fix(agent): publish correlated names for unnamed tool results

test(plugin-ai): deliver pagehide before closing fixture
merge: integrate verified plugin foundation into global Agent
2026-10-30 02:21:47 +00:00 · 2026-10-27 16:40:23 +00:00 · 2026-10-27 15:05:30 +00:00 · 2026-10-27 14:56:42 +00:00 · 2026-10-27 14:29:42 +00:00 · 2026-10-27 14:26:01 +00:00
120 changed files with 3923 additions and 209 deletions
@@ -582,6 +582,8 @@ Highlight the focused split pane:
  'settings.appearance.uiFont.desc': 'Choose the font for the application interface',
  'settings.appearance.windowOpacity': 'Window Opacity',
  'settings.appearance.windowOpacity.desc': 'Adjust the transparency of the entire application window. Lower values also fade terminal text. Some Linux desktop environments may not support this.',
+  'settings.appearance.windowBackgroundBlur': 'Frosted glass background',
+  'settings.appearance.windowBackgroundBlur.desc': 'Blur the desktop behind the window. At 100% opacity the effect is hidden, but your choice is preserved.',
  'settings.appearance.appIcon': 'App Icon',
  'settings.appearance.appIcon.desc': 'Choose a dock/taskbar icon style to make Netcatty easier to spot when switching apps. On Windows, the notification area icon uses the same style. Applies at runtime; the installed app bundle icon is unchanged.',
  'settings.appearance.appIcon.original': 'Original',
@@ -1262,6 +1264,8 @@ Highlight the focused split pane:
  'deepLink.jms.unsupported': 'Unsupported JumpServer protocol: {{protocol}}',
  'settings.tab.plugins': 'Plugins',
  "settings.plugins.manager.installed": "Installed plugins",
+  "settings.plugins.author.official": "Official maintainer",
+  "settings.plugins.author.officialMeaning": "Maintained by the Netcatty project. This is not a safety certification.",
  "settings.plugins.manager.import": "Import .ncpkg",
  "settings.plugins.manager.preview": "Imported packages stay disabled until you review and enable them.",
  "settings.plugins.manager.empty": "Import a local plugin package to get started.",
@@ -1419,7 +1423,7 @@ Highlight the focused split pane:
  'plugins.authentication.responseFailedWithMessage': 'Could not send the authentication response: {message}. Try again or cancel the request.',
  'plugins.authentication.continue': 'Continue',
  'plugins.hostActions.select': 'Share selected host metadata',
-  'plugins.hostActions.selectionNote': 'Share saved labels, addresses, usernames, protocols, groups and tags with this plugin. Group selection includes only the hosts selected now. Connecting requires a separate confirmation.',
+  'plugins.hostActions.selectionNote': 'Only the selected hosts\' saved labels, addresses, usernames, protocols, groups and tags are shared. Group selection includes only the hosts selected now. Later edit or connection requests follow this plugin\'s permission settings.',
  'plugins.hostActions.create': 'Review host draft',
  'plugins.hostActions.edit': 'Review host changes',
  'plugins.hostActions.connect': 'Confirm connection',
@@ -582,6 +582,8 @@ Resalta el panel dividido enfocado:
  'settings.appearance.uiFont.desc': 'Elige la fuente para la interfaz de la aplicación',
  'settings.appearance.windowOpacity': 'Opacidad de la ventana',
  'settings.appearance.windowOpacity.desc': 'Ajusta la transparencia de toda la ventana de la aplicación. Los valores más bajos también atenúan el texto de la terminal. Algunos entornos de escritorio de Linux pueden no admitir esto.',
+  'settings.appearance.windowBackgroundBlur': 'Fondo de cristal esmerilado',
+  'settings.appearance.windowBackgroundBlur.desc': 'Desenfoca el escritorio detrás de la ventana. Con una opacidad del 100 %, el efecto no es visible, pero se conserva tu elección.',
  'settings.appearance.appIcon': 'Ícono de la aplicación',
  'settings.appearance.appIcon.desc': 'Elige un estilo de ícono para el dock o la barra de tareas que haga más fácil distinguir Netcatty al cambiar de aplicación. En Windows, el icono del área de notificación usa el mismo estilo. Se aplica en tiempo de ejecución; el ícono del paquete instalado no cambia.',
  'settings.appearance.appIcon.original': 'Original',
@@ -1261,6 +1263,8 @@ Resalta el panel dividido enfocado:
  'deepLink.jms.invalid': 'Enlace JumpServer inválido',
  'deepLink.jms.unsupported': 'Protocolo JumpServer no compatible: {{protocol}}',
  'settings.tab.plugins': 'Plugins',
+  "settings.plugins.author.official": "Mantenimiento oficial",
+  "settings.plugins.author.officialMeaning": "Mantenido por el proyecto Netcatty. No es una certificación de seguridad.",
  "settings.plugins.manager.installed": "Plugins instalados",
  "settings.plugins.manager.import": "Importar .ncpkg",
  "settings.plugins.manager.preview": "Los paquetes importados permanecen desactivados hasta que los revises y actives.",
@@ -1419,7 +1423,7 @@ Resalta el panel dividido enfocado:
  'plugins.authentication.responseFailedWithMessage': 'No se pudo enviar la respuesta de autenticación: {message}. Inténtalo de nuevo o cancela la solicitud.',
  'plugins.authentication.continue': 'Continuar',
  'plugins.hostActions.select': 'Compartir metadatos de los equipos seleccionados',
-  'plugins.hostActions.selectionNote': 'Comparte nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados con este complemento. Los grupos solo incluyen los equipos seleccionados ahora. Conectar requiere otra confirmación.',
+  'plugins.hostActions.selectionNote': 'Solo se comparten los nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados de los equipos seleccionados. Los grupos solo incluyen los equipos seleccionados ahora. Las solicitudes posteriores de edición o conexión siguen los permisos de este complemento.',
  'plugins.hostActions.create': 'Revisar borrador de equipo',
  'plugins.hostActions.edit': 'Revisar cambios del equipo',
  'plugins.hostActions.connect': 'Confirmar conexión',
@@ -525,6 +525,8 @@ export const ruCoreMessages: Messages = {
  'settings.appearance.uiFont.desc': 'Выберите шрифт для интерфейса приложения',
  'settings.appearance.windowOpacity': 'Прозрачность окна',
  'settings.appearance.windowOpacity.desc': 'Настройте прозрачность всего окна приложения. При низких значениях текст терминала тоже бледнеет. В некоторых средах Linux это может не поддерживаться.',
+  'settings.appearance.windowBackgroundBlur': 'Матовое стекло',
+  'settings.appearance.windowBackgroundBlur.desc': 'Размывает рабочий стол за окном. При непрозрачности 100 % эффект не виден, но ваш выбор сохраняется.',
  'settings.appearance.appIcon': 'Значок приложения',
  'settings.appearance.appIcon.desc': 'Выберите стиль значка для Dock/панели задач, чтобы Netcatty было проще найти при переключении приложений. В Windows значок области уведомлений использует тот же стиль. Применяется во время работы; значок установленного пакета не меняется.',
  'settings.appearance.appIcon.original': 'Оригинал',
@@ -1130,6 +1132,8 @@ export const ruCoreMessages: Messages = {
  'deepLink.jms.unsupported': 'Неподдерживаемый протокол JumpServer: {{protocol}}',

  'settings.tab.plugins': 'Плагины',
+  "settings.plugins.author.official": "Официальная поддержка",
+  "settings.plugins.author.officialMeaning": "Поддерживается проектом Netcatty. Это не сертификат безопасности.",
  "settings.plugins.manager.installed": "Установленные плагины",
  "settings.plugins.manager.import": "Импорт .ncpkg",
  "settings.plugins.manager.preview": "Импортированные пакеты отключены до проверки и включения.",
@@ -1284,7 +1288,7 @@ export const ruCoreMessages: Messages = {
  'plugins.authentication.responseFailedWithMessage': 'Не удалось отправить ответ аутентификации: {message}. Повторите попытку или отмените запрос.',
  'plugins.authentication.continue': 'Продолжить',
  'plugins.hostActions.select': 'Передать метаданные выбранных хостов',
-  'plugins.hostActions.selectionNote': 'Плагину будут переданы сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Подключение требует отдельного подтверждения.',
+  'plugins.hostActions.selectionNote': 'Передаются только метаданные выбранных хостов: сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Дальнейшие запросы изменения или подключения зависят от настроек разрешений плагина.',
  'plugins.hostActions.create': 'Проверить черновик хоста',
  'plugins.hostActions.edit': 'Проверить изменения хоста',
  'plugins.hostActions.connect': 'Подтвердить подключение',
@@ -29,6 +29,16 @@ const ALL_SETTINGS_LOCALES = [
  ...LOCALIZED_SETTINGS_LOCALES,
 ];

+test("Host selection disclosure describes later permission-controlled actions without promising another confirmation", () => {
+  const permissionWords: Record<string, RegExp> = { en: /permission settings/i, es: /permisos/i, ru: /разрешени/u, 'zh-CN': /权限设置/u, 'zh-TW': /權限設定/u };
+  const oldPromise = /requires a separate confirmation|requiere otra confirmación|требует отдельного подтверждения|需要单独确认|需要另外確認/iu;
+  for (const locale of ALL_SETTINGS_LOCALES) {
+    const note = locale.messages['plugins.hostActions.selectionNote'];
+    assert.match(note, permissionWords[locale.name], locale.name);
+    assert.doesNotMatch(note, oldPromise, locale.name);
+  }
+});
+
 test("localized settings include names for every default shortcut", () => {
  for (const locale of ALL_SETTINGS_LOCALES) {
    const missing = DEFAULT_KEY_BINDINGS
@@ -586,6 +586,8 @@ Vaults 标签保持扁平，不使用这块背景。
  'settings.appearance.uiFont.desc': '选择软件界面使用的字体',
  'settings.appearance.windowOpacity': '窗口透明度',
  'settings.appearance.windowOpacity.desc': '调节整个应用窗口的透明度，方便叠在其他内容上方。较低时终端文字也会变淡；部分 Linux 桌面环境可能不支持。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊窗口后方的桌面。100% 不透明时效果不可见，但会保留你的开关设置。',
  'settings.appearance.appIcon': '应用图标',
