim-tool-result-output.md  | 39 ------------
 ...026-07-28-tui-dim-tool-result-output.zh.md | 39 ------------
 ...07-28-tui-foldable-context-cards.i18n.yaml |  6 --
 .../2026-07-28-tui-foldable-context-cards.md  | 35 -----------
 ...026-07-28-tui-foldable-context-cards.zh.md | 35 -----------
 ...-07-28-tui-uniform-dim-card-body.i18n.yaml |  6 --
 .../2026-07-28-tui-uniform-dim-card-body.md   | 51 ---------------
 ...2026-07-28-tui-uniform-dim-card-body.zh.md | 51 ---------------
 26 files changed, 129 insertions(+), 777 deletions(-)
 rename .agents/notes/implemented/architecture/{2026-07-28-tui-palette-single-source.i18n.yaml => 2026-07-28-consolidated-tui-presentation.i18n.yaml} (56%)
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.md
 create mode 100644 .agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.zh.md
 delete mode 100644 .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
 delete mode 100644 .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
 delete mode 100644 .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
 delete mode 100644 .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md

diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.i18n.yaml
similarity index 56%
rename from .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml
rename to .agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.i18n.yaml
index bdd45027ed..629476cf8e 100644
--- a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
-2026-07-28-tui-palette-single-source.md: 7027e650bfb94dca7608342b10c994b255f48d2d
-2026-07-28-tui-palette-single-source.zh.md: a956a916c01feceedc7b6b6715bee6ceb8b80e7f
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.md
+2026-07-28-consolidated-tui-presentation.md: f87d543a698d6e77abf9120c6579100df4b60b64
+2026-07-28-consolidated-tui-presentation.zh.md: 005e408f0e75207027315546942f9eab57d595d1
diff --git a/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.md b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.md
new file mode 100644
index 0000000000..f87d543a69
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.md
@@ -0,0 +1,63 @@
+# Agent Note: Consolidated TUI presentation and navigation
+
+Status: implemented
+
+English | [中文](2026-07-28-consolidated-tui-presentation.zh.md)
+
+## Problem
+
+The terminal UI accumulated independent presentation rules that interacted poorly: palette roles aliased one another or inverted emphasis on light terminals; tool-card framing, output, and exit markers repeated or competed; injected context was parsed as XML and could not fold reliably; and `/resume` excluded sessions outside the current workspace even when the launcher could reach them. Each symptom appeared local, but the durable decision is one terminal-reading model: a small inspectable palette, status-led cards with recessed bodies, content-independent transcript folding, and workspace-aware navigation.
+
+## Decision
+
+### Palette
+
+`paletteSpec(scheme)` is the single table of SGR codes, close codes, and purposes. `createPalette` derives every wrapper from it and `/palette` prints the same table in the running terminal. Components do not emit their own SGR sequences except for the fixed startup brand gradient. Every close resets every SGR group its open sets.
+
+Duplicate roles are merged: `muted` into `dim`, `added` into `success`, `removed` into `error`, and the unused second accent is removed. `dim` uses `2;39` and closes with `22;39` on both schemes so recessed text stays relative to the terminal foreground rather than becoming a fixed heavy gray on light backgrounds. Colors and attributes are branded separately in TypeScript, allowing attribute/color composition while rejecting nested colors whose reset would discard the outer color.
+
+### Tool cards
+
+A tool card has one colored `Tool / <name>` status header over one dim body. Presenter titles, terminal commands and cwd rows, output, XML text, and fold markers use that body tone. Diff colors remain because red and green carry meaning, and signal markers remain errors.
+
+`renderUnknownXml` receives an explicit body styler for unknown tool results. Terminal presenters parse and remove the model-facing final exit or signal marker before returning `TerminalResultView.output`; the TUI renders the structured status once as its own pill. Truncation, timeout, and sandbox lines remain in the body because the pill does not represent them.
+
+### Injected context and folding
+
+Injected context renders as prose in `ContextCardComponent`, not through the XML tree renderer. Exact matched outer `<system-reminder>` lines are stripped, but mismatched, unpaired, or inline tag-like text remains verbatim. Model-facing content is unchanged. Folding uses the shared `preview` helper after body assembly, so it depends only on row count, never parser success or payload characters.
+
+`Ctrl+O` cycles collapsed, expanded, and hidden. Tool cards disappear in the hidden state together with their card-owned leading gap. Context cards participate in collapsed and expanded states but fall back to collapsed while tools are hidden, because injected instructions are not disposable tool traffic.
+
+### Cross-workspace resume
+
+The resume picker summarizes all records and owns a current-workspace/all-workspaces scope toggled with Tab. It defaults to the current workspace, adds workspace labels only in the broader scope, and refuses records without a cwd because there is no directory to enter.
+
+`TuiResumeHost.handoff` receives the selected `SessionId` and the cwd re-read during preflight. The CLI changes directory before disposing the current app, so an unreachable directory fails while the terminal can still recover; `execve` then inherits the selected workspace. The launcher also supplies the exit message rather than asking the TUI to reconstruct launcher syntax.
+
+## Alternatives considered
+
+**Keep separate notes and local fixes for each visual symptom.** Rejected: the decisions share one reading hierarchy and repeatedly superseded each other. One owner makes the final palette, card, context, and navigation rules clear without requiring readers to reconstruct chronology.
+
+**Keep aliases and enforce presentation by convention.** Rejected: aliases imply distinctions that do not exist, and nested color resets or incomplete SGR closes fail silently. A single table plus types makes the contract inspectable and mechanically checked.
+
+**Retain framing/output color splits inside tool cards.** Rejected: real cards mixed default foreground, cyan commands, dim cwd, unstyled XML, and dim output. The status header already provides the scan anchor; one recessed body removes noise. Diff colors are the narrow semantic exception.
+
+**Parse or repair injected context as XML.** Rejected: reminder frames are prompting conventions around arbitrary prose containing raw ampersands, comparisons, and placeholder angle brackets. Repairing or escaping it would either guess structure or alter model-visible text.
+
+**Hide context cards with tool cards.** Rejected: context carries injected instructions, not recoverable execution detail. The hidden phase therefore removes only tool traffic.
+
+**Keep resume restricted to one workspace or infer cwd after boot.** Rejected: the restriction forces manual relaunch, while restored header cwd does not control filesystem and shell resolution. The target directory must cross the host seam before process replacement.
+
+**Drop the TUI exit pill or remove model-facing exit markers.** Rejected: the pill is the scannable UI status, while the text marker is the model's status signal. The presenter consumes the marker when constructing the structured view so both audiences receive one representation.
+
+## Consequences
+
+The transcript reads as colored status headers over recessed detail, context presentation is stable for arbitrary prose, and one shortcut controls transcript density. The public `TuiTheme.muted` role is removed; extensions use `dim`. The palette and `renderUnknownXml` contracts are stricter, adding small compile-time friction in exchange for preventing silent style loss.
+
+Cross-workspace resume can move every path-resolving tool to another directory. A missing or inaccessible cwd prevents handoff. The broader picker also makes concurrent access to a shared session store easier to reach; cross-process session locking remains separate work.
+
+The terminal presenter still treats a final output line exactly matching its exit-marker grammar as structured status, so a command that intentionally prints such a line can lose it from the card body. This residual is documented by `dsh-tool-bash`.
+
+## Testing
+
+TUI unit and keyless terminal snapshots cover palette enumeration, light/dark roles, legal and illegal style composition, uniformly dim card bodies, semantic diff colors, marker-free terminal output with one exit pill, prose-preserving context frames, content-independent folding, the three-state Ctrl+O cycle, model filtering, and both resume scopes. CLI handoff tests cover passing the re-read cwd and rejecting directory-entry failure before teardown. Tool-bash tests pin result-marker emission, parse, and stripping as one round trip.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.zh.md b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.zh.md
new file mode 100644
index 0000000000..005e408f0e
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-07-28-consolidated-tui-presentation.zh.md
@@ -0,0 +1,63 @@
+# Agent Note: 统一的 TUI 呈现与导航
+
+Status: implemented
+
+[English](2026-07-28-consolidated-tui-presentation.md) | 中文
+
+## Problem
+
+终端 UI 逐步积累了多套彼此干扰的呈现规则：调色板角色互为别名，或在浅色终端中颠倒强调层级；工具卡片的框架、输出和退出标记重复或争夺注意力；注入上下文被当作 XML 解析，无法可靠折叠；`/resume` 即使能通过启动器访问其他工作区，也会排除不属于当前工作区的会话。每个症状看似局部，但持久决策只有一个终端阅读模型：精简且可检查的调色板、以状态为首且正文内收的卡片、与内容无关的记录折叠，以及感知工作区的导航。
+
+## Decision
+
+### 调色板
+
+`paletteSpec(scheme)` 是 SGR 开始码、结束码和用途的唯一表。`createPalette` 从该表派生所有包装器，`/palette` 在运行中的终端打印同一张表。除固定的启动品牌渐变外，组件不自行发出 SGR 序列。每个结束码都重置对应开始码设置的所有 SGR 组。
+
+重复角色被合并：`muted` 并入 `dim`，`added` 并入 `success`，`removed` 并入 `error`，未使用的第二强调色被移除。`dim` 在两种配色方案中都使用 `2;39`，并以 `22;39` 结束，使内收文本相对于终端前景色变暗，而不会在浅色背景上变成固定的深灰色。TypeScript 分别标记颜色和属性，允许属性与颜色组合，同时拒绝会因重置而丢失外层颜色的嵌套颜色。
+
+### 工具卡片
+
+工具卡片由一行带颜色的 `Tool / <name>` 状态标题和一块统一的 dim 正文组成。呈现器标题、终端命令及 cwd 行、输出、XML 文本和折叠标记都使用正文色调。差异颜色继续保留，因为红绿承载语义；信号标记也继续作为错误显示。
+
+`renderUnknownXml` 对未知工具结果显式接收正文样式器。终端呈现器在返回 `TerminalResultView.output` 前解析并移除面向模型的末尾退出或信号标记；TUI 只把结构化状态呈现一次。截断、超时和沙箱信息继续留在正文中，因为状态标记不表达这些事实。
+
+### 注入上下文与折叠
+
+注入上下文由 `ContextCardComponent` 按普通文本呈现，不经过 XML 树渲染器。仅移除精确配对的外层 `<system-reminder>` 行；不匹配、单边或正文内类似标签的文本都原样保留。面向模型的内容不变。折叠在正文组装完成后使用共享 `preview` 辅助函数，因此只取决于行数，不依赖解析是否成功或载荷包含哪些字符。
+
+`Ctrl+O` 在折叠、展开和隐藏之间循环。隐藏状态会连同卡片自有的前导间距一起移除工具卡片。上下文卡片参与折叠和展开状态，但工具隐藏时回到折叠状态，因为注入指令不是可丢弃的工具流量。
+
+### 跨工作区恢复
+
+恢复选择器汇总所有记录，并维护可用 Tab 切换的当前工作区/所有工作区范围。默认范围是当前工作区；只有更宽范围才显示工作区标签。没有 cwd 的记录会被拒绝，因为没有可进入的目录。
+
+`TuiResumeHost.handoff` 接收选中的 `SessionId` 和预检时重新读取的 cwd。CLI 在释放当前应用前切换目录，因此无法访问的目录会在终端仍可恢复时失败；随后 `execve` 继承所选工作区。退出提示也由启动器提供，而不是让 TUI 反推启动器命令语法。
+
+## Alternatives considered
+
+**为每个视觉症状保留独立 Agent Note 和局部修复。** 否决：这些决策共享同一阅读层级，而且彼此多次取代。由一份记录统一拥有最终的调色板、卡片、上下文和导航规则，读者无需重建变更顺序。
+
+**保留别名，并依靠约定执行呈现规则。** 否决：别名暗示并不存在的差异；嵌套颜色重置或不完整的 SGR 结束会静默失败。单一表格加类型约束使契约可检查且可机械验证。
+
+**保留工具卡片内部的框架/输出颜色分层。** 否决：真实卡片会混用默认前景、青色命令、dim cwd、无样式 XML 和 dim 输出。状态标题已经提供扫描锚点；统一内收正文能消除噪声。差异颜色是狭窄的语义例外。
+
+**把注入上下文继续解析或修复成 XML。** 否决：提醒框架只是包裹任意普通文本的提示约定，其中会包含原始 `&`、比较表达式和尖括号占位符。修复或转义要么猜测结构，要么改变模型可见文本。
+
+**随工具卡片一起隐藏上下文卡片。** 否决：上下文承载注入指令，不是可恢复的执行细节。因此隐藏阶段只移除工具流量。
+
+**把恢复限制在一个工作区，或在启动后推断 cwd。** 否决：前者迫使用户手动重启；后者恢复的会话头 cwd 并不控制文件系统和 shell 的路径解析。目标目录必须在进程替换前跨过主机接口。
+
+**移除 TUI 退出状态标记，或移除面向模型的退出标记。** 否决：前者是便于扫描的 UI 状态，后者是模型的状态信号。呈现器在构造结构化视图时消费文本标记，使两类受众各看到一种表示。
+
+## Consequences
+
+记录现在表现为带颜色的状态标题和内收细节；上下文对任意普通文本都稳定呈现；一个快捷键控制记录密度。公共 `TuiTheme.muted` 角色被移除，扩展改用 `dim`。调色板和 `renderUnknownXml` 契约更严格，以少量编译期摩擦换取对静默样式丢失的防护。
+
+跨工作区恢复会把所有依赖路径解析的工具移动到另一个目录。cwd 缺失或不可访问时不能交接。更宽的选择范围也使共享会话存储的并发访问更容易触达；跨进程会话锁仍是独立后续工作。
+
+终端呈现器仍会把与退出标记语法完全一致的最后一行输出视为结构化状态，因此命令有意打印这种行时，卡片正文可能丢失该行。`dsh-tool-bash` 已记录这一残余限制。
+
+## Testing
+
+TUI 单元测试和无密钥终端快照覆盖调色板枚举、浅色/深色角色、合法与非法样式组合、统一 dim 卡片正文、保留语义的差异颜色、仅有一个退出状态且正文无标记、普通文本上下文框架、与内容无关的折叠、Ctrl+O 三态循环、模型过滤和两种恢复范围。CLI 交接测试覆盖传递重新读取的 cwd，并在释放前拒绝目录切换失败。tool-bash 测试把结果标记的生成、解析和移除固定为同一轮往返契约。
diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
deleted file mode 100644
index 7027e650bf..0000000000
--- a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Agent Note: One palette table, one role per meaning, printable by `/palette`
-
-Status: implemented
-
-English | [中文](2026-07-28-tui-palette-single-source.zh.md)
-
-## Problem
-
-The palette had fifteen roles built from escape codes written inline in `createPalette`, and three pairs of them resolved to the same SGR parameters: `added`/`success` were both `32`, `removed`/`error` both `31`, and on a light scheme `muted`/`dim` were both `90`. A reader picking `added` or `muted` believed they had chosen a distinct tone; they had chosen an alias. Nothing enumerated the roles, so no reader could compare them, and the codes existed only as literals at their use site.