  'settings.appearance.appIcon.desc': '选择 Dock/任务栏图标风格，切换应用时更容易找到 Netcatty。Windows 通知区域图标会使用同一套风格。运行时生效，安装包内的图标不会改变。',
  'settings.appearance.appIcon.original': '原始',
@@ -1177,6 +1179,8 @@ Vaults 标签保持扁平，不使用这块背景。
  'qs.default': '默认',
  'settings.tab.plugins': '插件',
  "settings.plugins.manager.installed": "已安装插件",
+  "settings.plugins.author.official": "官方维护",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 项目维护。这不是安全认证。",
  "settings.plugins.manager.import": "导入 .ncpkg",
  "settings.plugins.manager.preview": "导入的插件保持停用，请检查后再启用。",
  "settings.plugins.manager.empty": "导入本地插件包以开始使用。",
@@ -1334,7 +1338,7 @@ Vaults 标签保持扁平，不使用这块背景。
  'plugins.authentication.responseFailedWithMessage': '无法发送认证响应：{message}。请重试或取消此请求。',
  'plugins.authentication.continue': '继续',
  'plugins.hostActions.select': '分享所选主机的元数据',
-  'plugins.hostActions.selectionNote': '向此插件分享已保存的名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。连接主机需要单独确认。',
+  'plugins.hostActions.selectionNote': '仅向此插件共享所选主机的元数据：名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。后续编辑或连接请求遵循此插件的权限设置。',
  'plugins.hostActions.create': '预览主机草稿',
  'plugins.hostActions.edit': '预览主机修改',
  'plugins.hostActions.connect': '确认连接',
@@ -588,6 +588,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
  'settings.appearance.uiFont.desc': '選擇軟體介面使用的字型',
  'settings.appearance.windowOpacity': '視窗透明度',
  'settings.appearance.windowOpacity.desc': '調節整個應用程式視窗的透明度，方便疊在其他內容上方。較低時終端文字也會變淡；部分 Linux 桌面環境可能不支援。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊視窗後方的桌面。100% 不透明時效果不可見，但會保留你的開關設定。',
  'settings.appearance.appIcon': '應用程式圖示',
  'settings.appearance.appIcon.desc': '選擇 Dock/工作列圖示風格，切換應用程式時更容易找到 Netcatty。Windows 通知區域圖示會使用同一套風格。執行時生效，安裝檔內的圖示不會改變。',
  'settings.appearance.appIcon.original': '原始',
@@ -1179,6 +1181,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
  'qs.default': '預設',

  'settings.tab.plugins': '外掛程式',
+  "settings.plugins.author.official": "官方維護",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 專案維護。這不是安全認證。",
  "settings.plugins.manager.installed": "已安裝插件",
  "settings.plugins.manager.import": "導入 .ncpkg",
  "settings.plugins.manager.preview": "導入的插件保持停用，請檢查後再啟用。",
@@ -1337,7 +1341,7 @@ Vaults 分頁維持扁平，不使用這塊背景。
  'plugins.authentication.responseFailedWithMessage': '無法送出驗證回應：{message}。請重試或取消此要求。',
  'plugins.authentication.continue': '繼續',
  'plugins.hostActions.select': '分享所選主機的中繼資料',
-  'plugins.hostActions.selectionNote': '向此外掛分享已儲存的名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。連線需要另外確認。',
+  'plugins.hostActions.selectionNote': '僅向此外掛分享所選主機的中繼資料：名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。後續編輯或連線請求遵循此外掛的權限設定。',
  'plugins.hostActions.create': '預覽主機草稿',
  'plugins.hostActions.edit': '預覽主機修改',
  'plugins.hostActions.connect': '確認連線',
@@ -49,6 +49,7 @@ import {
  STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN,
  STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN_TAB,
  STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
  STORAGE_KEY_APP_ICON_VARIANT,
  STORAGE_KEY_HTTP_NETWORK_PROXY,
  STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
@@ -99,6 +100,7 @@ interface UseSettingsIpcSyncParams {
  setIsHotkeyRecordingState: Dispatch<SetStateAction<boolean>>;
  setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
  setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
  setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
  setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
  setAutoLaunchEnabled: Dispatch<SetStateAction<boolean>>;
@@ -148,6 +150,7 @@ export function useSettingsIpcSync({
  setIsHotkeyRecordingState,
  setGlobalHotkeyEnabled,
  setWindowOpacity,
+  setWindowBackgroundBlur,
  setAppIconVariant,
  setAutoUpdateEnabled,
  setAutoLaunchEnabled,
@@ -279,6 +282,9 @@ export function useSettingsIpcSync({
      if (key === STORAGE_KEY_WINDOW_OPACITY) {
        setWindowOpacity(value);
      }
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && typeof value === 'boolean') {
+        setWindowBackgroundBlur((prev) => (prev === value ? prev : value));
+      }
      if (key === STORAGE_KEY_APP_ICON_VARIANT) {
        const nextVariant = resolveAppIconVariant(value);
        setAppIconVariant((prev) => (prev === nextVariant ? prev : nextVariant));
@@ -371,6 +377,7 @@ export function useSettingsIpcSync({
    setFollowAppTerminalThemeState,
    setGlobalHotkeyEnabled,
    setWindowOpacity,
+    setWindowBackgroundBlur,
    setAppIconVariant,
    setHotkeyScheme,
    setIsHotkeyRecordingState,
@@ -53,6 +53,7 @@ import {
  STORAGE_KEY_UI_LANGUAGE,
  STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
  STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
  STORAGE_KEY_APP_ICON_VARIANT,
 } from '../../infrastructure/config/storageKeys';
 import { resolveAppIconVariant, type AppIconVariant } from '../../domain/appIconVariant';
@@ -116,6 +117,7 @@ interface UseSettingsStorageSyncParams {
  globalHotkeyEnabled: boolean;
  autoUpdateEnabled: boolean;
  windowOpacity: number;
+  windowBackgroundBlur: boolean;
  appIconVariant: AppIconVariant;
  setTheme: Dispatch<SetStateAction<'dark' | 'light' | 'system'>>;
  setLightUiThemeId: Dispatch<SetStateAction<string>>;
@@ -166,6 +168,7 @@ interface UseSettingsStorageSyncParams {
  setExplorerContextMenuEnabledState: (enabled: boolean) => void;
  setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
  setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
  setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
  setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
  setWorkspaceFocusStyleState: Dispatch<SetStateAction<'dim' | 'border'>>;
@@ -184,7 +187,7 @@ export function useSettingsStorageSync({
  sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
  showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
  editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
  setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode, applyIncomingCustomAccent,
  setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
  setTerminalThemeId, setTerminalThemeDarkId, setTerminalThemeLightId,
@@ -193,7 +196,7 @@ export function useSettingsStorageSync({
  setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
  setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
  setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState, setJmsDeepLinkEnabledState, setExplorerContextMenuEnabledState,
-  setGlobalHotkeyEnabled, setWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+  setGlobalHotkeyEnabled, setWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
  setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
  applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
 }: UseSettingsStorageSyncParams) {
@@ -208,7 +211,7 @@ export function useSettingsStorageSync({
    sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
    showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
    editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
  });
  settingsSnapshotRef.current = {
    theme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentVersion,
@@ -218,7 +221,7 @@ export function useSettingsStorageSync({
    sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
    showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
    editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
  };

  // Listen for storage changes from other windows (cross-window sync)
@@ -523,6 +526,12 @@ export function useSettingsStorageSync({
      if (e.key === STORAGE_KEY_WINDOW_OPACITY && e.newValue !== null) {
        setWindowOpacity(e.newValue);
      }
+      if (e.key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && e.newValue !== null) {
+        const newValue = e.newValue === 'true';
+        if (newValue !== s.windowBackgroundBlur) {
+          setWindowBackgroundBlur(newValue);
+        }
+      }
      if (e.key === STORAGE_KEY_APP_ICON_VARIANT && e.newValue !== null) {
        const newValue = resolveAppIconVariant(e.newValue);
        if (newValue !== s.appIconVariant) {
@@ -566,6 +575,7 @@ export function useSettingsStorageSync({
    setGlobalHotkeyEnabled,
    setHostClickBehaviorState,
    setWindowOpacity,
+    setWindowBackgroundBlur,
    setAppIconVariant,
    setHotkeyScheme,
    setLightUiThemeId,
@@ -7,6 +7,7 @@ import {
  STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
  STORAGE_KEY_TOGGLE_WINDOW_HOTKEY,
  STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
  STORAGE_KEY_APP_ICON_VARIANT,
  STORAGE_KEY_HTTP_NETWORK_PROXY,
 } from '../../infrastructure/config/storageKeys';
@@ -17,6 +18,8 @@ import {
 } from '../../domain/httpNetworkProxy';
 import { localStorageAdapter } from '../../infrastructure/persistence/localStorageAdapter';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { isMacPlatform } from '../../lib/utils';
+import { isWindowBackgroundBlurActive } from '../../domain/windowBackgroundBlur';
 import {
  parseWindowOpacityRecord,
  serializeWindowOpacityRecord,
@@ -47,6 +50,7 @@ interface UseSystemSettingsEffectsParams {
  autoLaunchEnabled: boolean;
  windowOpacityRecord: WindowOpacityRecord;
  windowOpacityMutationSourceRef: MutableRefObject<WindowOpacityMutationSource>;
+  windowBackgroundBlur: boolean;
  appIconVariant: AppIconVariant;
  autoUpdateEnabled: boolean;
  httpNetworkProxy: HttpNetworkProxySettings;
@@ -68,6 +72,7 @@ export function useSystemSettingsEffects({
  autoLaunchEnabled,
  windowOpacityRecord,
  windowOpacityMutationSourceRef,
+  windowBackgroundBlur,
  appIconVariant,
  autoUpdateEnabled,
  httpNetworkProxy,
@@ -300,6 +305,49 @@ export function useSystemSettingsEffects({
    persistMountedRef,
  ]);

+  // Window chrome also applies in detached sessions, independently of the
+  // OS-level effects disabled there (tray, global shortcuts, autolaunch, ...).
+  // Only the windows that own settings persistence drive the shared native
+  // state; detached/editor windows consume it (see applySharedWindowSetting).
+  useEffect(() => {
+    if (!enabled) return;
+    localStorageAdapter.writeBoolean(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+    if (!persistMountedRef.current) return;
+    notifySettingsChanged(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+  }, [
+    enabled,
+    windowBackgroundBlur,
+    notifySettingsChanged,
+    persistMountedRef,
+  ]);
+
+  const windowBackgroundBlurActive = isMacPlatform() && isWindowBackgroundBlurActive(
+    windowBackgroundBlur,
+    windowOpacityRecord.opacity,
+  );
+
+  // Applies in every app-content window, including detached sessions: the
+  // transparent backing only looks right when the renderer class matches the
+  // native vibrancy the main process put on that window.
+  useEffect(() => {
+    if (typeof document === 'undefined') return;
+    document.documentElement.classList.toggle('window-background-blur', windowBackgroundBlurActive);
+    document.documentElement.style.setProperty('--window-content-opacity', String(windowOpacityRecord.opacity));
+    return () => {
+      document.documentElement.classList.remove('window-background-blur');
+      document.documentElement.style.removeProperty('--window-content-opacity');
+    };
+  }, [windowBackgroundBlurActive, windowOpacityRecord.opacity]);
+
+  // setWindowBackgroundBlur is a main-process handler that retargets every
+  // app-content window, so a single owner must drive it.
+  useEffect(() => {
+    if (!enabled) return;
+    netcattyBridge.get()?.setWindowBackgroundBlur?.(windowBackgroundBlur).catch((err) => {
+      console.warn('[WindowBackgroundBlur] Failed to apply macOS vibrancy:', err);
+    });
+  }, [enabled, windowBackgroundBlur]);
+
  // Persist and sync app icon variant
  useEffect(() => {
    if (!enabled) return;
@@ -0,0 +1,139 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { JSDOM } from 'jsdom';
+
+import { STORAGE_KEY_WINDOW_BACKGROUND_BLUR } from '../../infrastructure/config/storageKeys';
+import { DEFAULT_HTTP_NETWORK_PROXY } from '../../domain/httpNetworkProxy';
+import { useSystemSettingsEffects } from './systemSettingsEffects';
+
+type Harness = {
+  dom: JSDOM;
+  params: Parameters<typeof useSystemSettingsEffects>[0];
+  bridgeRequests: boolean[];
+  blurNotifications: unknown[];
+  restore: () => void;
+};
+
+function setUp(enabled: boolean, windowBackgroundBlur: boolean): Harness {
+  const dom = new JSDOM('<html><body><div id="root"></div></body></html>', { url: 'http://localhost' });
+  Object.defineProperty(dom.window.navigator, 'platform', { value: 'MacIntel' });
+  const previousGlobals = new Map<string, PropertyDescriptor | undefined>();
+  const replacements = {
+    window: dom.window,
+    document: dom.window.document,
+    navigator: dom.window.navigator,
+    localStorage: dom.window.localStorage,
+    IS_REACT_ACT_ENVIRONMENT: true,
+  };
+  for (const [key, value] of Object.entries(replacements)) {
+    previousGlobals.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { value, configurable: true });
+  }
+  const bridgeRequests: boolean[] = [];
+  const blurNotifications: unknown[] = [];
+  Object.assign(dom.window, {
+    netcatty: {
+      setWindowBackgroundBlur: async (value: boolean) => { bridgeRequests.push(value); },
+    },
+  });
+  const noop = () => {};
+  const params: Parameters<typeof useSystemSettingsEffects>[0] = {
+    enabled,
+    toggleWindowHotkey: '',
+    globalHotkeyEnabled: false,
+    closeToTray: false,
+    showTrayIcon: false,
+    autoLaunchEnabled: false,
+    windowOpacityRecord: { opacity: 0.7, preferredOpacity: 0.7, version: 1 },
+    windowOpacityMutationSourceRef: { current: 'local' },
+    windowBackgroundBlur,
+    appIconVariant: 'original',
+    autoUpdateEnabled: false,
+    httpNetworkProxy: DEFAULT_HTTP_NETWORK_PROXY,
+    persistMountedRef: { current: true },
+    setHotkeyRegistrationError: noop,
+    setAutoUpdateEnabled: noop,
+    setAppIconVariant: noop,
+    setAutoLaunchEnabled: noop,
+    setAutoLaunchSupported: noop,
+    notifySettingsChanged: (key, value) => {
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) blurNotifications.push(value);
+    },
+  };
+  return {
+    dom,
+    params,
+    bridgeRequests,
+    blurNotifications,
+    restore: () => {
+      for (const [key, descriptor] of previousGlobals) {
+        if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+        else Reflect.deleteProperty(globalThis, key);
+      }
+      dom.window.close();
+    },
+  };
+}
+
+const Probe = (props: Parameters<typeof useSystemSettingsEffects>[0]) => {
+  useSystemSettingsEffects(props);
+  return null;
+};
+
+test('opacity changes and remounts preserve the chosen blur preference', async () => {
+  const harness = setUp(true, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    const opaqueParams = { ...params, windowOpacityRecord: { ...params.windowOpacityRecord, opacity: 1, version: 2 } };
+    await act(async () => { renderer!.update(React.createElement(Probe, opaqueParams)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    assert.deepEqual(bridgeRequests, [true]);
+    assert.deepEqual(blurNotifications, [true]);
+    await act(async () => { renderer!.unmount(); });
+    await act(async () => { renderer = create(React.createElement(Probe, opaqueParams)); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    await act(async () => { renderer!.update(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    await act(async () => { renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false })); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'false');
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.deepEqual(bridgeRequests, [true, true, false]);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});
+
+test('detached session windows only apply the blur class, never own the setting', async () => {
+  // Peer session windows run with enableSystemEffects off. They must still
+  // paint the transparent backing, but persistence, cross-window broadcast and
+  // the (all-windows) native vibrancy IPC stay with the settings owners.
+  const harness = setUp(false, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    assert.equal(document.documentElement.style.getPropertyValue('--window-content-opacity'), '0.7');
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+
+    await act(async () => {
+      renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false }));
+    });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});
@@ -72,7 +72,12 @@ export function usePluginAgentHost(sessions: TerminalSession[]) {
      STORAGE_KEY_AI_AGENT_MODEL_MAP, STORAGE_KEY_AI_AGENT_PROVIDER_MAP, STORAGE_KEY_AI_EXTERNAL_AGENTS]);
    const configurationChanged = (event: Event) => {
      const key = event.type === 'storage' ? (event as StorageEvent).key : (event as CustomEvent<{ key: string }>).detail?.key;
-      if (key === null || (key && configurationKeys.has(key))) runtime.invalidateConfiguration();
+      if (key === null || (key && configurationKeys.has(key))) {
+        runtime.invalidateConfiguration();
+        // Invalidate main-owned backend leases too, even with no event read in
+        // flight. Re-advertising availability does not renew existing handles.
+        void bridge.ready(false).then(() => { if (mounted) return bridge.ready(true); }).catch(() => {});
+      }
    };
    window.addEventListener('pagehide', pageHide);
    window.addEventListener('storage', configurationChanged); window.addEventListener(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, configurationChanged);
@@ -0,0 +1,59 @@
+import { useEffect, useMemo, useState, useSyncExternalStore } from 'react';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+// All visible rows share one IPC subscription. No catalog fetch or polling here.