-
-That hid a real defect for as long as it took a user to notice it. `dim` deliberately substituted ANSI 90 on light schemes, on the recorded theory that "SGR 2 lightens text on a light background." But lightening is precisely what a recessed tone must do, and ANSI 90 is a fixed hue: on a light theme whose default foreground is a soft gray, bright black is *heavier* than ordinary text. Every surface the TUI called dim — tool-card bodies, the timing footer, injected context, dialog chrome — therefore rendered as the most prominent text on screen, inverting the one relationship the role exists to express. The role named `dim` was the least dim thing in the transcript.
-
-Nothing prevented the inversion from being introduced, and nothing revealed it afterwards. There was no listing to compare tones in, and terminal captures report escape codes rather than rendered luminance, so reading `\x1b[90m` and concluding "gray, therefore recessed" is a mistake a reader repeats indefinitely without a rendered sample to check against.
-
-A second hazard was latent in the same design. SGR has no color stack: a nested span's close emits `39` (default foreground), not the enclosing color, so wrapping colored text in a second color silently drops the outer color for the remainder of the line. Only the type `(text: string) => string` guarded that, which is to say nothing guarded it.
-
-## Decision
-
-`paletteSpec(scheme)` is the single table of every SGR code the TUI may emit. Each entry carries `open`, `close`, and a `purpose` string. `createPalette` derives its wrappers by iterating `COLOR_ROLES` and `ATTRIBUTE_ROLES` over that table, and the `/palette` command prints it, so a role cannot exist in the palette without appearing in the listing or the reverse. No component writes an escape sequence of its own. The startup banner's brand gradient stays the one deliberate exception, since fixed brand color is its point.
-
-`close` MUST reset every SGR group `open` sets. This is stated on `ansi` because the roles that violated it did so silently: `dim` opened `2;39` while closing only `22`, leaking a foreground reset past its own span.
-
-Roles that resolved to the same escape are merged rather than kept as aliases. `muted` folds into `dim`, `added` into `success`, and `removed` into `error`, leaving seven colors and five attributes. `accent` becomes ANSI 95, the tone this terminal actually reads as emphasis, and the single-use `accent2` is deleted rather than kept as a second accent.
-
-`dim` is `2;39` closing `22;39` on both schemes. SGR 2 fades relative to whatever foreground the terminal is using, which is the only way to land *below* `text` on a light and a dark theme with one code; `39` pins the starting foreground to the default so the tone does not inherit a caller's color. Only `code` still varies by scheme, because ANSI 36 is genuinely hard to read on a light background.
-
-Colors and attributes are separately typed. A `ColorRole` takes `Colorable` and returns `Colored`; an `AttributeRole` is generic and preserves its argument's type. So `bold(accent(x))` and `accent(bold(x))` both compile, `accent(error(x))` does not, and — because the brand survives an attribute layer — neither does `dim(bold(success(x)))`.
-
-## Alternatives considered
-
-**Keep ANSI 90 for `dim` and adjust the surfaces that looked wrong.** Rejected: the surfaces were right and the tone was wrong. Every consumer of `dim` wanted the same thing, so the fix belongs in the one role, not in each caller.
-
-**Plain SGR 2 without the `39`.** Considered; the user compared both rendered against their own background. Both read as genuinely dim, and `2` alone is the smaller change, but `2;39` guarantees the span starts from the default foreground rather than inheriting a caller's color, which matters wherever `dim` wraps content that may already be styled.
-
-**Keep `muted` and `dim` as separate names against future differentiation.** Rejected: they resolved to one escape on one of the two supported schemes, and a name that sometimes aliases another is worse than one name. Reintroducing a second recessed tone is a new decision, to be made when a consumer needs it.
-
-**Enforce the no-nested-color rule by convention and review.** Rejected: the rule is mechanically checkable and the failure is invisible — a dropped outer color looks like a rendering quirk, not a bug. The brands cost two type aliases and caught four deliberate violations in a compile check.
-
-**A runtime guard that strips or rejects nested colors.** Rejected: it moves a statically decidable error to run time and would have to allocate on every styled span, in the render hot path.
-
-**Print the palette to stdout from a script instead of a TUI command.** Rejected: the point is to see the tones the *running* TUI produces in the *user's* terminal, under the scheme it actually resolved. A script cannot report the live scheme, and this specific bug was invisible outside the real terminal.
-
-## Consequences
-
-The listing is now the fastest way to find a palette defect: `/palette` shows every role painted by its own code beside the SGR pair it reports, so a tone that misbehaves is visible next to its neighbours instead of inferred from escape numbers. It also reports the resolved scheme, which surfaced that scheme detection is not stable across launches — an unrelated bug this change makes observable but does not fix.
-
-Four role names disappear from the palette, and `muted` leaves the public extension `TuiTheme`; an extension that wants a recessed tone uses `dim`. Merging the diff pair means `success` and `error` each carry two meanings, which is honest about there being one green and one red rather than implying a diff-specific palette.
-
-The brands introduce a small friction: an array literal seeded with a colored string infers `Colored[]`, so two call sites now annotate `string[]` explicitly. That is the cost of the guarantee, and it appears at declaration sites rather than in styling expressions.
-
-`accent` moving to 95 repaints twenty-four call sites, including Markdown headings and links, dialog borders, and the prompt. That is a visible change to surfaces beyond the reported defect, made because a single emphasis color is the point of the reduction.
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` asserts `/palette` prints every name and `purpose` in `paletteSpec` and that each row carries the spec's own open code, so a role added to the table without a listing entry, or a listing that reports one code while rendering another, fails. Verified by construction: truncating the attribute loop makes the test fail rather than pass silently.
-
-The scheme-detection test previously pinned `dim` changing between schemes, which is no longer true; it now pins scheme-independent `dim` alongside the `code` role that does vary. The blank-row and running-glyph tests carry the new SGR pairs. The no-nested-color rule is verified by compiling deliberate violations against the project's own tsconfig, where the four color-over-color expressions are rejected and the five legal attribute compositions are not.
diff --git a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md b/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
deleted file mode 100644
index a956a916c0..0000000000
--- a/.agents/notes/implemented/architecture/2026-07-28-tui-palette-single-source.zh.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Agent Note: 单一调色板表、每种含义一个角色，并可通过 `/palette` 打印
-
-Status: implemented
-
-[English](2026-07-28-tui-palette-single-source.md) | 中文
-
-## Problem
-
-调色板原有十五个角色，其转义码直接写在 `createPalette` 中，其中三对角色解析为相同的 SGR 参数：`added`/`success` 都是 `32`，`removed`/`error` 都是 `31`，而在浅色配色方案中，`muted`/`dim` 都是 `90`。读者选择 `added` 或 `muted` 时，会以为自己选了不同的色调，实际上选到的只是别名。没有任何地方枚举这些角色，因此读者无法比较它们，而这些转义码也仅以字面量存在于使用处。
-
-这个设计一直掩盖着一个真实缺陷，直到用户亲眼发现。`dim` 在浅色配色方案中刻意改用 ANSI 90，依据是记录中「SGR 2（dim）会让浅色背景上的文本变淡」的理由。但变淡恰恰是弱化色调必须做的事，而 ANSI 90 是固定色相：如果浅色主题的默认前景色是柔和的灰色，亮黑色就会比普通文本*更重*。因此，TUI 中所有称作 dim 的界面——工具卡片正文、计时页脚、注入的上下文、对话框边框——都会渲染为屏幕上最醒目的文本，颠倒了该角色本应表达的唯一关系。名为 `dim` 的角色反而成了 transcript（文本记录）中最不弱化的内容。
-
-这个颠倒既没有防范机制，发生后也没有显现机制。没有可供比较色调的清单，而终端捕获记录的是转义码而非渲染亮度，因此看到 `\x1b[90m` 就断定「这是灰色，所以会弱化」，是读者在没有渲染样例可供核对时会不断重复的错误。
-
-同一设计中还潜藏着第二个风险。SGR 没有颜色栈：嵌套区段的关闭码会发出 `39`（默认前景色），而不是外层颜色，因此用第二种颜色包裹已经着色的文本，会悄然丢弃该行剩余部分的外层颜色。唯一的防护只是类型 `(text: string) => string`，也就是说实际上毫无防护。
-
-## Decision
-
-`paletteSpec(scheme)` 是 TUI 可以发出的所有 SGR 码的唯一表。每个条目都包含 `open`、`close` 和一个 `purpose` 字符串。`createPalette` 遍历该表的 `COLOR_ROLES` 与 `ATTRIBUTE_ROLES` 来派生包装函数，`/palette` 命令则打印该表，因此一个角色不可能只存在于调色板中却不出现在清单里，反之亦然。任何组件都不会自行写入转义序列。启动横幅的品牌渐变色是唯一的有意例外，因为固定品牌色本来就是它的目的。
-
-`close` 必须重置 `open` 设置的每一个 SGR 组。该要求在 `ansi` 上明确说明，因为此前违反要求的角色没有显露问题：`dim` 以 `2;39` 开启，却只以 `22` 关闭，导致前景色重置越过其自身区段而泄漏。
-
-解析为同一转义码的角色会合并，而不是作为别名保留。`muted` 并入 `dim`，`added` 并入 `success`，`removed` 并入 `error`，最终留下七种颜色和五种属性。`accent` 改为 ANSI 95，这是该终端中实际呈现为强调色的色调；仅使用一次的 `accent2` 则直接删除，不再作为第二种强调色保留。
-
-在两种配色方案中，`dim` 都以 `2;39` 开启、以 `22;39` 关闭。SGR 2 会相对于终端当前使用的前景色减淡，这是仅用一个代码就在浅色和深色主题中落到 `text` *之下*的唯一方式；`39` 将起始前景色固定为默认值，使该色调不会继承调用方的颜色。只有 `code` 仍然随配色方案而变化，因为 ANSI 36 在浅色背景上确实难以辨认。
-
-颜色与属性分别采用不同的类型。`ColorRole` 接受 `Colorable` 并返回 `Colored`；`AttributeRole` 是泛型，会保留实参的类型。因此 `bold(accent(x))` 和 `accent(bold(x))` 都能编译，`accent(error(x))` 不能；而且——由于品牌标记可以穿过一层属性——`dim(bold(success(x)))` 同样不能编译。
-
-## Alternatives considered
-
-**保留 ANSI 90 作为 `dim`，并调整显示异常的界面。**否决：界面没有问题，错的是色调。`dim` 的所有消费方都需要同一种效果，因此修复应落在这个角色本身，而不是每个调用方中。
-
-**不带 `39` 的纯 SGR 2。**考虑过；用户在自己的背景上比较了两者的渲染效果。两者看起来都确实弱化，单独使用 `2` 也是更小的改动，但 `2;39` 可以保证区段从默认前景色开始，而不是继承调用方的颜色；当 `dim` 包裹可能已有样式的内容时，这一点很重要。
-
-**保留 `muted` 与 `dim` 两个名称，以备日后加以区分。**否决：它们在两种受支持的配色方案之一中解析为同一个转义码，而一个有时成为其他名称别名的名称，还不如只保留一个名称。重新引入第二种弱化色调是一项新决策，应等到消费方确有需要时再作出。
-
-**通过约定和评审来执行禁止嵌套颜色的规则。**否决：这条规则可以机械检查，而且故障不可见——外层颜色丢失看起来会像渲染异常，而不是缺陷。品牌类型的代价只是两个类型别名，却在编译检查中捕获了四处刻意构造的违规。
-
-**在运行时剥离或拒绝嵌套颜色的防护。**否决：这会把一个可静态判定的错误推迟到运行时，并且必须在渲染热路径中为每个带样式的区段分配内存。
-
-**通过脚本将调色板打印到 stdout，而不是使用 TUI 命令。**否决：目的是在*运行中的* TUI 所实际解析出的配色方案下，查看它在*用户自己的*终端中产生的色调。脚本无法报告实时配色方案，而这个特定缺陷在真实终端之外不可见。
-
-## Consequences
-
-现在，清单是发现调色板缺陷最快的方式：`/palette` 会用每个角色自身的代码绘制该角色，并在旁边显示其报告的 SGR 码对，因此表现异常的色调会直接出现在邻近角色旁边，而不必根据转义码数字推断。它还会报告解析出的配色方案，由此揭示配色方案检测在多次启动之间并不稳定——这是本次变更令其可观察、但并未修复的无关缺陷。
-
-调色板中消失了四个角色名称，`muted` 也从公共扩展 `TuiTheme` 中移除；需要弱化色调的扩展应使用 `dim`。合并差异对意味着 `success` 和 `error` 各自承载两种含义，这如实反映了系统只有一种绿色和一种红色，而不会暗示另有差异专用调色板。
-
-品牌类型带来了一点不便：如果数组字面量以着色字符串开头，便会推断为 `Colored[]`，因此现在有两个调用点需要显式标注 `string[]`。这是该保证的代价，而且它出现在声明位置，而不是样式表达式中。
-
-`accent` 改为 95 后，二十四个调用点随之重新着色，包括 Markdown 标题和链接、对话框边框以及提示行。这是报告缺陷之外其他界面的可见变化；作出这一改动，是因为精简的目的正是只保留一种强调色。
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` 断言 `/palette` 会打印每个名称和 `purpose`（均来自 `paletteSpec`），并且每一行都包含规格自身的开启码，因此在表中添加角色却没有清单条目，或清单报告的代码与渲染使用的代码不同，都会导致测试失败。构造验证也已完成：截断属性循环会让测试失败，而不会静默通过。
-
-配色方案检测测试此前固定了 `dim` 会随配色方案变化的行为，但现在已不再如此；该测试现在同时固定与配色方案无关的 `dim`，以及确实会变化的 `code` 角色。空白行测试与运行状态字形测试包含新的 SGR 码对。禁止嵌套颜色的规则通过项目自身的 tsconfig 编译刻意构造的违规来验证，其中四个颜色叠加颜色的表达式会被拒绝，五个合法的属性组合则不会。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
deleted file mode 100644
index af1e8ea8d3..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
-2026-07-28-context-card-content-independent-fold.md: 7e5e6e9ed8df317b1f1ade8f6935a18903937d6f
-2026-07-28-context-card-content-independent-fold.zh.md: 48e329d4d64395e3bcfa9ecb6085474d70eddac0
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
deleted file mode 100644
index 7e5e6e9ed8..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.md
+++ /dev/null
@@ -1,37 +0,0 @@
-# Agent Note: Context-card folding is independent of whether the text parses as XML
-
-Status: implemented
-
-English | [中文](2026-07-28-context-card-content-independent-fold.zh.md)
-
-## Problem
-
-[Foldable injected-context cards](../feature/2026-07-28-tui-foldable-context-cards.md) folded only the tree-rendered body. `ContextCardComponent.render` passed `expanded` and `maxOutputLines` into `renderUnknownXml`, which returns `undefined` when the text is not one complete XML document; the `undefined` branch then rendered the whole message as a single muted blob that consulted neither field. Unparsed context was therefore permanently expanded and inert under `Ctrl+O`.