+const generations = new Map<string, number>();
+const listeners = new Set<() => void>();
+let unsubscribe: (() => void) | undefined;
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  if (listeners.size === 1) unsubscribe = netcattyBridge.get()?.onPluginCatalogChanged?.(({ sourceId }) => {
+    generations.set(sourceId, (generations.get(sourceId) ?? 0) + 1);
+    for (const notify of listeners) notify();
+  });
+  return () => {
+    listeners.delete(listener);
+    if (!listeners.size) { unsubscribe?.(); unsubscribe = undefined; generations.clear(); }
+  };
+}
+
+export function usePluginAuthorIdentity({ entry, plugin, sourceId = 'official' }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const [element, setElement] = useState<HTMLElement | null>(null);
+  const [loaded, setLoaded] = useState<{ key: string; value: NetcattyPluginAuthorPresentation } | null>(null);
+  const pluginId = plugin?.id;
+  const entryId = entry?.id;
+  const selectionToken = entry?.selectionToken;
+  const request = useMemo<NetcattyPluginAuthorRequest | null>(() => pluginId
+    ? { kind: 'installed', pluginId }
+    : entryId && selectionToken ? { kind: 'catalog', pluginId: entryId, selectionToken, sourceId } : null,
+  [pluginId, entryId, selectionToken, sourceId]);
+  const identitySource = plugin?.source?.id ?? sourceId;
+  const generation = useSyncExternalStore(subscribe, () => generations.get(identitySource) ?? 0, () => 0);
+  const key = JSON.stringify([request, plugin?.activeVersion, plugin?.archiveSha256, plugin?.source?.id, plugin?.runtime?.quarantinedAt, generation]);
+  const installed = Boolean(plugin);
+  const version = plugin?.activeVersion;
+  const archiveSha256 = plugin?.archiveSha256 ?? null;
+  const installedSourceId = plugin?.source?.id ?? 'local';
+  useEffect(() => {
+    if (!element || !request) return;
+    let active = true;
+    let started = false;
+    const load = () => {
+      if (started) return;
+      started = true;
+      void netcattyBridge.get()?.getPluginAuthorPresentation?.(request).then((value) => {
+        if (!active || !value) return;
+        if (installed && (value.version !== version || value.archiveSha256 !== archiveSha256 || value.sourceId !== installedSourceId)) return;
+        setLoaded({ key, value });
+      }).catch(() => { /* The visible author placeholder remains usable offline. */ });
+    };
+    const observer = typeof IntersectionObserver === 'undefined' ? null : new IntersectionObserver((entries) => {
+      if (entries.some((entry) => entry.isIntersecting)) { load(); observer?.disconnect(); }
+    }, { rootMargin: '64px' });
+    if (observer) observer.observe(element); else load();
+    return () => { active = false; observer?.disconnect(); };
+  }, [element, request, key, installed, version, archiveSha256, installedSourceId]);
+  return { ref: setElement, identity: loaded?.key === key ? loaded.value : null };
+}
@@ -74,6 +74,7 @@ import {
  STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
  STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
  STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
  STORAGE_KEY_APP_ICON_VARIANT,
  STORAGE_KEY_AUTO_UPDATE_ENABLED,
  STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
@@ -645,6 +646,9 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    windowOpacityMutationSourceRef.current = 'local';
    setWindowOpacityRecord(toggleWindowOpacityRecord);
  }, []);
+  const [windowBackgroundBlur, setWindowBackgroundBlur] = useState<boolean>(() => {
+    return readStoredString(STORAGE_KEY_WINDOW_BACKGROUND_BLUR) === 'true';
+  });
  const [appIconVariant, setAppIconVariantState] = useState<AppIconVariant>(() => {
    const stored = readStoredString(STORAGE_KEY_APP_ICON_VARIANT);
    return resolveAppIconVariant(stored ?? DEFAULT_APP_ICON_VARIANT);
@@ -1276,6 +1280,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    setIsHotkeyRecordingState,
    setGlobalHotkeyEnabled,
    setWindowOpacity: applyIncomingWindowOpacity,
+    setWindowBackgroundBlur,
    setAppIconVariant,
    setAutoUpdateEnabled,
    setAutoLaunchEnabled,
@@ -1298,12 +1303,18 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    setSshTransportIdleTtlMsState,
  });

-  // Detached sessions share opacity and the shortcut configuration needed to
-  // operate it. Keep general settings listeners and OS effects disabled there.
+  // Detached sessions share window chrome (opacity, background blur) and the
+  // shortcut configuration needed to operate it. Keep general settings
+  // listeners and OS effects disabled there.
  useEffect(() => {
    if (enableSettingsSync) return;
    const applySharedWindowSetting = (key: string, value: unknown) => {
      if (key === STORAGE_KEY_WINDOW_OPACITY) applyIncomingWindowOpacity(value);
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) {
+        // Storage events deliver the raw string; IPC delivers a boolean.
+        const incoming = typeof value === 'boolean' ? value : value === 'true';
+        setWindowBackgroundBlur(incoming);
+      }
      if (key === STORAGE_KEY_HOTKEY_SCHEME && (value === 'disabled' || value === 'mac' || value === 'pc')) {
        setHotkeyScheme(value);
      }
@@ -1377,7 +1388,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
    showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
    editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
    setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode,
    applyIncomingCustomAccent,
    setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
@@ -1387,7 +1398,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
    setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
    setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState: applyIncomingSshDeepLinkEnabled, setJmsDeepLinkEnabledState: applyIncomingJmsDeepLinkEnabled, setExplorerContextMenuEnabledState: applyIncomingExplorerContextMenuEnabled,
-    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
    setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
    applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
  });
@@ -1896,6 +1907,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    autoLaunchEnabled,
    windowOpacityRecord,
    windowOpacityMutationSourceRef,
+    windowBackgroundBlur,
    appIconVariant,
    autoUpdateEnabled,
    httpNetworkProxy,
@@ -2276,6 +2288,8 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
    windowOpacity,
    setWindowOpacity,
    toggleWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
    appIconVariant,
    setAppIconVariant,
    rehydrateAllFromStorage,
@@ -207,7 +207,9 @@ test('cold plugin host reaches the local fixture through the actual main provide
    assert.deepEqual(sdkErrorNames, []);
  } finally {
    console.error = originalConsoleError;
-    panel?.window.close();
+    // JSDOM.close does not deliver the browser pagehide lifecycle. Invalidate
+    // the sample's pending callbacks before teardown closes its document.
+    if (panel) { panel.window.dispatchEvent(new panel.window.Event('pagehide')); panel.window.close(); }
    await act(async () => root.unmount());
    await service?.manager.shutdown(); aiBridge.cleanup();
    publishNotesSnapshot(oldNotes); registerAppAppLockRuntime(oldLock);
@@ -102,11 +102,18 @@ test('installed global Chat UI reuses actual Catty runtime, configured HTTP tran
      if (Date.now() >= until) throw Error(`Global Agent UI fixture timed out; accepted=${counts.requests}, rejected=${counts.rejected}, effects=${workerCalls.length}, status=${panel?.window.document.getElementById('status')?.textContent}`);
      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 5)); });
    } };
-    panel = new JSDOM(fs.readFileSync(path.join(sample, 'panel.html'), 'utf8'), { runScripts: 'outside-only' });
-    Object.defineProperty(panel.window, 'netcattyView', { value: { executeCommand: async (name: string, params: unknown) => {
-      const result = structuredClone(await service!.contributionService.executeCommand(name, structuredClone(params))); pluginReplies.push(result); return result;
-    }, onDidReceiveMessage: () => ({ dispose() {} }), onDidChangeEnvironment: () => ({ dispose() {} }) } });
-    await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
+    let viewOpen = true;
+    const mountPanel = async () => {
+      panel = new JSDOM(fs.readFileSync(path.join(sample, 'panel.html'), 'utf8'), { runScripts: 'outside-only' });
+      Object.defineProperty(panel.window, 'netcattyView', { value: { executeCommand: async (name: string, params: unknown) => {
+        // PluginViewHost.close removes sender authority before WebContents
+        // closes. A pagehide RPC cannot be relied on to reach this relay.
+        if (!viewOpen) throw Error('Untrusted plugin view sender');
+        const result = structuredClone(await service!.contributionService.executeCommand(name, structuredClone(params))); pluginReplies.push(result); return result;
+      }, onDidReceiveMessage: () => ({ dispose() {} }), onDidChangeEnvironment: () => ({ dispose() {} }) } });
+      await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
+    };
+    await mountPanel();
    const element = (id: string) => panel!.window.document.getElementById(id)!;
    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
@@ -114,7 +121,7 @@ test('installed global Chat UI reuses actual Catty runtime, configured HTTP tran
    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
    await act(async () => element('open').click()); await waitFor(() => element('status').textContent!.startsWith('Ready'));
-    const prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic selected-target task';
+    let prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic selected-target task';
    const send = () => element('compose').dispatchEvent(new panel!.window.Event('submit', { cancelable: true }));
    phase = 'complete'; await act(async () => { send(); }); await waitFor(() => element('status').textContent === 'Complete');
    assert.deepEqual(workerCalls, ['synthetic-b']); assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
@@ -124,12 +131,29 @@ test('installed global Chat UI reuses actual Catty runtime, configured HTTP tran
    await waitFor(() => element('transcript').textContent!.includes('Synthetic waiting output'));
    await act(async () => element('stop').click()); await waitFor(() => element('status').textContent === 'Stopped' && counts.aborted === 1);
    const stopped = element('transcript').textContent; await new Promise((resolve) => setTimeout(resolve, 75)); assert.equal(element('transcript').textContent, stopped);
+    phase = 'modal-reopen-history';
+    const reference = pluginReplies.find((value) => value && typeof value === 'object' && 'conversationRef' in value && 'chatHandle' in value) as { conversationRef: string };
+    const beforeReopen = counts.requests;
+    viewOpen = false;
+    panel!.window.dispatchEvent(new panel!.window.Event('pagehide')); panel!.window.close();
+    viewOpen = true; await mountPanel();
+    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    (element('conversation') as HTMLSelectElement).value = reference.conversationRef;
+    await act(async () => element('conversation').dispatchEvent(new panel!.window.Event('change')));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click());
+    await waitFor(() => /^(Ready|Conversation unavailable)/.test(element('status').textContent!));
+    assert.match(element('status').textContent!, /^Ready/, 'ordinary modal reopen must release the prior exact chat even if pagehide cleanup never reaches the plugin');
+    assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
+    assert.equal(service.agentService.chats.size, 1); assert.equal(counts.requests, beforeReopen, 'history reopen does not invoke a model');
+    prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic continuation';
    phase = 'deny'; const before = counts.requests; const plugin = service.database.getActivePlugin('com.netcatty.globalagent');
    service.permissionEngine.setMode(plugin, 'ai.agent.actions', 'deny', service.permissionEngine.getPolicyRevision(plugin));
    await act(async () => { send(); }); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
    assert.equal(counts.requests, before); assert.deepEqual(workerCalls, ['synthetic-b']);
    phase = 'restart-history';
-    const reference = pluginReplies.find((value) => value && typeof value === 'object' && 'conversationRef' in value && 'chatHandle' in value) as { conversationRef: string };
    await service.manager.setEnabled('com.netcatty.globalagent', false);
    await service.manager.setEnabled('com.netcatty.globalagent', true);
    await act(async () => element('refresh').click()); await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
@@ -144,6 +168,15 @@ test('installed global Chat UI reuses actual Catty runtime, configured HTTP tran
    await waitFor(() => element('status').textContent === 'Complete');
    assert.equal(counts.requests, before + 1, 'Actions Deny allows a tool-free configured model turn after reopening');
    assert.deepEqual(workerCalls, ['synthetic-b']);
+    phase = 'backend-revision';
+    const latestChat = [...pluginReplies].reverse().find((value) => value && typeof value === 'object' && 'chatHandle' in value) as { chatHandle: string };
+    const generation = service.agentService.host.generation; const requestsBeforeChange = counts.requests;
+    const { LOCAL_STORAGE_ADAPTER_CHANGED_EVENT } = await import('../infrastructure/persistence/localStorageAdapter');
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_ACTIVE_MODEL, 'changed-synthetic-model');
+    await act(async () => window.dispatchEvent(new CustomEvent(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, { detail: { key: keys.STORAGE_KEY_AI_ACTIVE_MODEL } })));
+    await waitFor(() => service!.agentService.host.generation > generation && service!.agentService.chats.size === 0);
+    await assert.rejects(service.contributionService.executeCommand('com.netcatty.globalagent.history', { chatHandle: latestChat.chatHandle }));
+    assert.equal(counts.requests, requestsBeforeChange, 'configuration invalidation never retries model inference');
    assert.doesNotMatch(JSON.stringify(pluginReplies), /FIXTURE_ONLY_API_MARKER|apiKey|externalSessionId|plugin-agent:|opaque-owner|mcpServers|permissionMode/);
    assert.doesNotMatch(JSON.stringify(trustedReplies), /FIXTURE_ONLY_API_MARKER|apiKey/);
    assert.deepEqual(errors, []);
@@ -100,6 +100,21 @@ test('registered Ask uses one in-app dialog; policy controls apply Allow and Den
    await act(async () => { button('Deny').click(); await displayed; await settle(); });
    await new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
    assert.equal(nativeVisibility.at(-1), true, 'dismissing Ask restores the existing view without closing it');
+    for (const selections of [[], [{ title: 'Synthetic terminal B', scope: 'session', version: 'opaque-worker-revision' }]]) {
+      await act(async () => {
+        displayed = host.request({ requestId: 'agent-empty-args', pluginId: plugin.id, permission: 'ai.agent.actions', resources: ['*'],
+          displayContext: { modelLabel: 'Synthetic configured Catty', action: { capabilityId: 'session.environment', text: '{}', label: 'PLUGIN_SUPPLIED_OPERATION_NAME' }, selections },
+        }); await settle();
+      });
+      const dialog = document.querySelector('[role="dialog"]')!;
+      assert.match(dialog.textContent!, /Operation:.*get_environment/);
+      assert.match(dialog.textContent!, /session\.environment/);
+      assert.equal(dialog.querySelector('pre')!.textContent, '{}');
+      if (selections.length) assert.match(dialog.textContent!, /Targets:.*Synthetic terminal B/);
+      else assert.match(dialog.textContent!, /Targets:.*No targets selected/);
+      assert.doesNotMatch(dialog.textContent!, /opaque-worker-revision|PLUGIN_SUPPLIED_OPERATION_NAME/);
+      await act(async () => { button('Deny').click(); await displayed; await settle(); });
+    }
  } finally {
    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); engine.shutdown(); dom.window.close();
    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
@@ -576,6 +576,8 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
                                setShowHostTreeSidebar={settings.setShowHostTreeSidebar}
                                windowOpacity={settings.windowOpacity}
                                setWindowOpacity={settings.setWindowOpacity}
+                                windowBackgroundBlur={settings.windowBackgroundBlur}
+                                setWindowBackgroundBlur={settings.setWindowBackgroundBlur}
                                appIconVariant={settings.appIconVariant}
                                setAppIconVariant={settings.setAppIconVariant}
                            />
@@ -64,6 +64,8 @@ interface TextEditorModalProps {
  onClose: () => void;
  fileName: string;
  initialContent: string;
+  /** Full path for language detection; the title still uses fileName. */
+  filePath?: string;
  onSave: (content: string) => Promise<void>;
  editorWordWrap: boolean;
  onToggleWordWrap: () => void;
@@ -79,6 +81,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
  open,
  onClose,
  fileName,
+  filePath,
  initialContent,
  onSave,
  editorWordWrap,
@@ -94,7 +97,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
  const [baselineContent, setBaselineContent] = useState(initialContent);
  const [saving, setSaving] = useState(false);
  const [saveError, setSaveError] = useState<string | null>(null);
-  const [languageId, setLanguageId] = useState(() => getLanguageId(fileName));
+  const [languageId, setLanguageId] = useState(() => getLanguageId(filePath ?? fileName));
  const contentRef = useRef(initialContent);
  const baselineContentRef = useRef(initialContent);
  const savingRef = useRef(false);
@@ -149,13 +152,13 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
    setBaselineContent(initialContent);
    setSaveError(null);
    setSaving(false);
-    setLanguageId(getLanguageId(fileName));
+    setLanguageId(getLanguageId(filePath ?? fileName));
    contentRef.current = initialContent;
    baselineContentRef.current = initialContent;
    savingRef.current = false;
    closePromptRef.current = null;
    viewStateRef.current = null;
-  }, [initialContent, fileName]);
+  }, [initialContent, fileName, filePath]);

  const saveContent = useCallback(async (contentToSave = contentRef.current): Promise<boolean> => {
    return saveCoordinatorRef.current?.save(contentToSave) ?? false;
@@ -8,6 +8,7 @@ import {
  getTextEditorContentStats,
  isTextEditorCommandWEnabled,
  isTextEditorReadOnly,
+  languageIdToMonaco,
  TextEditorPromoteButton,
 } from "./TextEditorPane.tsx";
 import { TooltipProvider } from "../ui/tooltip.tsx";
@@ -16,6 +17,11 @@ import { DEFAULT_KEY_BINDINGS } from "../../domain/models/keyBindings.ts";
 const wrap = (child: React.ReactElement) =>
  React.createElement(TooltipProvider, null, child);

+test("maps manual Nginx selection to the registered language", () => {
+  assert.equal(languageIdToMonaco('nginx'), 'nginx');
+  assert.equal(languageIdToMonaco('ini'), 'ini');
+});
+
 test("disables promoting a modal editor to a tab while a save is running", () => {
  assert.equal(canPromoteTextEditor({ saving: true }), false);
  assert.equal(canPromoteTextEditor({ saving: false }), true);
@@ -30,6 +30,7 @@ import { useClipboardBackend } from '../../application/state/useClipboardBackend
 import { isPrimaryModifierWBinding } from '../../application/state/windowCommandClose';
 import { HotkeyScheme, KeyBinding, matchesKeyBinding } from '../../domain/models';
 import { pasteForMonacoEditorCommand } from '../../infrastructure/monaco/monacoClipboardPaste';
+import { registerNginxLanguage } from '../../infrastructure/monaco/nginxLanguage';
 import { useNetcattyMonacoTheme } from '../../infrastructure/monaco/useNetcattyMonacoTheme';
 import { getLanguageName, getSupportedLanguages } from '../../lib/sftpFileUtils';
 import { Button } from '../ui/button';
@@ -37,7 +38,7 @@ import { Combobox } from '../ui/combobox';
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip';

 // Map our language IDs to Monaco language IDs
-const languageIdToMonaco = (langId: string): string => {
+export const languageIdToMonaco = (langId: string): string => {
  const mapping: Record<string, string> = {
    'javascript': 'javascript',
    'typescript': 'typescript',
@@ -73,6 +74,7 @@ const languageIdToMonaco = (langId: string): string => {
    'yaml': 'yaml',
    'toml': 'ini',
    'ini': 'ini',
+    'nginx': 'nginx',
    'sql': 'sql',
    'graphql': 'graphql',
    'markdown': 'markdown',
@@ -512,6 +514,7 @@ const TextEditorPaneInner: React.FC<TextEditorPaneProps> = ({
          language={monacoLanguage}
          value={content}
          onChange={handleEditorChange}
+          beforeMount={registerNginxLanguage}
          onMount={handleEditorMount}
          theme={customThemeName}
          loading={
@@ -0,0 +1,26 @@
+import React, { useState } from 'react';
+import { UserRound } from 'lucide-react';
+import { usePluginAuthorIdentity } from '../../application/state/usePluginAuthorIdentity';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { Badge } from '../ui/badge';
+
+export function PluginAuthorRow({ entry, plugin, sourceId }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const { t } = useI18n();
+  const { ref, identity } = usePluginAuthorIdentity({ entry, plugin, sourceId });
+  const [failed, setFailed] = useState<string | null>(null);
+  const author = identity?.author ?? entry?.author ?? plugin?.manifest?.publisher ?? '';
+  const imageKey = JSON.stringify([entry?.id, entry?.selectionToken, plugin?.id, plugin?.activeVersion, plugin?.archiveSha256, sourceId, identity?.avatar]);
+  const avatar = identity?.avatar;
+  const showImage = avatar && avatar.length <= 700_000 && /^data:image\/png;base64,[A-Za-z0-9+/]+={0,2}$/.test(avatar) && failed !== imageKey;