-
-The parser rejects far more real context than the fallback implied. `workspace-context` frames instructions in `<system-reminder>` and escapes only `</system-reminder>`, so any raw `&` or `<` inside the prose is an invalid entity reference or bogus tag that fails the whole document. A badge URL's `&logo=` does it, and so does any `a < b`. Observed on a live session log: two `workspace-instructions` cards rendered 254 and 85 identical rows collapsed and expanded, each with a literal `<system-reminder>` as the first body row, while a `dsh-tool-skill` card whose text happened to parse folded 113 rows to 46.
-
-The user-visible symptom read as two bugs — the frame line was back, and nothing folded — but both are this one branch.
-
-## Decision
-
-Folding is a property of the card, not of the text. `preview` is exported from `packages/ui/tui/src/components/xml-tool-output.ts` and applied to the assembled body in `ContextCardComponent.render`.
-
-`ToolCardComponent` had an inline copy of that head/tail/marker arithmetic; it now calls the same `preview`, so one function owns the fold rule for every transcript card. Where a tool card's tree body was already folded per child, re-applying the limit to the assembled rows is deliberate: the per-child budget bounds each child, not their sum, so many small children could still exceed the card's budget.
-
-This note's fix kept the parse and made the fold independent of it. The card [no longer parses context at all](2026-07-28-context-cards-render-prose-not-xml.md), which also removed the residual frame row this fix could not suppress: an unparsed body had no parsed root to drop, so its first row stayed the literal `<system-reminder>`.
-
-## Alternatives considered
-
-**Escape `&` and `<` in `workspace-context` so the document always parses.** Rejected as the fix for this defect: it makes the fold work by making the parse succeed, leaving folding contingent on content. Any other plugin injecting arbitrary text, or any escaping gap, reintroduces the same symptom. Worth doing on its own merits — it would also drop the frame row — but the card must fold regardless.
-
-**Pre-parse repair, or a lenient HTML-style parser.** Rejected: `renderUnknownXml` declines on purpose so partial or mixed text renders unchanged rather than through a guessed tree. Loosening it to satisfy a presentation budget trades a correct decline for a wrong tree, and affects unknown tool results too.
-
-**Truncate in the `undefined` branch alone.** Rejected: it fixes the symptom while leaving two fold implementations whose agreement is unverified. Exporting `preview` removes the tool card's duplicate at the same time.
-
-## Consequences
-
-Every context card folds to `maxToolOutputLines` and responds to `Ctrl+O`, whatever its text contains. Tool cards whose tree body has many children can now fold where they did not, since the card total is bounded rather than each child.
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` pins a context card whose text carries a raw `&` (a badge URL's `&logo=`, the observed real-world trigger): it is collapsed by default with the `Ctrl+O to expand` marker, hides a middle line, and reveals it on `Ctrl+O`. That test failed on this fix's parent commit, where the card emitted no marker.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
deleted file mode 100644
index 48e329d4d6..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-card-content-independent-fold.zh.md
+++ /dev/null
@@ -1,37 +0,0 @@
-# Agent Note: 上下文卡片的折叠与文本能否按 XML 解析无关
-
-Status: implemented
-
-[English](2026-07-28-context-card-content-independent-fold.md) | 中文
-
-## 问题
-
-[可折叠的注入上下文卡片](../feature/2026-07-28-tui-foldable-context-cards.md)此前只折叠按树形渲染的正文。`ContextCardComponent.render` 把 `expanded` 和 `maxOutputLines` 传给 `renderUnknownXml`，而当文本不是一个完整的 XML 文档时，该函数返回 `undefined`；`undefined` 分支随后把整条消息渲染成单块暗色文本，这两个字段一个都不看。于是未能解析的上下文永久处于展开状态，且对 `Ctrl+O` 毫无反应。
-
-解析器拒绝的真实上下文远多于该回退分支所暗示的范围。`workspace-context` 用 `<system-reminder>` 包裹指令，并且只转义 `</system-reminder>`，因此正文中任何裸的 `&` 或 `<` 都构成无效实体引用或非法标签，进而让整篇文档解析失败。徽章 URL 中的 `&logo=` 会触发这一情况，任何 `a < b` 也会。在一份真实会话日志中观察到：两张 `workspace-instructions` 卡片分别渲染出 254 行和 85 行，折叠态与展开态完全一致，且每张卡片正文首行都是字面量 `<system-reminder>`；而一张文本恰好能解析的 `dsh-tool-skill` 卡片则把 113 行折叠到了 46 行。
-
-用户可见的症状看起来像两个缺陷——外框行又回来了，而且什么都折不起来——但两者都出自这同一个分支。
-
-## 决策
-
-折叠是卡片的属性，而非文本的属性。`preview` 从 `packages/ui/tui/src/components/xml-tool-output.ts` 导出，并在 `ContextCardComponent.render` 中作用于组装完成的正文。
-
-`ToolCardComponent` 此前内联复制了那套头部／尾部／标记的行数计算；它现在调用同一个 `preview`，因此所有 transcript（文本记录）卡片的折叠规则由一个函数统一持有。对于工具卡片中已经逐子项折叠过的树形正文，再对组装完成的行施加一次限额是有意为之：逐子项的限额只约束单个子项，而非它们的总和，因此大量小子项仍可能超出卡片的限额。
-
-本记录的修复保留了解析，并让折叠不再依赖解析结果。卡片[已完全不再解析上下文](2026-07-28-context-cards-render-prose-not-xml.md)，这同时也消除了本次修复无法抑制的残留外框行：未解析的正文没有可去掉的已解析根元素，因此其首行仍是字面量 `<system-reminder>`。
-
-## 考虑过的替代方案
-
-**在 `workspace-context` 中转义 `&` 与 `<`，使文档总能解析。** 作为本缺陷的修复方案不予采纳：它是靠让解析成功来让折叠生效，从而使折叠仍取决于内容。任何注入任意文本的其他插件，或任何转义遗漏，都会重新引入同一症状。这件事本身值得做——它还会顺带去掉外框行——但卡片无论如何都必须能折叠。
-
-**先做预解析修复，或改用宽松的 HTML 式解析器。** 不予采纳：`renderUnknownXml` 是有意拒绝的，这样部分或混合文本才会原样渲染，而不是走一棵猜出来的树。为了满足呈现限额而放宽它，等于用一次正确的拒绝换来一棵错误的树，并且会连未知工具结果一起波及。
-
-**只在 `undefined` 分支里做截断。** 不予采纳：它修掉了症状，却留下两份彼此一致性未经验证的折叠实现。导出 `preview` 同时消除了工具卡片中的那份重复。
-
-## 后果
-
-每张上下文卡片都会折叠到 `maxToolOutputLines`，并响应 `Ctrl+O`，无论其文本包含什么。树形正文含大量子项的工具卡片现在可能在原先不折叠的情况下折叠，因为受约束的是卡片总行数而非每个子项。
-
-## 测试
-
-`packages/ui/tui/tests/tui.spec.ts` 固定了一张文本带有裸 `&` 的上下文卡片（徽章 URL 中的 `&logo=`，即观察到的真实触发条件）：它默认处于折叠态并带有 `Ctrl+O to expand` 标记，隐藏了中间某一行，按下 `Ctrl+O` 后将其显示出来。该测试在本次修复的父提交上曾失败，当时的卡片不会输出标记。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
deleted file mode 100644
index 417d09e167..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
-2026-07-28-context-cards-render-prose-not-xml.md: 0b87e6b5e20648dc40ce1cde7a6d4c23843f478f
-2026-07-28-context-cards-render-prose-not-xml.zh.md: 461466be148ffce6ebc5e7188f88014bf6bac69e
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
deleted file mode 100644
index 0b87e6b5e2..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# Agent Note: Context cards render injected context as prose, not as XML
-
-Status: implemented
-
-English | [中文](2026-07-28-context-cards-render-prose-not-xml.zh.md)
-
-## Problem
-
-`ContextCardComponent` rendered injected context through `renderUnknownXml`, the strict single-document XML tree renderer. That made two user-visible properties depend on whether the payload happened to be well-formed XML: the redundant frame row was dropped only via `xml.slice(1)` on a successful parse, and — before the [content-independent fold](2026-07-28-context-card-content-independent-fold.md) — so was folding.
-
-Injected context is not XML. Three facts establish it:
-
-- `<system-reminder>` is a prompting convention, not markup. No model is trained on the tag ([envelope rationale](../simplification/2026-07-20-unwrap-injected-content-envelopes.md)); it signals "injected, not the user speaking".
-- Real instruction bodies contain characters that are fatal to a strict parse but ordinary in prose. A raw `&` in a badge URL's `&logo=` is an invalid entity reference; measured on a live session, one `workspace-instructions` payload carried four.
-- The angle brackets inside those bodies are not elements. Every inner "tag" in this repository's own instructions is a placeholder in a path or command template — `packages/<group>/<pkg>/`, `-t <name>`, `Branded<B>`. Tree-rendering them as elements misrepresents the text.
-
-The fragility was never workspace-specific: `dsh-tool-skill` builds the same frame and parses today only because no skill description has yet contained an `&`.
-
-## Decision
-
-The card does not parse. It strips a producer's outer frame by exact line match and renders the remaining text as muted prose rows, folded by the shared `preview`.
-
-`stripReminderFrame` removes the first and last lines only when they are a matched open/close pair, each alone on its line (`REMINDER_FRAME_LINE`). An unpaired tag line, a mismatched pair, or a tag mentioned mid-prose is left intact, so no body is silently truncated by a tag-like first line. Producers emit the frame as whole lines, which is what makes an exact match sufficient.
-
-Model-facing text is untouched. The rejected alternative — escaping at the producer so the document parses — would have changed what the model reads.
-
-Emptiness is decided on the stripped text rather than the styled rows. A palette wraps every row in escapes, so a blank body styled first yields one escape-only row that reads as a stray blank line under the header; testing `stripped === ''` renders the card header-only instead.
-
-Removing the parse also removes the C1-expansion hazard it carried. `renderUnknownXml` had to escape parsed text because a character reference like `&#155;` expands to a control character the raw-source escaping never saw. Unparsed text cannot expand, so `&#155;` now renders literally and terminal-injection safety rests solely on `displayText`, which the `untrusted-controls` snapshot pins.
-
-`renderUnknownXml` keeps its one remaining consumer: unknown tool results, where a genuine XML result is plausible and the root element is meaningful. Only `preview` is shared with the context card.
-
-## Alternatives considered
-
-**XML-escape `&` and `<` in every producer so the frame parses.** Rejected: it corrupts a model-facing contract to satisfy a presentation detail. The model would read `packages/&lt;group&gt;/&lt;pkg&gt;/` and `&amp;logo=deepseek` — and that badge URL is an instruction the model is told to copy verbatim into a pull request description. It also needs repeating in every current and future producer with nothing keeping them in sync.
-
-**Escape only for display, keeping the model text intact.** Rejected: escaping display-side to make a parse succeed, then rendering the parse as a tree, reintroduces the placeholders-as-elements misreading. The text is prose either way, so parsing it buys nothing.