+  return <div ref={ref} className="flex min-w-0 items-center gap-2 text-xs text-muted-foreground" data-plugin-author-row>
+    <span className="inline-flex h-5 w-5 shrink-0 items-center justify-center overflow-hidden rounded-full bg-muted/60" aria-hidden="true">
+      {showImage ? <img src={avatar} alt="" width={20} height={20} className="h-full w-full object-cover" onError={() => setFailed(imageKey)} />
+        : <UserRound size={13} data-plugin-author-placeholder />}
+    </span>
+    <span className="min-w-0 truncate" title={author}>{author}</span>
+    {identity?.officialMaintained === true && <Badge className="shrink-0 whitespace-nowrap border-0 bg-amber-500/15 px-2 py-0.5 text-[10px] font-medium text-amber-800 hover:bg-amber-500/15 dark:bg-amber-400/15 dark:text-amber-300 dark:hover:bg-amber-400/15"
+      title={t('settings.plugins.author.officialMeaning')} data-plugin-official-maintainer>{t('settings.plugins.author.official')}</Badge>}
+  </div>;
+}
@@ -3,6 +3,7 @@ import { useI18n } from '../../application/i18n/I18nProvider';
 import { describePluginPermission } from '@/domain/pluginPermissionDescriptions.cjs';
 import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
 import { Button } from '../ui/button';
+import globalAgentToolSpecs from '../../infrastructure/ai/harness/generated/globalAgentToolSpecs.json';

 /** Rendered only by the trusted app, never inside a plugin view. */
 export function PluginPermissionHost() {
@@ -12,6 +13,9 @@ export function PluginPermissionHost() {
  if (!prompt) return null;
  const description = describePluginPermission(prompt.permission, resolvedLocale);
  const resources = prompt.resources.filter((resource) => resource !== '*' && !resource.startsWith('selected:'));
+  const action = prompt.displayContext?.action;
+  const operation = action && (globalAgentToolSpecs.find((tool) => tool.capabilityId === action.capabilityId)?.toolName ?? action.capabilityId);
+  const selections = prompt.displayContext?.selections ?? [];
  return <Dialog open onOpenChange={(open) => { if (!open) void respond('cancel'); }}>
    <DialogContent data-host-security-surface="" className="max-h-[85vh] overflow-y-auto sm:max-w-[480px]">
      <DialogHeader>
@@ -20,13 +24,17 @@ export function PluginPermissionHost() {
      </DialogHeader>
      <p className="text-sm">{description.description}</p>
      {prompt.displayContext?.modelLabel && <p className="text-sm break-words">{zh ? '模型' : 'Model'}: {prompt.displayContext.modelLabel}</p>}
-      {prompt.displayContext?.action && <div className="space-y-1">
+      {action && <div className="space-y-1">
+        <p className="text-sm break-words">{zh ? '操作' : 'Operation'}: <code>{operation}</code>{operation !== action.capabilityId && <> ({action.capabilityId})</>}</p>
        <p className="text-sm">{zh ? '请求内容（控制字符以转义形式显示）' : 'Requested action (control characters shown as escapes)'}</p>
-        <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words rounded border border-border p-2 text-xs">{prompt.displayContext.action.text}</pre>
+        <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words rounded border border-border p-2 text-xs">{action.text}</pre>
+      </div>}
+      {(selections.length > 0 || prompt.permission === 'ai.agent.actions') && <div className="space-y-1">
+        <p className="text-sm">{zh ? '目标' : 'Targets'}:{selections.length === 0 && (zh ? ' 未选择目标' : ' No targets selected')}</p>
+        {selections.map((item, index) => <p key={index} className="text-sm break-words">
+          {item.title} <span className="text-xs text-muted-foreground">· {item.scope}</span>
+        </p>)}
      </div>}
-      {(prompt.displayContext?.selections ?? []).map((item, index) => <p key={index} className="text-sm break-words">
-        {item.title} <span className="text-xs text-muted-foreground">· {item.scope}</span>
-      </p>)}
      {(prompt.relatedPermissions ?? []).filter((item, index, items) => items.findIndex((other) => other.permission === item.permission) === index).map((item, index) => <div key={index} className="space-y-1 text-sm">
        <p>{describePluginPermission(item.permission, resolvedLocale).description}</p>
        <p className="text-xs text-muted-foreground break-all">{item.resources.filter((resource) => !resource.startsWith('selected:')).join(', ')}</p>
@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { JSDOM } from 'jsdom';
+import { EventEmitter } from 'node:events';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+import { usePluginAuthorIdentity } from '../../../application/state/usePluginAuthorIdentity';
+import { checkPluginUpdates } from '../../../infrastructure/services/pluginUpdateCheck';
+
+const require = createRequire(import.meta.url);
+const { PluginDatabase } = require('../../../electron/plugins/database.cjs');
+const { MarketSourcesService } = require('../../../electron/plugins/marketSourcesService.cjs');
+const { OFFICIAL_SOURCE } = require('../../../electron/plugins/sourceIdentity.cjs');
+const { registerPluginBridge, CHANNELS } = require('../../../electron/plugins/pluginBridge.cjs');
+const { createPreloadApi } = require('../../../electron/preload/api.cjs');
+const { catalog, delivery, makeFiles, read, digest } = require('../../../electron/plugins/fixtures/staticDistributionFixture.cjs');
+
+test('mounted installed authors follow actual catalog/update/source entrypoints without changing package identity', async () => {
+  const rootPath = mkdtempSync(join(tmpdir(), 'netcatty-author-refresh-'));
+  const database = new PluginDatabase(join(rootPath, 'plugins.sqlite'));
+  const dom = new JSDOM('<!doctype html><div id="root"></div>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const [key, value] of Object.entries({ window: dom.window, document: dom.window.document,
+    navigator: dom.window.navigator, HTMLElement: dom.window.HTMLElement, Element: dom.window.Element,
+    Node: dom.window.Node, IntersectionObserver: undefined, IS_REACT_ACT_ENVIRONMENT: true })) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  }
+  const entry = structuredClone(catalog[0]);
+  entry.artifact = { sha256: 'a'.repeat(64), url: `${OFFICIAL_SOURCE.origin}/assets/${'a'.repeat(64)}.ncpkg` };
+  const bytes = read(delivery.plugins[0].iconLight.path.slice(1));
+  const avatar = { path: `/assets/${digest(bytes)}.png`, sha256: digest(bytes), size: bytes.length };
+  const filesFor = (entries = [entry], image = true) => {
+    const files = makeFiles(entries, (index: { plugins: Array<{ id: string; versions: Array<{ distribution: string }> }> }, sidecar: { schemaVersion: number; plugins: Array<{ id: string; avatar: typeof avatar | null; artifact: { path: string; sha256: string; size: number } }> }) => {
+      sidecar.schemaVersion = 2;
+      for (const item of sidecar.plugins) {
+        item.avatar = image ? avatar : null;
+        item.artifact = { path: `/assets/${entry.artifact.sha256}.ncpkg`, sha256: entry.artifact.sha256, size: 1 };
+        index.plugins.find((plugin) => plugin.id === item.id).versions[0].distribution = 'release';
+      }
+    });
+    files.set(avatar.path, bytes); return files;
+  };
+  let files = filesFor();
+  database.installVersion({ pluginId: entry.id, version: entry.version, runtimeKind: "browser", apiVersion: "0.1.0-internal.1", manifest: entry.manifest, archiveSha256: entry.artifact.sha256,
+    packageRelativePath: 'packages/synthetic', source: OFFICIAL_SOURCE }, { enable: true });
+  const manager = { initialize: async () => {}, list: async () => database.listPlugins(),
+    changeMarketSource: async (change: () => unknown) => change() };
+  let avatarReads = 0;
+  const service = new MarketSourcesService({ database, manager,
+    fetch: async (url: string) => { assert.equal(new URL(url).origin, OFFICIAL_SOURCE.origin); assert.ok(!new URL(url).pathname.endsWith('.ncpkg'), 'rejected selection never downloads a package'); return new Response(files.get(new URL(url).pathname)); },
+    createSourceFetch: (origin: string) => async (url: string) => { assert.equal(new URL(url).origin, origin); return new Response(files.get(new URL(url).pathname)); },
+    resolveAvatar: async () => { avatarReads++; return 'data:image/png;base64,eA=='; } });
+  const ipcMain = { handlers: new Map(), handle(channel: string, handler: unknown) { this.handlers.set(channel, handler); }, on() {} };
+  const events = new EventEmitter();
+  registerPluginBridge(ipcMain, { manager, catalogService: service, isTrustedSender: () => true,
+    broadcast: (channel: string, payload: unknown) => events.emit(channel, {}, payload) });
+  const api = createPreloadApi({ ipcRenderer: { on: events.on.bind(events), removeListener: events.removeListener.bind(events),
+    invoke: (channel: string, payload: unknown) => ipcMain.handlers.get(channel)({}, payload) } });
+  let authorCalls = 0;
+  const original = api.getPluginAuthorPresentation;
+  api.getPluginAuthorPresentation = (request: NetcattyPluginAuthorRequest) => { authorCalls++; return original(request); };
+  Object.assign(window, { netcatty: api });
+  let plugin = database.getActivePlugin(entry.id) as NetcattyInstalledPlugin;
+  function Row() {
+    const { ref, identity } = usePluginAuthorIdentity({ plugin });
+    return <div ref={ref} data-author={identity?.author} data-avatar={identity?.avatar} data-official={identity?.officialMaintained ?? false} />;
+  }
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const row = () => document.querySelector<HTMLElement>('[data-official]')!;
+  try {
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(avatarReads, 0, 'opening installed rows never fetches a catalog/avatar');
+    await act(async () => { await checkPluginUpdates(api); });
+    assert.equal(row().dataset.author, entry.author); assert.equal(row().dataset.official, 'true');
+    assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 1, 'rows share one preload subscription');
+    const count = authorCalls;
+    await act(async () => { await api.listPluginCatalog('official'); root.render(<><Row /><Row /></>); });
+    assert.equal(authorCalls, count, 'equivalent catalog and installation retain request dedupe');
+    files = filesFor([{ ...entry, author: 'Updated project name' }], false);
+    await act(async () => { await api.listPluginCatalog('official'); });
+    assert.equal(row().dataset.author, 'Updated project name'); assert.equal(row().dataset.avatar, undefined);
+    const beforeWithdrawal = (await api.listPluginCatalog('official')).entries[0];
+    files = filesFor([]);
+    await act(async () => {
+      await assert.rejects(api.installCatalogPlugin(entry.id, beforeWithdrawal.selectionToken, 'official'), /not in the curated catalog|changed/);
+    });
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(row().dataset.avatar, undefined, 'rejected install refresh removes withdrawn enrichment without another list or remount');
+
+    const source = await api.addPluginSource({ name: 'Community', address: 'https://community.example.com' });