-
-**A lenient HTML-style parser.** Rejected: `renderUnknownXml` declines by design so partial or mixed text renders unchanged rather than as a guessed tree. Loosening it trades a correct decline for a wrong tree, and would affect unknown tool results too.
-
-## Consequences
-
-Context cards render identically whatever their text contains: the frame row is gone in every case, prose survives verbatim, and the fold depends only on row count. Bodies lose the tree's two-space indentation and nested-element structure, which the re-recorded `surface-after-compaction-{narrow,wide}` snapshots show; a nested block such as `<available_skills>` now appears as the literal text it is in the model-facing payload. An empty frame renders header-only rather than leaving a blank row.
-
-A character reference in context is no longer decoded for display, which is the correct reading of a payload the model receives literally.
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` pins the frame stripped for a multi-line reminder, prose preserved for an unpaired tag pair (`<available_skills>` … `</other-tag>`), header-only rendering for an empty frame, and a body carrying both a raw `&logo=` and `packages/<group>/<pkg>/` that folds and survives verbatim through a `Ctrl+O` round trip. The one-line frame case pins that `&#155;` stays literal while a raw C1 byte never reaches the terminal. The `surface-after-compaction-{narrow,wide}` keyless snapshots were re-recorded for the lost indentation and the now-recorded muted styling; `untrusted-controls` is unchanged, holding the escaping contract. `examples/tui-agent`'s `multi-turn-conversation` terminal snapshot was refreshed too: it had been failing since the original foldable-context change on an unrelated stale row, where it still expected a width-padded `Context · plan-mode` header that no card has emitted since the header stopped passing through `Text`. Both changed files keep 100% statement and branch coverage.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
deleted file mode 100644
index 461466be14..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-context-cards-render-prose-not-xml.zh.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# Agent Note: 上下文卡片把注入上下文渲染为文本，而非 XML
-
-Status: implemented
-
-[English](2026-07-28-context-cards-render-prose-not-xml.md) | 中文
-
-## 问题
-
-`ContextCardComponent` 此前通过 `renderUnknownXml` 渲染注入上下文，而该函数是严格的单文档 XML 树形渲染器。这使得两个用户可见的属性取决于载荷是否恰好是格式良好的 XML：冗余的外框行只有在解析成功时才会经 `xml.slice(1)` 去掉，而在[与内容无关的折叠](2026-07-28-context-card-content-independent-fold.md)之前，折叠同样如此。
-
-注入上下文并不是 XML。三个事实可以确立这一点：
-
-- `<system-reminder>` 是一种提示词约定，而非标记语言。没有任何模型是针对该标签训练的（[外框设计依据](../simplification/2026-07-20-unwrap-injected-content-envelopes.md)）；它传达的是「这是注入内容，不是用户在说话」。
-- 真实的指令正文包含一些对严格解析致命、但在普通文本中再正常不过的字符。徽章 URL 中 `&logo=` 里的裸 `&` 就是一个无效实体引用；在一次真实会话上测得，某个 `workspace-instructions` 载荷携带了四个。
-- 这些正文里的尖括号并不是元素。本仓库自身指令中的每一个内层「标签」都是路径或命令模板中的占位符——`packages/<group>/<pkg>/`、`-t <name>`、`Branded<B>`。把它们按元素做树形渲染会曲解这段文本。
-
-这种脆弱性从来不局限于工作区：`dsh-tool-skill` 构造的是同一套外框，它今天还能解析成功，仅仅因为至今没有哪个 skill（技能）描述里出现过 `&`。
-
-## 决策
-
-卡片不做解析。它按整行精确匹配剥掉生产方的外层外框，把剩余文本渲染为暗色文本行，并交由共享的 `preview` 折叠。
-
-`stripReminderFrame` 只在首行与末行构成一对匹配的开闭标签、且各自独占一行（`REMINDER_FRAME_LINE`）时才将其移除。落单的标签行、不匹配的标签对、以及在文本中间提及的标签都原样保留，因此不会有正文因为首行形似标签而被静默截断。生产方以整行形式输出外框，这正是精确匹配足够可靠的原因。
-
-面向模型的文本不受影响。被否决的替代方案（在生产方做转义以使文档可解析）会改变模型读到的内容。
-
-是否为空由剥离后的文本判定，而不是由已套样式的行判定。调色板会给每一行都包上转义序列，因此空正文若先套样式，就会产出一行只含转义序列的行，看上去像标题下方多出一条无端的空行；改为检测 `stripped === ''` 后，卡片只渲染标题。
-
-去掉解析同时也去掉了它带来的 C1 展开隐患。`renderUnknownXml` 必须对解析出的文本做转义，因为形如 `&#155;` 的字符引用会展开为一个控制字符，而针对原始源文本的转义根本看不到它。未经解析的文本无法展开，因此 `&#155;` 现在按字面渲染，终端注入安全性完全由 `displayText` 承担，并由 `untrusted-controls` 快照固定。
-
-`renderUnknownXml` 保留了它唯一剩下的消费方：未知工具结果。在那里真正的 XML 结果是有可能出现的，根元素也确有含义。与上下文卡片共享的只有 `preview`。
-
-## 考虑过的替代方案
-
-**在每个生产方中把 `&` 与 `<` 做 XML 转义，使外框可解析。** 不予采纳：它为了迁就一个呈现细节而破坏面向模型的契约。模型会读到 `packages/&lt;group&gt;/&lt;pkg&gt;/` 和 `&amp;logo=deepseek`——而那个徽章 URL 正是一条要求模型逐字复制到 PR（Pull Request）描述里的指令。它还需要在每个现有和未来的生产方中重复实现，且没有任何机制保证它们彼此一致。
-
-**只在展示侧转义，保持模型文本不变。** 不予采纳：为让解析成功而在展示侧转义、再把解析结果渲染成树，会重新引入把占位符当作元素的误读。这段文本无论如何都是普通文本，解析它换不来任何收益。
-
-**改用宽松的 HTML 式解析器。** 不予采纳：`renderUnknownXml` 是有意拒绝的，这样部分或混合文本才会原样渲染，而不是走一棵猜出来的树。放宽它等于用一次正确的拒绝换来一棵错误的树，并且会连未知工具结果一起波及。
-
-## 后果
-
-上下文卡片无论文本包含什么都渲染一致：外框行在所有情形下都消失，普通文本逐字保留，折叠只取决于行数。正文失去了树形渲染的两空格缩进与嵌套元素结构，重新录制的 `surface-after-compaction-{narrow,wide}` 快照体现了这一点；诸如 `<available_skills>` 这类嵌套块，现在按它在面向模型载荷中的字面文本出现。空外框只渲染标题，而不是留下一条空行。
-
-上下文中的字符引用不再为展示而解码，这才是对模型逐字接收到的载荷的正确读法。
-
-## 测试
-
-`packages/ui/tui/tests/tui.spec.ts` 固定了以下几点：多行提醒的外框被剥掉；标签对落单（`<available_skills>` … `</other-tag>`）时普通文本得以保留；空外框只渲染标题；以及一段同时含有裸 `&logo=` 和 `packages/<group>/<pkg>/` 的正文会折叠，并在 `Ctrl+O` 的一次往返中逐字存活。单行外框的用例固定了 `&#155;` 保持字面量，同时裸的 C1 字节永远不会到达终端。`surface-after-compaction-{narrow,wide}` 无密钥快照因缩进丢失和现已录制的暗色样式而被重新录制；`untrusted-controls` 未变，继续持有转义契约。`examples/tui-agent` 的 `multi-turn-conversation` 终端快照也一并刷新：自最初的可折叠上下文改动以来，它一直因一行无关的陈旧内容而失败——那里它仍期望一个按宽度补齐的 `Context · plan-mode` 标题，而自标题不再经由 `Text` 渲染之后，就没有卡片再输出过这种标题。两个改动文件都保持 100% 的语句与分支覆盖率。
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
deleted file mode 100644
index 9ac8345ba9..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
-2026-07-28-terminal-card-double-exit-status.md: e082308a9a3bd6071753993572bfca518bd89de5
-2026-07-28-terminal-card-double-exit-status.zh.md: dc8aa0a6c26958c1cfe7e4d20b7228260f7a1bff
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
deleted file mode 100644
index e082308a9a..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Agent Note: The terminal card reported a non-zero exit twice
-
-Status: implemented
-
-English | [中文](2026-07-28-terminal-card-double-exit-status.zh.md)
-
-## Problem
-
-A failing `bash` call rendered its exit status twice:
-
-```
-● Tool / bash / Check merge lock and flock availability
-$ … ; grep -n "merge.lock" .gitignore
-/opt/homebrew/bin/flock
-[exit code: 1]
-[exit 1]
-```
-
-`renderResult` appends `[exit code: N]` to the model-facing text because the model reads a single string and must see the exit. `presentBashResult` then returned that same string verbatim as the terminal card's `output` while also parsing the marker into `exitCode`, and the TUI renders `output` followed by its own dim `[exit N]` pill. Every non-zero exit and every signal kill therefore printed both forms.
-
-Neither producer was individually wrong: `TerminalResultView` documents `output` as the captured command output and `exitCode`/`signal` as separate structured fields precisely so a capable UI can show a pill. The bug was that `presentBashResult` put the consumed marker in both places. The TUI's own snapshot fixtures hid it — the hand-built card fixture supplies a marker-free `output`, and the one real recorded bash journey (`bash-terminal-card`) runs `echo TERMINAL_OK`, which exits 0 and so emits no marker at all.
-
-## Decision
-
-`parseExitStatus` now returns `{ body, …exit }`: it splits the rendered text at the marker it anchors on, so the caller receives the output body without the status line it consumed. `presentBashResult` passes that body as the card's `output`. Only the exit/signal marker leaves the output; `[output truncated: …]`, `[timed out after Nms]`, and the sandbox denial and escalation lines stay in the body because they carry facts no exit pill shows.
-
-The split lives in `render.ts` next to the marker emission it inverts. Emission, parse, and strip already had to co-evolve in one file, and a round-trip test pins the trio.
-
-## Alternatives considered
-
-- **Drop the `[exit N]` pill in the TUI.** Rejected: the pill is the scannable status, styled and placed independently of command output, and it is the only exit signal a card gets for a `TerminalResultView` produced by a tool other than `bash`.
-- **Strip the marker in the TUI renderer.** Rejected: the renderer would have to know `dsh-tool-bash`'s marker vocabulary, and the strip belongs with the parse that already consumes it. A tool's render intent is the tool's to define.
-- **Stop emitting the marker from `renderResult`.** Rejected: the marker is the model's only exit signal in a single text result, and the `tool:bash` prompt section teaches the model to check it.
-- **Have `execute` return a structured exit alongside the text.** Rejected: `presentResult(args, result)` is deliberately pure over content blocks so it replays from the session log, which retains only the rendered text.
-
-## Consequences
-
-A card body no longer ends in the marker, so a session replayed from the log renders the same single pill as a live run. The pre-existing display-only residual is now slightly larger and is recorded in the package README: output whose final line happens to be exactly `[exit code: N]` or `[killed by signal: …]` is read as the marker, which both shows a wrong pill and drops that line from the card body.
-
-The deliberate treatments in [the tool-card header note](../feature/2026-07-27-tui-tool-card-header.md) are unchanged: terminal exit keeps its existing dim `[exit N]` line rather than moving into a uniform footer.
-
-## Testing
-
-`tools.spec.ts` pins the marker-free body for a non-zero exit, a signal kill, and a clean run; asserts a timeout marker survives alongside the stripped exit; and extends the `renderResult`/`parseExitStatus` round-trip to assert no consumed marker remains in the body.
-
-The defect was invisible to every existing snapshot, so `tui-keyless-smoke.e2e.ts` adds a real-PTY scenario: the scripted adapter calls the real `bash` tool with `printf …; exit 3`, and the test asserts the terminal output contains the command's stdout and `[exit 3]` but never `[exit code: 3]`. It reproduces the double render when the presenter fix is reverted.
diff --git a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md b/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
deleted file mode 100644
index dc8aa0a6c2..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-07-28-terminal-card-double-exit-status.zh.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Agent Note: terminal 卡片把非零退出状态报告了两次
-
-Status: implemented
-
-[English](2026-07-28-terminal-card-double-exit-status.md) | 中文
-
-## Problem
-
-失败的 `bash` 调用会把退出状态渲染两次：
-
-```
-● Tool / bash / Check merge lock and flock availability
-$ … ; grep -n "merge.lock" .gitignore
-/opt/homebrew/bin/flock
-[exit code: 1]
-[exit 1]
-```
-
-`renderResult` 会把 `[exit code: N]` 追加到面向模型的文本上，因为模型读到的是单个字符串，必须能看到退出状态。而 `presentBashResult` 随后把同一个字符串原样作为 terminal 卡片的 `output` 返回，同时又把该标记解析进 `exitCode`，TUI 则在 `output` 之后再渲染自己的暗色 `[exit N]` 徽标。于是每一次非零退出、每一次信号终止都会同时打印两种形式。
-
-两个产出方各自都没有错：`TerminalResultView` 明确约定 `output` 是捕获的命令输出，`exitCode`/`signal` 是独立的结构化字段，正是为了让有能力的 UI 能显示徽标。缺陷在于 `presentBashResult` 把已被消费的标记同时放进了两个位置。TUI 自己的快照 fixture（测试前置数据）掩盖了它：手工构造的卡片 fixture 提供的 `output` 不含标记，而唯一真实录制的 bash 流程（`bash-terminal-card`）执行 `echo TERMINAL_OK`，退出码为 0，因此根本不会发出标记。
-
-## Decision
-
-`parseExitStatus` 现在返回 `{ body, …exit }`：它在自己锚定的标记处切分渲染后的文本，于是调用方拿到的输出正文不再包含它消费掉的那行状态。`presentBashResult` 把该正文作为卡片的 `output` 传出。只有退出／信号标记会离开输出；`[output truncated: …]`、`[timed out after Nms]` 以及沙箱拒绝与升权提示行仍留在正文中，因为它们携带的事实是退出徽标无法体现的。
-
-切分逻辑放在 `render.ts` 中、紧邻它所反演的标记发出处。发出、解析与剥除本就必须在同一个文件里协同演进，一个往返测试把这三者钉在一起。
-
-## Alternatives considered
-
-- **在 TUI 中去掉 `[exit N]` 徽标。** 已否决：该徽标是可快速扫读的状态，其样式与位置独立于命令输出，而且对于由 `bash` 之外的工具产出的 `TerminalResultView`，它是卡片能拿到的唯一退出信号。
-- **在 TUI 渲染器中剥除该标记。** 已否决：渲染器将不得不知晓 `dsh-tool-bash` 的标记词汇，而剥除应当与已经消费它的那次解析放在一起。工具的渲染意图应由工具自己定义。
-- **不再从 `renderResult` 发出该标记。** 已否决：在单个文本结果中，该标记是模型唯一的退出信号，而且 `tool:bash` 提示词章节会教模型去检查它。
-- **让 `execute` 在文本之外一并返回结构化的退出状态。** 已否决：`presentResult(args, result)` 刻意设计为对内容块的纯函数，从而可以从会话日志回放，而日志只保留渲染后的文本。
-
-## Consequences
-
-卡片正文不再以标记结尾，因此从日志回放的会话与实时运行渲染出同样的单个徽标。既有的仅影响展示的残留问题现在稍微扩大，并已记录在包（package）的 README 中：如果输出的最后一行恰好正是 `[exit code: N]` 或 `[killed by signal: …]`，它会被读成标记，既显示错误的徽标，也会把该行从卡片正文中丢掉。
-
-[工具卡片标题 note](../feature/2026-07-27-tui-tool-card-header.md) 中的刻意处理保持不变：terminal 的退出状态仍沿用既有的暗色 `[exit N]` 行，而不是并入统一的页脚。
-
-## Testing
-
-`tools.spec.ts` 针对非零退出、信号终止与正常运行三种情形钉住不含标记的正文；断言超时标记会与被剥除的退出标记并存；并扩展 `renderResult`/`parseExitStatus` 往返测试，断言正文中不再残留被消费的标记。
-
-该缺陷对所有既有快照都不可见，因此 `tui-keyless-smoke.e2e.ts` 新增了一个真实 PTY 场景：脚本化适配器以 `printf …; exit 3` 调用真实的 `bash` 工具，测试断言终端输出包含该命令的 stdout 与 `[exit 3]`，但绝不出现 `[exit code: 3]`。若回退 presenter 的修复，它能复现重复渲染。
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
deleted file mode 100644
index 60285a26b0..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
-2026-07-28-cross-workspace-resume.md: 09b638398ea9379d39df94fcb42da3395cdd70df
-2026-07-28-cross-workspace-resume.zh.md: 5a2e7d2535c07b4ace0416b234dc28b32cbcd2fc
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
deleted file mode 100644
index 09b638398e..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Agent Note: Cross-workspace session resume
-
-Status: implemented
-
-English | [中文](2026-07-28-cross-workspace-resume.zh.md)
-
-## Problem
-
-`/resume` could only reach sessions started in the launch directory, so returning to yesterday's work in another project meant remembering its path, leaving the TUI, and relaunching there. Two independent causes produced that limit, and fixing either alone changes nothing.
-
-Storage was the binding one. The shipped `tui-demo` bundle defaulted `persistenceRoot` to a relative `./.sessions`, so each launch directory owned a disjoint JSONL root and a disjoint derived `session-query.db`. Sessions from another project were not filtered out of the listing — they were absent from the store the listing reads. The JSONL backend already partitions per-cwd *inside* one root, so the partitioning was doubled: once by root, once within it.
-
-The picker then filtered again. It dropped records whose `cwd` differed from the current session before display, and `summarizeResumeCandidate` independently marked a differing `cwd` as `disabledReason: 'different workspace'`, so a foreign session that did reach the store was both hidden and refused.
-
-Finally, resume never changed directory. The host re-execs `dsh --resume=<id>` through `process.execve`, which inherits the cwd. Session *header* cwd is restored from the log, but process cwd is what `dsh-fs-local`, the bash executor, and glob/grep resolve against, so resuming a foreign session would have replayed its transcript while acting on the wrong project.
-
-## Decision
-
-The dsh launcher supplies one session root under its Harness home through a boot slot, the picker gains a workspace scope, and the handoff carries the target directory.
-
-**Storage.** `dsh-paths` owns the location as `resolveSessionsRoot()` (`sessions` under the Harness home, by `resolveDshHome`'s precedence), but only the launcher assumes it: shared-store policy is the dsh CLI's, never a plugin's. The TUI surface provides the root through the `SESSIONS_ROOT_KEY` boot slot (`ctx.provide` before Loader entries mount) and `dsh web` patches the same root in `apps/cli/src/app-cli-entry.ts`. Two CLI surfaces computing that path independently is exactly the failure this change fixes — disjoint stores — so the fact gets one home rather than a `join` per caller, alongside the existing `registryRoot()` precedent for `run`.
-
-`tui-demo` itself keeps a project-local `./.sessions` default and reads the launcher slot between explicit config and that default (`config.persistenceRoot ?? ctx.get(SESSIONS_ROOT_KEY) ?? './.sessions'`). The precedence lives in `composeTuiApp`, not as a schemastery `.default()`, because a schema default would materialize before the compose function runs and shadow the slot for every Loader mount. `examples/tui-agent/cordis.yml` omits `persistenceRoot` so the launcher slot (or, for a bare example boot, the project-local default) applies. Configuring an explicit root always wins, which remains the correct choice for a hermetic deployment.
-
-**Scope, not exclusion.** A workspace other than the current one is a display scope rather than a disabled reason. `showResume()` summarizes every record and the `ResumePicker` owns a `scope` of `'workspace' | 'all'`, defaulting to the current workspace so the common case is unchanged. Tab toggles; the scope line names the active scope and the count the other holds; each row in the all-workspaces scope reports its own workspace, and that label joins the searchable text only in the scope that shows it. A toggle clears the query and selection so the highlighted row always belongs to the visible list, and the per-row workspace line makes a row one terminal row taller in that scope, which the visible-count budget accounts for.
-
-`summarizeResumeCandidate` therefore drops `'different workspace'` and gains `'session has no recorded workspace'`. That is a real new refusal rather than a rename: a header without `cwd` names no directory for the host to enter, so it cannot be handed off even though its log is intact.
-
-**Handoff.** `TuiResumeHost.handoff` takes the target `cwd` beside the `SessionId`. `preflightResume` resolves both together and returns them, so the caller cannot re-derive a stale directory from the row it displayed — a record whose `cwd` moved between listing and preflight is resumed in the *re-read* directory, which is why the former "reject a moved cwd" behavior is now a handoff with the new path. The shipped host chdirs before disposing the app: an unreachable directory must reject while the caller can still restore the terminal, because after teardown no owner remains to report to. `resumeArgs` keeps the `meta` subcommand form only when the target is this checkout, since `dsh meta` chdirs to the harness source itself and would override any other workspace.
-
-## Alternatives considered
-
-**Patch `persistenceRoot` from the `dsh` launcher instead of changing the bundle default.** Rejected after finding that a loader patch assigns `config` wholesale. The personal `~/.dsh/config.yaml` overlay already patches the `tui-agent` row with a partial config, which is exactly why `persistenceRoot` was falling back to the bundle default in the first place; a launcher patch would either be erased by that overlay or have to win over it and make the overlay unable to set the field. Owning the default in the bundle survives any partial patch and keeps one home for the fact.
-
-**Keep `./.sessions` and additionally scan the Harness-home root.** Rejected: two roots means two SQLite indexes and a merged listing whose rows have different liveness and revision authorities, to preserve visibility of logs that the no-migration decision already gives up.
-
-**Migrate existing project-local logs into the shared root.** Rejected by the requester. Sessions under a project's `./.sessions` stay on disk and stay resumable by explicit `dsh --resume <id>` from that directory, but no longer appear in `/resume`.
-
-**One flat list of every workspace.** Rejected: it loses the "this project" default that the overwhelmingly common case wants, and in a busy home directory the current project's sessions would compete with unrelated ones.
-
-**Let the host infer the directory from the restored session header.** Rejected: the header is model- and prompt-facing state restored *after* boot, while the directory must be entered *before* `execve`. Passing it explicitly keeps the ordering visible at the seam.
-
-## Consequences
-
-- Sessions already stored under a project-local `./.sessions` disappear from `/resume`. This is the accepted cost of no migration.
-- One shared root makes the pre-existing absence of a cross-process session lock reachable in one step: colliding used to require two terminals in the same directory, and is now one Tab away. `record.live` comes from the in-process `SessionQueryService`, so preflight rejects only sessions live in *this* runtime, while the JSONL backend takes no lock and two processes appending one log with independent `seq` counters would interleave. Closing this is no longer speculative hardening: `SessionRegistry.list()` already publishes live sessions cross-process under the same Harness home for `dsh list-sessions`, so consulting it in `summarizeResumeCandidate` is a small follow-up. It stays out of this change as pre-existing scope.
-- A resumed session can change the process's working directory, so a foreign resume is not a pure transcript restoration — every path-resolving tool moves with it.
-- The Harness home now holds session logs for every project on the machine. Its growth is no longer bounded by one checkout, and no retention policy is introduced here.
-
-## Testing
-
-TUI tests cover the default scope hiding other workspaces while reporting their count, Tab revealing them with per-row workspace labels, Tab back clearing the query and selection, searching by workspace label, a cwd-less record staying visible but disabled, and the handoff receiving both the id and the workspace re-read at preflight. The former "reject a moved cwd" case now asserts the handoff carries the new directory. `dsh-paths` tests pin `resolveSessionsRoot`'s precedence against `resolveDshHome`'s. `tui-demo` composition tests pin the project-local default and the derived `session-query.db` path. The keyless TUI snapshot pins both scopes of the selector, including the scope line, the per-row workspace lines, and the Tab hint in the footer. A manual cross-workspace resume verified at the process level that the replacement's working directory became the target workspace.