+    const community = structuredClone(entry);
+    community.id = community.manifest.id = 'com.community.identity';
+    community.artifact.url = `${source.origin}/assets/${community.artifact.sha256}.ncpkg`;
+    files = filesFor([community]);
+    database.installVersion({ pluginId: community.id, version: community.version, manifest: community.manifest,
+      archiveSha256: community.artifact.sha256, packageRelativePath: 'packages/community', source }, { enable: true });
+    await act(async () => { await api.listPluginCatalog(source.id); });
+    assert.equal(authorCalls, count + 4, 'unrelated source changes do not reload official rows');
+    plugin = database.getActivePlugin(community.id);
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, community.author); assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(row().dataset.official, 'false', 'copied catalog never gains official maintenance authority');
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: false }); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: true }); });
+    assert.equal(row().dataset.author, community.author);
+    await act(async () => { await api.removePluginSource(source.id, false); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => root.unmount());
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 0, 'last row releases the shared IPC listener');
+  } finally {
+    database.close(); dom.window.close(); rmSync(rootPath, { recursive: true, force: true });
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});
@@ -0,0 +1,116 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { JSDOM } from 'jsdom';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
+import { I18nProvider } from '../../../application/i18n/I18nProvider';
+
+const entry = { id: 'com.netcatty.starter', name: 'Starter', author: 'Netcatty', version: '0.1.2',
+  repository: 'binaricat/Netcatty', commit: 'a'.repeat(40), selectionToken: 'b'.repeat(64),
+  manifest: { publisher: 'netcatty' } } as NetcattyPluginCatalogEntry;
+const identity = { author: 'Netcatty', avatar: 'data:image/png;base64,eA==', officialMaintained: true,
+  sourceId: 'official', version: entry.version, archiveSha256: null };
+
+test('untrusted entry strings and absent imagery produce a compact placeholder without an official badge', () => {
+  const claimed = { ...entry, author: '<img src="https://avatars.githubusercontent.com/u/1">',
+    officialMaintained: true, avatar: 'https://avatars.githubusercontent.com/u/1' };
+  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginAuthorRow entry={claimed} /></I18nProvider>);
+  assert.match(html, /data-plugin-author-placeholder/);
+  assert.doesNotMatch(html, /<img|data-plugin-official-maintainer/);
+  assert.match(html, /&lt;img/);
+  assert.match(html, /items-center/);
+});
+
+test('mounted author rows load only when visible, retain fallbacks, cancel stale results and show a borderless themed maintainer pill', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  const observers: Array<{ target: Element | null; callback: IntersectionObserverCallback }> = [];
+  class VisibilityObserver {
+    record: typeof observers[number];
+    constructor(callback: IntersectionObserverCallback) { this.record = { callback, target: null }; observers.push(this.record); }
+    observe(target: Element) { this.record.target = target; }
+    disconnect() { this.record.target = null; }
+  }
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('IntersectionObserver', VisibilityObserver);
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const calls: NetcattyPluginAuthorRequest[] = [];
+  const pending: Array<(value: NetcattyPluginAuthorPresentation | null) => void> = [];
+  Object.assign(window, { netcatty: { getPluginAuthorPresentation: (request: NetcattyPluginAuthorRequest) => {
+    calls.push(request); return new Promise((resolve) => pending.push(resolve));
+  } } });
+  const render = async (value = entry, sourceId = 'official') => {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow entry={value} sourceId={sourceId} /></I18nProvider>));
+  };
+  const visible = async () => {
+    await act(async () => {
+      for (const observer of [...observers]) if (observer.target) observer.callback([{ target: observer.target, isIntersecting: true } as IntersectionObserverEntry], {} as IntersectionObserver);
+    });
+  };
+  try {
+    await render(); assert.equal(calls.length, 0); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    await visible(); assert.deepEqual(calls[0], { kind: 'catalog', pluginId: entry.id, selectionToken: entry.selectionToken, sourceId: 'official' });
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'), 'loading uses the default placeholder');
+    await act(async () => pending.shift()!(identity));
+    const image = document.querySelector('img')!;
+    assert.equal(image.getAttribute('src'), identity.avatar); assert.equal(image.width, 20); assert.equal(image.height, 20);
+    const badge = document.querySelector<HTMLElement>('[data-plugin-official-maintainer]')!;
+    assert.equal(badge.textContent, 'Official maintainer'); assert.match(badge.title, /not a safety certification/);
+    assert.ok(badge.classList.contains('border-0'));
+    assert.ok(badge.classList.contains('bg-amber-500/15')); assert.ok(badge.classList.contains('dark:bg-amber-400/15'));
+    assert.ok(badge.classList.contains('text-amber-800')); assert.ok(badge.classList.contains('dark:text-amber-300'));
+    document.documentElement.classList.add('dark');
+    assert.ok(document.querySelector('[data-plugin-author-row]')?.classList.contains('items-center'));
+    await act(async () => image.dispatchEvent(new Event('error')));
+    assert.equal(document.querySelector('img'), null); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    assert.ok(document.querySelector('[data-plugin-official-maintainer]'), 'image failure does not alter maintenance identity');
+
+    const next = { ...entry, selectionToken: 'c'.repeat(64) };
+    await render(next); assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    await visible(); const stale = pending.shift()!;
+    const copied = { ...entry, author: 'Community author', selectionToken: 'd'.repeat(64) };
+    await render(copied, 'third-party:copy'); await visible();
+    await act(async () => stale(identity));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    assert.match(document.querySelector('[data-plugin-author-row]')!.textContent!, /Community author/);
+    await act(async () => pending.shift()!({ ...identity, author: copied.author, sourceId: 'third-party:copy', officialMaintained: false, avatar: 'https://avatars.githubusercontent.com/u/1' }));
+    assert.equal(document.querySelector('img'), null, 'renderer never uses a remote avatar URL');
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+
+    await render({ ...entry, selectionToken: 'f'.repeat(64) }); await visible();
+    await act(async () => pending.shift()!({ ...identity, avatar: null, officialMaintained: false }));
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    const installed = { id: entry.id, activeVersion: entry.version, archiveSha256: 'a'.repeat(64),
+      source: { id: 'official', kind: 'official', origin: 'https://plugins.netcatty.app', name: 'Official' },
+      manifest: entry.manifest, runtime: {} } as NetcattyInstalledPlugin;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={installed} /></I18nProvider>));
+    await visible(); assert.deepEqual(calls.at(-1), { kind: 'installed', pluginId: installed.id });
+    await act(async () => pending.shift()!({ ...identity, version: '9.0.0', archiveSha256: installed.archiveSha256! }));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null, 'a stale installed version cannot gain a badge');
+    const count = calls.length;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={{ ...installed }} /></I18nProvider>));
+    await visible(); assert.equal(calls.length, count, 'unchanged installed identity does not reload on a new object reference');
+
+    await render({ ...entry, selectionToken: 'e'.repeat(64) }); await visible();
+    const late = pending.shift()!;
+    await act(async () => root.unmount());
+    await act(async () => late(identity));
+    assert.equal(document.querySelector('[data-plugin-author-row]'), null);
+    assert.ok(observers.every((observer) => observer.target === null));
+  } finally {
+    dom.window.close();
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});
@@ -32,7 +32,9 @@ test('installed grid filters, opens one detail and restores search, scroll and c
    assert.equal(cards().length, 2);
    const alphaCard = renderer.root.findAllByType('article')[0];
    assert.match(JSON.stringify(renderer.toJSON()), /Alpha safely formats synthetic greetings/);
-    assert.ok(alphaCard.findAllByType('p').some((node) => node.children.includes('Example')), 'author has its own line');
+    const authorRow = alphaCard.findByProps({ 'data-plugin-author-row': true });
+    assert.ok(authorRow.findAllByType('span').some((node) => node.children.includes('Example')), 'author has its own compact row');
+    assert.ok(authorRow.findByProps({ 'data-plugin-author-placeholder': true }), 'an unverified installed publisher has a default avatar');
    assert.ok(alphaCard.findAllByType('p').some((node) => node.props.className?.includes('line-clamp-3')), 'card description is bounded');
    assert.match(JSON.stringify(renderer.toJSON()), /MIT/);
    assert.match(JSON.stringify(renderer.toJSON()), /Incompatible version/);
@@ -19,7 +19,7 @@ export function PluginLogSettings() {
  const disclosure = zh
    ? '插件编写的日志文字可能包含敏感数据。截断和字段过滤不能保证任意文字安全。只为排查问题临时开启，导出前请检查。重启应用后自动关闭详细日志。'
    : 'Plugin-authored text may contain sensitive data. Truncation and field filtering cannot make arbitrary text safe. Enable temporarily for troubleshooting and review files before sharing. Verbose diagnostics turn off after app restart.';
-  return <div data-host-security-surface="">
+  return <div>
    <Dialog open={open} onOpenChange={setOpen}>
      <SettingRow label={title} description={zh ? '选择是否在此设备保存审计记录和诊断日志。' : 'Choose whether to keep audit records and diagnostics on this device.'}>
        <div className="flex items-center gap-3">
@@ -53,6 +53,6 @@ export function PluginLogSettings() {
        </DialogFooter>
      </DialogContent>
    </Dialog>
-    <ConfirmDialog open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
+    <ConfirmDialog hostSecuritySurface open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
  </div>;
 }
@@ -68,6 +68,11 @@ test('plugin manager is single-instance, closes with Escape, restores focus and
    })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
    await click(trigger);
    await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
+    // Radix schedules close-focus cleanup after the React close commit. The
+    // settle inside click's act() can precede that commit; observe the actual
+    // handoff instead of assuming the cleanup timer already ran.