diff --git a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md b/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
deleted file mode 100644
index 5a2e7d2535..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-cross-workspace-resume.zh.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Agent Note: 跨 workspace 会话恢复
-
-Status: implemented
-
-[English](2026-07-28-cross-workspace-resume.md) | 中文
-
-## Problem
-
-`/resume` 只能触达在启动目录中创建的会话，因此要回到昨天在另一个项目里的工作，就得记住它的路径、退出 TUI、再到那里重新启动。造成这一限制的原因有两个，彼此独立，只修其中一个都不会有任何变化。
-
-存储是那个决定性的原因。已交付的 `tui-demo` 组合包把 `persistenceRoot` 默认成相对路径 `./.sessions`，于是每个启动目录都独占一份互不相交的 JSONL 根目录，以及一份互不相交的派生 `session-query.db`。来自另一个项目的会话并不是在列表中被过滤掉的——它们根本不存在于列表读取的存储中。JSONL 后端本来就会在*同一个*根目录*内部*按 cwd 分区，所以分区被叠加了两层：一层按根目录，一层在根目录内部。
-
-接着选择器又过滤了一次。它在展示前丢弃 `cwd` 与当前会话不同的记录，而 `summarizeResumeCandidate` 又独立地把不同的 `cwd` 标记为 `disabledReason: 'different workspace'`，于是一个确实进入了存储的外部会话既被隐藏，也会被拒绝。
-
-最后，恢复流程从不切换目录。宿主通过 `process.execve` 重新执行 `dsh --resume=<id>`，而它会继承 cwd。会话*头部*的 cwd 会从日志中还原，但 `dsh-fs-local`、bash 执行器以及 glob／grep 解析路径时依据的是进程 cwd，所以恢复一个外部会话会在回放它的 transcript（文本记录）的同时，作用到错误的项目上。
-
-## Decision
-
-dsh 启动器通过启动槽位提供其 Harness home 下的同一个会话根目录，选择器获得 workspace 范围，交接过程携带目标目录。
-
-**存储。** `dsh-paths` 以 `resolveSessionsRoot()` 拥有该位置（按 `resolveDshHome` 的优先级，取 Harness home 下的 `sessions`），但只有启动器假定它：共享存储策略属于 dsh CLI，绝不属于插件。TUI 界面通过 `SESSIONS_ROOT_KEY` 启动槽位（在 Loader 条目挂载前 `ctx.provide`）提供该根目录，`dsh web` 则在 `apps/cli/src/app-cli-entry.ts` 中为同一根目录打补丁。CLI 的两处界面各自独立计算该路径，正是本次改动所修复的那种失败——互不相交的存储——因此这项事实只有一个归属，而不是每个调用方各做一次 `join`，这与 `run` 已有的 `registryRoot()` 先例一致。
-
-`tui-demo` 自身保持项目本地的 `./.sessions` 默认值，并在显式配置与该默认值之间读取启动器槽位（`config.persistenceRoot ?? ctx.get(SESSIONS_ROOT_KEY) ?? './.sessions'`）。这一优先级放在 `composeTuiApp` 内，而不是写成 schemastery 的 `.default()`，因为 schema 默认值会在 compose 函数运行前物化，使每次 Loader 挂载都遮蔽该槽位。`examples/tui-agent/cordis.yml` 不写 `persistenceRoot`，因此启动器槽位（裸示例启动时则为项目本地默认值）生效。显式配置的根目录总是获胜，对于封闭部署来说这仍然是正确的选择。
-
-**是范围，不是排除。** 当前 workspace 之外的 workspace 是一种展示范围，而不是禁用理由。`showResume()` 汇总每一条记录，`ResumePicker` 持有一个 `'workspace' | 'all'` 的 `scope`，默认为当前 workspace，因此常见场景毫无变化。Tab 切换范围；范围行会说明当前生效的范围，以及另一个范围下的数量；在全 workspace 范围中每一行都报告自己的 workspace，而该标签只在展示它的范围里才加入可搜索文本。切换范围会清空查询和选中项，使高亮行始终属于可见列表；而逐行的 workspace 行会让该范围下的每一行在终端里多占一行，可见条数预算已经把这一点计入。
-
-因此 `summarizeResumeCandidate` 去掉了 `'different workspace'`，并新增 `'session has no recorded workspace'`。这是一条真正新增的拒绝理由，而不是改名：没有 `cwd` 的头部没有指明任何目录供宿主进入，所以即便它的日志完好也无法完成交接。
-
-**交接。** `TuiResumeHost.handoff` 在 `SessionId` 之外还接收目标 `cwd`。`preflightResume` 把两者一起解析并一起返回，因此调用方无法从它展示过的那一行里重新推导出一个陈旧目录——在列表展示与预检之间 `cwd` 发生了移动的记录，会在*重新读取到的*目录中恢复，这也是原先「拒绝已移动的 cwd」的行为如今变成携带新路径完成交接的原因。已交付的宿主在释放应用之前切换目录：不可达的目录必须在调用方还能恢复终端时就拒绝，因为拆卸之后已经没有任何所有者可供汇报。`resumeArgs` 只在目标就是本 checkout 时才保留 `meta` 子命令形式，因为 `dsh meta` 会切换到 harness 源码本身，从而覆盖任何其他 workspace。
-
-## Alternatives considered
-
-**从 `dsh` 启动器给 `persistenceRoot` 打补丁，而不是改动组合包默认值。** 在发现 loader 补丁会整体赋值 `config` 之后否决。个人的 `~/.dsh/config.yaml` 覆盖层已经用一份局部配置给 `tui-agent` 那一项打了补丁，这恰恰就是 `persistenceRoot` 一开始会退回到组合包默认值的原因；启动器补丁要么会被该覆盖层擦除，要么必须压过它，从而让覆盖层再也无法设置这个字段。把默认值放在组合包里能经受任何局部补丁，并让这项事实只有一个归属。
-
-**保留 `./.sessions`，并额外扫描 Harness home 根目录。** 否决：两个根目录意味着两份 SQLite 索引，以及一份合并列表——其中各行的活跃状态与版本权威来源并不相同，而这一切只是为了保住不做迁移的决策本就已经放弃的那部分日志可见性。
-
-**把现有的项目本地日志迁移到共享根目录。** 被需求方否决。项目 `./.sessions` 下的会话仍留在磁盘上，从该目录显式执行 `dsh --resume <id>` 仍可恢复，只是不再出现在 `/resume` 中。
-
-**把所有 workspace 铺成一个扁平列表。** 否决：这会丢掉绝大多数场景想要的「本项目」默认值，而在一个繁忙的 home 目录里，当前项目的会话会和无关会话争夺注意力。
-
-**让宿主从还原后的会话头部推断目录。** 否决：会话头部是面向模型与提示词的状态，在启动*之后*才还原，而目录必须在 `execve` *之前*进入。显式传递它能让这个顺序在边界处保持可见。
-
-## Consequences
-
-- 已经存放在项目本地 `./.sessions` 下的会话会从 `/resume` 中消失。这是不做迁移所接受的代价。
-- 同一个共享根目录让原本就缺失的跨进程会话锁一步之内即可触达：过去要造成冲突需要在同一个目录里开两个终端，如今只差一次 Tab。`record.live` 来自进程内的 `SessionQueryService`，因此预检只会拒绝在*本*运行时中处于活跃状态的会话，而 JSONL 后端不加任何锁，两个进程用各自独立的 `seq` 计数器追加同一份日志会互相交错。解决这一点已不再是投机性加固：`SessionRegistry.list()` 已经为 `dsh list-sessions` 在同一个 Harness home 下跨进程发布活跃会话，因此在 `summarizeResumeCandidate` 中查询它是一项小的后续工作。它作为既有范围之外的问题不纳入本次改动。
-- 恢复一个会话可以改变进程的工作目录，因此恢复外部会话不是单纯的 transcript 还原——每个解析路径的工具都会随之移动。
-- Harness home 现在保存着这台机器上每个项目的会话日志。它的增长不再受单个 checkout 约束，而本记录也没有引入任何保留策略。
-
-## Testing
-
-TUI 测试覆盖默认范围隐藏其他 workspace 但报告其数量、Tab 显示它们并带上逐行 workspace 标签、再按 Tab 返回时清空查询与选中项、按 workspace 标签搜索、无 cwd 的记录仍可见但不可选，以及交接同时收到 id 和在预检时重新读取到的 workspace。原先「拒绝已移动的 cwd」的用例现在断言交接携带新目录。`dsh-paths` 测试固定 `resolveSessionsRoot` 的优先级与 `resolveDshHome` 的一致。`tui-demo` 组合测试固定项目本地默认值以及派生出的 `session-query.db` 路径。无密钥 TUI 快照固定选择器的两个范围，包括范围行、逐行 workspace 行，以及页脚中的 Tab 提示。手动执行的一次跨 workspace 恢复在进程层面验证了替换后进程的工作目录变为目标 workspace。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
deleted file mode 100644
index 07fbaed171..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
-2026-07-28-tui-dim-tool-result-output.md: 3eab3e57158c1bbcbadf233e27e50360601c84d5
-2026-07-28-tui-dim-tool-result-output.zh.md: cac06245f6c9d71a358f789099512a5a4a84eb49
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
deleted file mode 100644
index 3eab3e5715..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.md
+++ /dev/null
@@ -1,39 +0,0 @@
-# Agent Note: Dim tool-result output inside TUI tool cards
-
-Status: implemented
-
-English | [中文](2026-07-28-tui-dim-tool-result-output.zh.md)
-
-## Problem
-
-After the [fixed `Tool / <name>` header](2026-07-27-tui-tool-card-header.md) moved every tool-specific detail into the card body, that body became a flat block at the terminal's default foreground: a presenter title, a terminal `$` command, its cwd, and the tool's own output all read as one undifferentiated run of text. A transcript of several calls gave no visual cue for where the card's framing ended and what the tool actually produced began, and long command output competed with the surrounding conversation for attention even though it is reference material a reader skims rather than reads.
-
-## Decision
-
-The framing/output split below is superseded by [one dim tone for the whole card body](2026-07-28-tui-uniform-dim-card-body.md), which keeps dim output but extends it over the framing rows; that note owns the current rule and the reason the split read as scatter. What remains current here is why tool output is recessed at all, and the diff-card and blank-row carve-outs both notes share.
-
-Inside a tool card, the tool's own output renders in the `dim` palette role while the card's framing keeps its existing color. Framing is the presenter title, a terminal card's `$` command line and cwd row, and a diff card's per-file path headers and `+`/`-` lines; output is a terminal card's captured stdout/stderr and a generic card's result text.
-
-`ToolCardComponent.renderBody` in `packages/ui/tui/src/components/transcript.ts` returns a `CardBody` of `{ prelude, lines }` instead of one flat string array. `prelude` holds already-styled framing rows that render verbatim; `lines` holds the tool's text. A terminal card dims its output rows through `dimOutput`, which leaves a blank row as the empty string so the branch's existing blank-row filter still drops it rather than keeping an ANSI-wrapped empty value. A diff card returns its hunks and change footer entirely as `prelude`: the `+`/`-` colors already carry the diff's meaning, and dimming them would fight that signal.
-
-A generic card renders its title and result as one Markdown document and dims only the rows past the title's, in `dimPastPrelude`. Rendering the title alone at the same width yields its row count, so the split survives wrapping and the document keeps its own block spacing — notably the blank row pi-tui's Markdown places between a leading paragraph and a following heading, which a two-document split would drop. A whitespace-only row is left unwrapped so Markdown's line padding stays out of the styled ranges. Markdown role colors (headings, inline code) still apply over the dim base, so a dim result keeps its internal structure.
-
-Exit and signal markers keep their existing roles (`dim [exit N]`, `error [signal …]`), and the collapsed-preview marker stays dim, so the change adds no new palette role and no configuration.
-
-## Alternatives considered
-
-**Dim the whole card body.** Rejected: it flattens a diff card's `+`/`-` green and red, which is the one place color carries meaning rather than emphasis, and it dims the `$` command a reader scans for to identify what ran.
-
-**Change the generic card's Markdown base color and keep the title inside the same document.** Rejected: `DefaultTextStyle.color` applies uniformly to every row, so the title would dim along with the result. Splitting the title into its own document instead loses the blank row Markdown inserts before a heading, which visibly closed the gap between title and result in the `run_code` and `cordis_inspect` cards.
-
-**Introduce a dedicated `toolOutput` palette role.** Rejected: no consumer needs it distinct from `dim`, and the palette's role set is the contract other components read; adding a role that resolves to the same SGR pair buys nothing.
-
-**Dim every row unconditionally in `dimOutput`.** Rejected: wrapping an empty string yields a non-empty ANSI value, which defeats the terminal branch's `filter(Boolean)` and adds a blank row to every card whose output ends in a newline — that is, nearly every real bash result.
-
-## Consequences
-
-A card now reads as framing plus output at a glance, and a transcript of many calls scans as a column of headers with recessed detail beneath each. The cost is that `dimPastPrelude` renders a generic card's Markdown twice per frame — once for the prelude alone to count its rows, once for the whole document — which is acceptable at card scale and keeps the row split correct under wrapping. Because dim is an SGR attribute rather than a color, a result's Markdown role colors survive underneath it, so a dim body is still structured rather than uniformly gray. The treatment is TUI-local: ACP and JSON-RPC bridges keep their own tool-call presentation, and no presenter or `presentation.ts` type changed.
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` pins the blank-row guard with color enabled, where the dim wrapper is what makes an empty row non-empty; the assertion fails if `dimOutput` wraps unconditionally. The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` and `examples/tui-agent/tests/snapshots/` were re-recorded and carry the new `dim` style ranges for bash output, read output, `run_code`, `workflow`, `subagent`, `todo_write`, and `cordis_*` results, while the diff cards' `+`/`-` ranges and the `$` command rows are unchanged.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
deleted file mode 100644
index cac06245f6..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-dim-tool-result-output.zh.md
+++ /dev/null
@@ -1,39 +0,0 @@
-# Agent Note: Dim tool-result output inside TUI tool cards
-
-Status: implemented
-
-[English](2026-07-28-tui-dim-tool-result-output.md) | 中文
-
-## Problem
-
-[固定的 `Tool / <name>` 表头](2026-07-27-tui-tool-card-header.md)把每一项工具专属的细节都移入卡片正文后，正文成为使用终端默认前景色的扁平文本块：presenter 标题、终端的 `$` 命令及其 cwd，以及工具自身的输出都成了一段无法区分的文本。包含多次调用的 transcript（文本记录）无法在视觉上区分卡片框架到哪里结束、工具实际产生的内容从哪里开始；而且命令输出较长时会与周围的对话争夺注意力，尽管它只是供读者扫读而非细读的参考资料。
-
-## Decision
-
-下文所述的框架/输出划分已由[整个卡片正文统一使用一种暗色调](2026-07-28-tui-uniform-dim-card-body.md)取代：后者保留输出的暗色样式，并将其扩展到框架行；当前规则以及这种划分为何呈现为颜色散乱，均由该说明负责记录。本文仍然有效的是工具输出为何需要弱化，以及两篇说明共同保留的 diff 卡片和空白行例外。
-
-在工具卡片中，工具自身的输出使用调色板的 `dim` 角色渲染，而卡片框架保留既有颜色。框架包括 presenter 标题、终端卡片的 `$` 命令行与 cwd 行，以及 diff 卡片各文件的路径表头和 `+`/`-` 行；输出包括终端卡片捕获的 stdout/stderr，以及 generic 卡片的结果文本。
-
-`ToolCardComponent.renderBody` 在 `packages/ui/tui/src/components/transcript.ts` 中返回 `CardBody`，其内容为 `{ prelude, lines }`，而非单一的扁平字符串数组。`prelude` 保存已设置样式并按原样渲染的框架行；`lines` 保存工具文本。终端卡片通过 `dimOutput` 将输出行变暗；该函数会把空白行保留为空字符串，使此分支既有的空白行过滤逻辑仍会丢弃它，而不会保留一个带 ANSI 包装的空值。diff 卡片将其变更块与变更页脚全部作为 `prelude` 返回：`+`/`-` 的颜色已经承载了 diff 的含义，再将它们变暗会干扰这一信号。
-
-对于 generic 卡片，标题与结果作为同一个 Markdown 文档渲染，再由 `dimPastPrelude` 仅将标题之后的行变暗。以相同宽度单独渲染标题即可得到它的行数，因此即使发生折行，也能正确划分两部分，同时文档仍可保留自身的块间距，尤其是 pi-tui 的 Markdown 在开头段落与后续标题之间插入的空白行；拆成两个文档会丢失该空白行。仅含空白字符的行不会添加样式包装，因此 Markdown 的行填充不会进入样式范围。Markdown 的角色颜色（标题、内联代码）仍会叠加于暗色基础样式之上，因此变暗的结果仍保留内部结构。
-
-退出和信号标记保留既有角色（`dim [exit N]`、`error [signal …]`），折叠预览标记也保持变暗，因此此变更没有新增调色板角色或配置。
-
-## Alternatives considered
-
-**将整个卡片正文变暗。** 已否决：这会削弱 diff 卡片中 `+`/`-` 的绿色和红色，而这里的颜色承载的是含义而非强调；同时还会把读者用来确认所运行命令的 `$` 命令变暗。
-
-**更改 generic 卡片的 Markdown 基础颜色，并将标题留在同一个文档中。** 已否决：`DefaultTextStyle.color` 会统一应用于每一行，因此标题会随结果一起变暗。改为把标题拆成单独的文档，又会丢失 Markdown 在标题前插入的空白行，从视觉上消除 `run_code` 和 `cordis_inspect` 卡片中标题与结果之间的间隔。
-
-**引入专用的 `toolOutput` 调色板角色。** 已否决：没有消费方需要将其与 `dim` 区分，而调色板的角色集合是其他组件读取的契约；新增一个解析为相同 SGR 组合的角色没有收益。
-
-**在 `dimOutput` 中无条件将每一行变暗。** 已否决：包装空字符串会得到一个非空的 ANSI 值，使终端分支的 `filter(Boolean)` 失效，并为输出以换行符结尾的每张卡片都增加一个空白行，而几乎每条真实 bash 结果都以换行符结尾。
-
-## Consequences
-
-卡片现在一眼就能看出框架与输出，包含大量调用的 transcript 也呈现为一列表头，每个表头下方是弱化的细节。代价是 `dimPastPrelude` 每帧会渲染 generic 卡片的 Markdown 两次：第一次只渲染 prelude 以统计行数，第二次渲染整个文档；在卡片规模下，这一开销可以接受，并能在折行时保持正确的行划分。由于变暗效果是 SGR 属性而非颜色，结果中的 Markdown 角色颜色仍能在其下保留，因此变暗的正文仍有结构，而不是统一的灰色。此处理仅限 TUI：ACP 和 JSON-RPC 桥接层保留各自的工具调用呈现方式，所有 presenter 与 `presentation.ts` 类型均未改变。
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` 在启用颜色的情况下固定了空白行守卫，此时正是 dim 包装层使空白行成为非空值；如果 `dimOutput` 无条件包装，该断言就会失败。`packages/ui/tui/tests/snapshots/` 与 `examples/tui-agent/tests/snapshots/` 下的无密钥终端快照已重新录制，并加入新的 `dim` 样式范围，覆盖 bash 输出、read 输出、`run_code`、`workflow`、`subagent`、`todo_write` 和 `cordis_*` 结果，同时 diff 卡片的 `+`/`-` 范围与 `$` 命令行保持不变。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
deleted file mode 100644
index 506e343d61..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
-2026-07-28-tui-foldable-context-cards.md: ff96c30db231c682a5a4d6a9aa3b94a283b8501b
-2026-07-28-tui-foldable-context-cards.zh.md: ceb9f28834d26abc5717174dd34ab316e3754284
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
deleted file mode 100644
index ff96c30db2..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: Foldable injected-context cards in the TUI
-
-Status: implemented
-
-English | [中文](2026-07-28-tui-foldable-context-cards.zh.md)
-
-## Problem
-
-The TUI rendered every injected-context message (a non-`user` `user/message` source: `workspace-context`, `goal`, and other plugins) as three loose transcript children — a dim `Context · <label>` header, the message's XML root element name (`system-reminder`), and the body — always fully expanded. Two things read badly. First, unlike tool-call cards, a context card could not be collapsed, so a large `workspace-context` reminder occupied the transcript permanently with no `Ctrl+O` fold. Second, the XML root element rendered as its own literal line (`system-reminder`) directly under the `Context · workspace-context` header that already names the source, so the frame element read as raw-XML noise duplicating the header.
-
-## Decision
-
-Injected context renders as a `ContextCardComponent` (`packages/ui/tui/src/components/transcript.ts`), a collapsible dim card that shares the tool-card `Ctrl+O` toggle and starts collapsed. Its header is the same dim `Context · <label>` line. Its body is the message text as muted prose rows with the redundant frame lines stripped: the source label already names the context, so the body starts at the instruction content and the `system-reminder` line is gone. The body folds to the card's `maxToolOutputLines` budget through the shared `preview` helper, showing the `… +N lines (Ctrl+O to expand)` marker. Neither the fold nor the frame stripping depends on the payload's syntax ([content-independent fold](../bug-fix/2026-07-28-context-card-content-independent-fold.md), [prose rendering](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)); this note's original implementation routed both through `renderUnknownXml`.
-
-`Ctrl+O` cycles the shared `toggleTools` handler through three states — collapsed preview, expanded, hidden — matching Codex's behavior: the hidden phase removes tool cards (and their leading gap, which the card renders itself) from the transcript entirely. Context cards carry injected instructions rather than tool traffic, so they never hide; the hidden phase reads as their collapsed preview. The notice names the state (`Tool and context cards {collapsed|expanded}.` / `Tool cards hidden.`) and the `/help` shortcut line reads `Ctrl+O cycle cards (collapse/expand/hide)`. `renderEvent` tracks each card in a `contextCards` set alongside `allToolCards`, cleared by `rebuildTranscript`.
-
-The label derivation tolerates a non-object source shape (an invalid injected source that is neither a session-reference card nor an object): it falls back to the generic `context` heading rather than dereferencing `plugin`/`kind` off a non-object. The `sessionReferenceCard` branch (the single-line referenced-sessions row) is unchanged — it has nothing to fold.
-
-The change is TUI-only. It touches `ContextCardComponent`/`ToolCardComponent` wiring in `transcript.ts` and the `renderEvent`/`toggleTools`/help paths in `packages/ui/tui/src/index.ts`. No producer, session event, or other UI bridge (ACP, JSON-RPC) changes; the fold shape is TUI-local and not a cross-package contract.
-
-## Alternatives considered
-
-**Keep context cards fully expanded, only drop the root line.** Rejected: the primary complaint was that a large `workspace-context` reminder cannot be folded like a tool card. Dropping the redundant frame line alone leaves the transcript-occupancy problem unsolved.
-
-**A dedicated shortcut for context cards, independent of tool cards.** Rejected in favor of sharing `Ctrl+O`: one key matches the existing mental model and adds nothing to learn or document, and the two card kinds fold for the same reason (transcript noise). The cycle's hidden phase applies only to tool cards for the same reason a shared key works: hiding injected instructions would remove content the user cannot recover from any other card.
-
-**Suppress the root line generically inside `renderUnknownXml`.** Rejected: `renderUnknownXml` also renders unknown tool results, where the root element is meaningful. Root suppression is a context-card presentation choice and lives in `ContextCardComponent`, keeping the tool-card path unchanged.
-
-## Consequences
-
-A `workspace-context` reminder now collapses with the same `Ctrl+O` that folds tool cards, and its body no longer prints the redundant `system-reminder` frame line under the header. The cost is a second card kind tracked for the shared cycle and a small label-shape fallback for invalid injected sources. Because the change is confined to the TUI transcript, ACP and JSON-RPC bridges keep their own injected-context presentation.
-
-## Testing
-
-`packages/ui/tui/tests/tui.spec.ts` pins that a context card is collapsed by default with the `Ctrl+O to expand` marker, expands on `Ctrl+O` with the `Tool and context cards expanded.` notice, survives the hidden phase at its collapsed preview while tool cards disappear from a repaint, returns to `collapsed` on the fourth press, drops the `system-reminder` frame line, renders unframed context as muted prose, and renders an empty frame header-only. The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` — rendered through the real assembled TUI and a pseudo-terminal — were re-recorded and show the frame-less context card, the updated toggle notice, and the updated `/help` shortcut line.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
deleted file mode 100644
index ceb9f28834..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-foldable-context-cards.zh.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Agent Note: TUI 中的可折叠注入上下文卡片
-
-Status: implemented
-
-[English](2026-07-28-tui-foldable-context-cards.md) | 中文
-
-## 问题
-
-TUI 会将每条注入上下文消息（即一条来源不是 `user` 的 `user/message`：`workspace-context`、`goal` 及其他插件）渲染为 transcript（文本记录）中的三个零散子项：暗色的 `Context · <label>` 标题、消息的 XML 根元素名称（`system-reminder`）和正文，并且始终完全展开。这种呈现有两处影响阅读。第一，与工具调用卡片不同，上下文卡片无法折叠，因此较大的 `workspace-context` 提醒会一直占据 transcript，无法通过 `Ctrl+O` 折叠。第二，XML 根元素会直接显示在已经注明来源的 `Context · workspace-context` 标题下方，单独形成一行字面值（`system-reminder`）；这使外框元素成为重复标题信息的原始 XML 噪声。
-
-## 决策
-
-注入上下文渲染为 `ContextCardComponent`（`packages/ui/tui/src/components/transcript.ts`）。这是一个可折叠的暗色卡片，与工具卡片共用 `Ctrl+O` 切换操作，初始状态为折叠。其标题仍是暗色的 `Context · <label>` 行。正文是去掉多余外框行后、以暗色文本按行渲染的消息内容：来源标签已经指明上下文，因此正文直接从指令内容开始，不再显示 `system-reminder` 行。正文通过共用的 `preview` 辅助函数折叠到卡片的 `maxToolOutputLines` 行数限额，并显示 `… +N lines (Ctrl+O to expand)` 标记。折叠与去外框都不依赖载荷的语法（[与内容无关的折叠](../bug-fix/2026-07-28-context-card-content-independent-fold.md)、[渲染为文本](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)）；本记录最初的实现是把两者都走 `renderUnknownXml`。
-
-`Ctrl+O` 让共享的 `toggleTools` 处理器在三种状态间循环——折叠预览、展开、隐藏——与 Codex 的行为一致：隐藏阶段把工具卡片（连同卡片自渲染的前导空行）从 transcript 中完全去掉。上下文卡片承载的是注入指令而非工具流量，因此从不隐藏；隐藏阶段对它们呈现为折叠预览。通知文本按状态命名（`Tool and context cards {collapsed|expanded}.` / `Tool cards hidden.`），`/help` 中的快捷键说明为 `Ctrl+O cycle cards (collapse/expand/hide)`。`renderEvent` 将每张上下文卡片记录在 `contextCards` 集合中，与 `allToolCards` 并列；`rebuildTranscript` 会清空该集合。
-
-标签派生逻辑可以处理非对象形态的来源（既不是会话引用卡片也不是对象的无效注入来源）：系统会回退到通用的 `context` 标题，而不会从非对象值中解引用 `plugin`／`kind`。`sessionReferenceCard` 分支（引用会话的单行条目）保持不变，其中没有可折叠内容。
-
-此变更仅限于 TUI。它涉及 `transcript.ts` 中 `ContextCardComponent`／`ToolCardComponent` 的连接，以及 `packages/ui/tui/src/index.ts` 中的 `renderEvent`／`toggleTools`／帮助信息路径。生产方、会话事件和其他 UI 桥接层（ACP、JSON-RPC）均无需变更；折叠方式属于 TUI 的局部实现，并非跨包契约。
-
-## 考虑过的替代方案
-
-**保持上下文卡片完全展开，仅去掉根元素行。** 不予采纳：最主要的问题是较大的 `workspace-context` 提醒无法像工具卡片一样折叠。只去掉多余的外框行，仍无法解决 transcript 占用问题。
-
-**为上下文卡片设置独立快捷键，与工具卡片分开。** 不予采纳，选择共享 `Ctrl+O`：统一按键符合现有认知模式，无需学习或记录新的按键；两类卡片的折叠目的相同，都是减少 transcript 噪声。循环的隐藏阶段只作用于工具卡片，理由与共享按键成立的理由相同：隐藏注入指令会移除用户无法从其他卡片找回的内容。
-
-**在 `renderUnknownXml` 内统一隐藏根元素行。** 不予采纳：`renderUnknownXml` 还用于渲染未知的工具结果，此时根元素具有实际意义。隐藏根元素是上下文卡片的呈现选择，应由 `ContextCardComponent` 负责，从而保持工具卡片路径不变。
-
-## 后果
-
-`workspace-context` 提醒可以通过折叠工具卡片的同一个 `Ctrl+O` 折叠，其正文也不再在标题下方显示多余的 `system-reminder` 外框行。代价是共享循环逻辑需要额外跟踪第二种卡片，并为无效注入来源增加一小段标签形态回退逻辑。由于此变更仅限于 TUI transcript，ACP 和 JSON-RPC 桥接层会保留各自的注入上下文呈现方式。
-
-## 测试
-
-`packages/ui/tui/tests/tui.spec.ts` 固定以下行为：上下文卡片默认折叠并显示 `Ctrl+O to expand` 标记；按下 `Ctrl+O` 后展开，并显示 `Tool and context cards expanded.` 通知；在隐藏阶段以折叠预览存活、而工具卡片在重绘后消失；第四次按键回到 `collapsed`；不显示 `system-reminder` 外框行；将不带外框的上下文渲染为暗色文本；空外框只渲染标题。`packages/ui/tui/tests/snapshots/` 下的无密钥终端快照通过实际组装的 TUI 和伪终端渲染，并已重新录制；其中展示了不带外框元素的上下文卡片、更新后的切换通知，以及更新后的 `/help` 快捷键说明。
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
deleted file mode 100644
index 9c59295fa9..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.i18n.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
-2026-07-28-tui-uniform-dim-card-body.md: 571ae517b508e0ca49571237dfe96d9b710f8721
-2026-07-28-tui-uniform-dim-card-body.zh.md: 4b776d3ade411e1ef6e18c527907457ea719bfba
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
deleted file mode 100644
index 571ae517b5..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Agent Note: One dim tone for the whole TUI tool-card body
-
-Status: implemented
-
-English | [中文](2026-07-28-tui-uniform-dim-card-body.zh.md)
-
-## Problem
-
-[Dimming tool-result output](2026-07-28-tui-dim-tool-result-output.md) split a tool card into framing that keeps its own color and output that renders dim. In a real transcript that split read as scatter rather than structure, because the framing rows are not one color: a generic card's presenter title (`Read src/foo.ts (95 - 149)`, `Update todo list`) stayed at the terminal's default foreground, a terminal card's `$` command was cyan, its cwd was dim, and the output below was dim. Three tones in four consecutive rows, and the brightest one — plain default foreground, which reads as solid black on a light scheme — sat on the least informative row.
-
-An unknown tool's XML tree was worse, and is what surfaced the problem. `renderUnknownXml` styled element names through its `label` callback but emitted text content with no styling at all, while the card's collapsed `… +N lines (Ctrl+O to expand)` marker was dim. The card body therefore mixed unstyled black content rows with a dim fold hint, so the hint looked like it belonged to a different element than the text it summarized. The same undifferentiated-body complaint the earlier note set out to fix had reappeared one level down, inside the body.
-
-The underlying reason is that the two roles are indistinguishable on one of the two supported schemes. `dim` is SGR 2 on a dark scheme but ANSI 90 on a light one, exactly what `muted` always is, so a body that mixes `dim`, `muted`, and unstyled rows collapses to two tones on light terminals and three on dark — a difference that reads as inconsistency rather than as meaning.
-
-## Decision
-
-A tool card's body is one dim tone end to end. The card's only colored row is its `Tool / <name>` header, which carries call status (warning pending, success ok, error). The presenter title, a terminal card's `$` command line and its cwd, the tool's own output, an XML tree's text content, and the collapsed fold marker all render through the `dim` role.
-
-Two exceptions keep color where color is the meaning rather than emphasis: a diff card's `+`/`-` lines and per-file path headers, whose red and green *are* the diff, and a terminal card's `[signal …]` marker, which reports abnormal termination. An XML tree's element names stay `muted`, one shade off body text, because they are structure a reader navigates by rather than content.
-
-`renderUnknownXml` takes a `body` styler beside its existing `label` styler and applies it to every text row — `textBlock`'s lines and the single-line `<tag>: value` form's value. Its one caller, the unknown-tool card, passes the card's body tone (`dim`), so tree content matches the rows around it instead of falling back to the default foreground.
-
-`ContextCardComponent` renders [injected context as prose](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md) rather than parsing it, and its body moves from `muted` to `dim` for the same reason the tool cards changed: the card's header and fold marker are already `dim`, so a `muted` body was the one row group that did not match.
-
-`ToolCardComponent.dimPastPrelude` becomes `dimBody`: it still renders prelude and result as one Markdown document so the document's own block spacing survives, but dims every row rather than only those past the prelude's row count. That deletes the second Markdown render the old row-counting split needed, since there is no longer a boundary to locate. A whitespace-only row stays unwrapped, keeping Markdown's padding out of the styled ranges, and the terminal branch's blank rows stay the empty string so its `filter(Boolean)` still drops them.
-
-## Alternatives considered
-
-**Keep the framing/output split and just fix the XML tree.** Rejected: it addresses the reported symptom and leaves the cause. The split's premise is that framing shares one color, which was never true — the presenter title, the cyan `$` command, and the dim cwd are three tones — so every future framing row reopens the same question.
-
-**Give the presenter title its own role (bold, or accent).** Rejected: it adds a fourth tone to the row the user identified as noise. The header already names the tool, so the title is a detail line, not a heading; emphasizing it competes with the status color directly above it.
-
-**Keep the `$` command cyan as a scan anchor.** Considered and explicitly declined by the user in favor of a uniform body. The `$ ` prefix and the header's `/ <description>` segment already locate the command, so the color was redundant with two other cues.
-
-**Make `dim` and `muted` visually distinct on light schemes so the existing three-tone body reads as structure.** Rejected: the palette is built from the 16-color ANSI set precisely so terminals remap it, and the only tones reliably dimmer than default foreground on both schemes are the two that already collapse. Manufacturing a third would mean fixed shades, which the palette contract forbids.
-
-**Dim diff `+`/`-` lines too, for a fully monochrome transcript.** Rejected: a diff's colors carry its semantics, and the leading `+`/`-` character alone is a weaker signal that a reader must parse rather than see.
-
-## Consequences
-
-A card now reads as one colored header over a recessed block, and a transcript of many calls scans as a column of status headers. The user-visible change is that presenter titles, `$` commands, and XML tree content lost their distinct tones; the reported scatter goes with them.
-
-`dimBody` renders a generic card's Markdown once per frame instead of twice, so the earlier note's stated cost is gone. Because `dim` is an SGR attribute on dark schemes rather than a color, a result's Markdown role colors (headings, inline code) still show through underneath it, so a dim body keeps its internal structure on dark terminals; on light schemes `dim` resolves to ANSI 90 and those roles read against gray instead.
-
-The `renderUnknownXml` signature gained a required parameter, so its caller and its unit test pass a body styler; there is no default, because a caller that forgets one is exactly the bug this note fixes. The treatment stays TUI-local: no presenter, palette role, or `presentation.ts` type changed, and the ACP and JSON-RPC bridges keep their own tool-call presentation.
-
-## Testing
-
-`packages/ui/tui/tests/xml-tool-output.spec.ts` asserts the body tone through a distinct `[body]…[/body]` marker on every text row, so a regression that drops the styler fails rather than silently rendering unstyled text. It also pins that an interior blank line stays the empty string, since styling it would emit an escape-only row that reads as a stray indented blank.
-
-The keyless terminal snapshots under `packages/ui/tui/tests/snapshots/` and `examples/tui-agent/tests/snapshots/` were refreshed from committed replay scripts. Their diffs are style ranges only: `fg=cyan` and `fg=bright-black` rows become `dim`, and rows that previously carried no style gain it — covering bash output, read output, `run_code`, `workflow`, `subagent`, `todo_write`, `cordis_*`, and injected-context prose, while the diff cards' `+`/`-` ranges are unchanged.
diff --git a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md b/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md
deleted file mode 100644
index 4b776d3ade..0000000000
--- a/.agents/notes/implemented/feature/2026-07-28-tui-uniform-dim-card-body.zh.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Agent Note: TUI 工具卡片正文统一使用暗色调
-
-Status: implemented
-
-[English](2026-07-28-tui-uniform-dim-card-body.md) | 中文
-
-## Problem
-
-[将工具结果输出变暗](2026-07-28-tui-dim-tool-result-output.md)把工具卡片划分为保留自身颜色的框架和以暗色渲染的输出。在真实 transcript（文本记录）中，这种划分呈现的是颜色散乱而非结构层次，因为各框架行并非同一种颜色：generic 卡片的 presenter 标题（`Read src/foo.ts (95 - 149)`、`Update todo list`）保留终端的默认前景色，终端卡片的 `$` 命令为青色，cwd 为暗色，下方输出也是暗色。连续四行中出现三种色调，而最亮的默认前景色在浅色方案中呈现为纯黑色，却落在信息量最少的一行。
-
-未知工具的 XML 树问题更为明显，也正是它暴露了这个缺陷。`renderUnknownXml` 通过 `label` 回调设置元素名的样式，却完全不为文本内容设置样式，而卡片折叠后的 `… +N lines (Ctrl+O to expand)` 标记为暗色。因此，卡片正文混合了无样式的黑色内容行和暗色的折叠提示，使提示看起来与它所概括的文本不属于同一个元素。此前说明要解决的正文无法区分问题又在正文内部重现了一层。
-
-根本原因在于，这两种角色在两套受支持的方案之一中无法区分。在深色方案中，`dim` 是 SGR 2；在浅色方案中则是 ANSI 90，与 `muted` 始终使用的样式完全相同。因此，混合 `dim`、`muted` 和无样式行的正文在浅色终端上呈现两种色调，在深色终端上呈现三种色调；这种差异体现为不一致，而非含义。
-
-## Decision
-
-工具卡片的正文从头到尾统一使用一种暗色调。卡片中唯一带颜色的行是 `Tool / <name>` 表头，它承载调用状态：挂起时为 warning、成功时为 success、错误时为 error。presenter 标题、终端卡片的 `$` 命令行及 cwd、工具自身的输出、XML 树的文本内容和折叠标记均通过 `dim` 角色渲染。
-
-有两项例外会保留颜色，因为颜色在这些位置承载含义，而非强调：diff 卡片的 `+`/`-` 行和各文件路径表头，其红色与绿色本身就是 diff；终端卡片的 `[signal …]` 标记则报告异常终止。XML 树的元素名保持 `muted`，与正文文本相差一档，因为它们是供读者定位的结构，而非内容。
-
-`renderUnknownXml` 接收一个 `body` 样式函数，与既有的 `label` 样式函数并列，并将其应用于每一个文本行，包括 `textBlock` 的各行以及单行 `<tag>: value` 形式中的值。它唯一的调用方——未知工具卡片——传入卡片的正文色调（`dim`），使树的内容与周围各行保持一致，而不会回退到默认前景色。
-
-`ContextCardComponent` 将[注入上下文渲染为散文](../bug-fix/2026-07-28-context-cards-render-prose-not-xml.md)而不对其解析，其正文也从 `muted` 改为 `dim`，原因与工具卡片相同：该卡片的表头与折叠标记本已是 `dim`，因此 `muted` 正文是卡片中唯一不匹配的行组。
-
-`ToolCardComponent.dimPastPrelude` 更名为 `dimBody`：它仍将 prelude 与结果作为同一个 Markdown 文档渲染，使文档自身的块间距得以保留，但现在会将每一行变暗，而非只处理 prelude 行数之后的内容。由于不再需要定位边界，旧的行数划分所需的第二次 Markdown 渲染也随之删除。仅含空白字符的行仍不添加样式包装，使 Markdown 的填充不会进入样式范围；终端分支的空白行仍为空字符串，因此其 `filter(Boolean)` 仍会将其丢弃。
-
-## Alternatives considered
-
-**保留框架/输出划分，只修复 XML 树。** 已否决：这只处理了报告的症状，未解决根因。该划分的前提是框架共用一种颜色，但实际从来不是如此：presenter 标题、青色的 `$` 命令和暗色的 cwd 使用三种色调，因此以后每增加一种框架行都会再次引出同一个问题。
-
-**为 presenter 标题设置专属角色（粗体或强调色）。** 已否决：这会在用户认为形成噪声的行上增加第四种色调。表头已经给出工具名称，因此标题是细节行而非标题行；强调它会与正上方的状态色争夺注意力。
-
-**保留青色的 `$` 命令，将其作为扫读定位点。** 用户考虑过此方案，但明确选择统一正文并否决了它。`$ ` 前缀和表头中的 `/ <description>` 段已经可以定位命令，因此该颜色与另外两个提示重复。
-
-**使 `dim` 和 `muted` 在浅色方案中呈现明显差异，让既有的三色正文体现结构。** 已否决：调色板特意基于 16 色 ANSI 色集构建，以便终端重新映射颜色；在两种方案中都能可靠弱于默认前景色的只有目前已经重合的两种色调。制造第三种色调需要使用固定色值，而调色板契约禁止这样做。
-
-**也将 diff 的 `+`/`-` 行变暗，使 transcript 完全单色。** 已否决：diff 的颜色承载其语义，而仅依靠开头的 `+`/`-` 字符是更弱的信号，读者必须解析字符才能理解，无法直接从颜色识别。
-
-## Consequences
-
-卡片现在呈现为一行带颜色的表头，下接一个弱化的正文块；包含大量调用的 transcript 扫读起来则是一列状态表头。用户可见的变化是 presenter 标题、`$` 命令和 XML 树内容不再使用各自独立的色调，此前报告的颜色散乱也随之消失。
-
-`dimBody` 每帧只渲染一次 generic 卡片的 Markdown，而非两次，因此此前说明中记录的代价已经消除。由于深色方案中的 `dim` 是 SGR 属性而非颜色，结果中的 Markdown 角色颜色（标题、内联代码）仍能在其下显示，所以暗色正文在深色终端上仍保留内部结构；在浅色方案中，`dim` 解析为 ANSI 90，这些角色则以灰色为基础呈现。
-
-`renderUnknownXml` 的签名新增了一个必需参数，因此其调用方及其单元测试均传入正文样式函数；这里不提供默认值，因为调用方忘记传入该参数，正是本文要修复的缺陷。此处理仍仅限 TUI：没有更改任何 presenter、调色板角色或 `presentation.ts` 类型，ACP 和 JSON-RPC 桥接层继续使用各自的工具调用呈现方式。
-
-## Testing
-
-`packages/ui/tui/tests/xml-tool-output.spec.ts` 通过每个文本行上的 `[body]…[/body]` 专用标记断言正文色调，因此遗漏样式函数的回归会导致测试失败，而不会静默渲染为无样式文本。它还固定了内部空行仍为空字符串，因为为其设置样式会产生一个只含转义序列的行，读起来像一个多余的缩进空行。
-
-`packages/ui/tui/tests/snapshots/` 和 `examples/tui-agent/tests/snapshots/` 下的无密钥终端快照已通过提交到仓库的回放脚本刷新。差异仅涉及样式范围：将 `fg=cyan` 和 `fg=bright-black` 行改为 `dim`，并为之前没有样式的行添加 `dim`；覆盖 bash 输出、read 输出、`run_code`、`workflow`、`subagent`、`todo_write`、`cordis_*` 以及注入上下文散文，而 diff 卡片的 `+`/`-` 范围保持不变。