+    const handoffDeadline = Date.now() + 2_000;
+    while (!handedOff && Date.now() < handoffDeadline) await act(async () => { await settle(); });
    assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
    function ControlledEntry() {
      const [open, setOpen] = useState(false);
@@ -4,6 +4,7 @@ import { Dialog, DialogContent, DialogDescription, DialogTitle } from '../../ui/
 import { PluginInfo } from './PluginInfo';
 import React, { useRef, useState } from 'react';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { useI18n } from '../../../application/i18n/I18nProvider';
 import { usePluginCatalog } from '../../../application/state/usePluginCatalog';
@@ -82,7 +83,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
          return <button key={item.id} type="button" data-plugin-id={item.id} aria-current={selected === item.id ? 'true' : undefined} onClick={() => choose(item.id)}
            className="plugin-card min-w-0 flex min-h-[200px] flex-col gap-3 rounded-lg bg-card p-4 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring">
            <div className="flex items-center gap-3"><span className="flex h-8 w-8 shrink-0 items-center justify-center"><PluginBrandIcon entry={item} size={32} className="text-muted-foreground" /></span><span className="min-w-0 break-words text-sm font-semibold leading-5">{item.name}</span></div>
-            <p className="break-words text-xs text-muted-foreground">{item.author}</p>
+            <PluginAuthorRow entry={item} sourceId={sourceId} />
            <p className="line-clamp-3 break-words text-sm leading-5 text-muted-foreground">{item.description}</p>
            <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1 text-xs text-muted-foreground"><span>{item.version} · {item.license}</span><span className="text-foreground">{t('settings.plugins.manager.details')}</span></div>
            <div className="flex flex-wrap gap-2 text-xs text-muted-foreground">{isInstalled && <span className="rounded bg-muted px-2 py-0.5 text-foreground">{t('settings.plugins.market.installed')}</span>}{!item.artifact && <span className="rounded bg-muted/40 px-2 py-0.5">{t('settings.plugins.market.sourceBadge')}</span>}</div>
@@ -91,7 +92,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
      </div>}
      {entry && <article key={entry.id} aria-label={entry.name} className="plugin-marketplace-detail mx-auto w-full max-w-[920px] min-w-0 space-y-6 focus:outline-none">
        <Button variant="ghost" size="sm" onClick={back}><ArrowLeft size={14} className="mr-2" />{t('settings.plugins.market.back')}</Button>
-        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><p className="text-xs text-muted-foreground">{entry.author} · {entry.version} · {entry.license}</p>
+        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><PluginAuthorRow entry={entry} sourceId={sourceId} /><p className="text-xs text-muted-foreground">{entry.version} · {entry.license}</p>
          {installedEntry && <p className="text-xs text-muted-foreground">{t('settings.plugins.market.installed')} · {installedEntry.activeVersion} · {t(installedEntry.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}</p>}
        </div>
        {installedEntry?.runtime?.lastError && <p role="status" className="break-words text-xs text-destructive">{t('settings.plugins.manager.lastError')}: {installedEntry.runtime.lastError}</p>}
@@ -3,6 +3,7 @@ import { describePluginRuntime } from '@/domain/pluginRuntimePolicy.cjs';
 import React, { useRef, useState } from 'react';
 import { PluginPermissionPanel } from './PluginPermissionPanel';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { usePluginManager } from '../../../application/state/usePluginManager';
 import { useI18n } from '../../../application/i18n/I18nProvider';
@@ -103,7 +104,7 @@ export function PluginPackageManager({ manager, onSelectionChange, initialSelect
        </Button>
      </div>
      <p className="break-all text-xs text-muted-foreground">{t('settings.plugins.sources.source')}: {t(plugin.source?.kind === 'official' ? 'settings.plugins.sources.official' : plugin.source?.kind === 'third-party' ? 'settings.plugins.sources.thirdparty' : 'settings.plugins.sources.local')}{plugin.source?.origin ? ` · ${plugin.source.origin}` : ''}</p>
-      {plugin.manifest?.publisher && <p className="break-words text-xs text-muted-foreground">{plugin.manifest.publisher}</p>}
+      {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
      <p className={`break-words text-sm leading-5 text-muted-foreground ${selectedPlugin ? 'whitespace-pre-wrap' : 'line-clamp-3'}`}>{descriptionOf(plugin) || t('settings.plugins.manager.noDescription')}</p>
      {!selectedPlugin ? <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1">
        <p className="break-words text-xs text-muted-foreground">{plugin.activeVersion}{plugin.manifest?.license ? ` · ${plugin.manifest.license}` : ''}</p>
@@ -6,6 +6,7 @@ import type { usePluginManager } from '../../../application/state/usePluginManag
 import { Button } from '../../ui/button';
 import { Input } from '../../ui/input';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { SettingCard, SettingRow, SettingsSection, Toggle } from '../settings-ui';
 import { PluginLogSettings } from './PluginLogSettings';

@@ -72,7 +73,8 @@ export function PluginSettingsLanding({ manager, settingsAvailable, settingsErro
              <span className="truncate" title={name}>{name}</span>
              {plugin.activeVersion && <span className="shrink-0 text-xs font-normal text-muted-foreground">{plugin.activeVersion}</span>}
            </span>} description={<>
-              <span className="block break-words">{[plugin.manifest?.publisher, sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
+              {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
+              <span className="block break-words">{[sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
              {availableUpdate && <span className="block text-primary">{t('settings.plugins.landing.updateAvailable').replace('{version}', availableUpdate.availableVersion)}</span>}
              {description && <span className="line-clamp-2 break-words">{description}</span>}
            </>}>
@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { JSDOM } from 'jsdom';
+const require = createRequire(import.meta.url);
+
+test('real Settings landing leaves views visible while idle; log and Ask dialogs suspend and restore them', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div><div id="native-view-mount"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'Event', 'MouseEvent', 'KeyboardEvent', 'MutationObserver', 'DocumentFragment', 'CustomEvent']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginSettingsLanding } = await import('./PluginSettingsLanding');
+  const { PluginPermissionHost } = await import('../../plugins/PluginPermissionHost');
+  const { observePluginHostSecurityVisibility } = await import('../../../application/state/pluginHostSecurityVisibility');
+  const { PluginPermissionDecisionHost } = require('../../../electron/plugins/permissionDecisionHost.cjs');
+  type Prompt = NetcattyPluginPermissionPrompt | { requestId: string; closed: true };
+  const listeners = new Set<(event: Prompt) => void>();
+  const sender = Object.assign(new EventEmitter(), { isDestroyed: () => false, send: (_channel: string, event: Prompt) => { for (const listener of listeners) listener(event); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const host = new PluginPermissionDecisionHost({ getWindows: () => [owner], isLocked: () => false });
+  let logStatus = { saveToDisk: false, verbose: false, droppedRecords: 0, writeErrors: 0, pendingBytes: 0, maxBytes: 3145728, retentionDays: 7 };
+  Object.assign(dom.window, { netcatty: {
+    async getPluginLogStatus() { return logStatus; },
+    async configurePluginLogs(value: { saveToDisk: boolean; verbose: boolean }) { logStatus = { ...logStatus, ...value }; return logStatus; },
+    onPluginPermission(listener: (event: Prompt) => void) { listeners.add(listener); return () => listeners.delete(listener); },
+    setPluginPermissionReady: async (ready: boolean) => host.setReady(sender, ready),
+    respondPluginPermission: async (response: unknown) => host.respond(sender, response),
+  } });
+  const manager = { plugins: [], available: true, statusKnown: true, busy: false, error: null, credentialStorageAvailable: true,
+    async refresh() {}, async setEnabled() {}, async importPackage() {}, async uninstall() {} };
+  let visible = true;
+  const transitions: boolean[] = [];
+  const stopVisibility = observePluginHostSecurityVisibility(document.getElementById('native-view-mount')!, (next) => { visible = next; transitions.push(next); });
+  const root = createRoot(document.getElementById('root')!);
+  const button = (label: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((element) => element.textContent === label)!;
+  const flushVisibility = () => new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginSettingsLanding manager={manager} settingsAvailable={new Set()} onManage={() => {}} /><PluginPermissionHost /></I18nProvider>));
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.ok(button('Configure'), 'real idle logging row is present');
+    assert.equal(visible, true, 'idle Settings landing must not hide the native child');
+    assert.deepEqual(transitions, []);
+    await act(async () => button('Configure').click());
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'actual logging security dialog must hide the child');
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[0].click());
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[1].click());
+    await flushVisibility();
+    assert.equal(document.querySelectorAll('[role="dialog"]').length, 2);
+    assert.equal(visible, false, 'the verbose security confirmation must also keep the child hidden');
+    await act(async () => button('Cancel').click());
+    await flushVisibility();
+    assert.equal(visible, false, 'cancelling verbose returns to the protected logging dialog');
+    await act(async () => button('Close').click());
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(visible, true, 'closing logs must restore the child while its idle row remains');
+    let pending!: Promise<{ decision: string }>;
+    await act(async () => {
+      pending = host.request({ requestId: 'settings-visibility-ask', pluginId: 'com.example.settings-visibility', pluginName: 'Settings visibility fixture', pluginVersion: '1.0.0',
+        permission: 'settings.read', resources: ['*'], reason: 'Read own synthetic setting' });
+    });
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'Ask must still hide the child above the real landing');
+    await act(async () => { button('Deny').click(); await pending; });
+    await flushVisibility();
+    assert.equal((await pending).decision, 'deny');
+    assert.equal(visible, true, 'dismissing Ask must restore the same child');
+    assert.deepEqual(transitions, [false, true, false, true]);
+  } finally {
+    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});
@@ -23,7 +23,7 @@ import {
 import { resolveAppIconVariant, type AppIconVariant } from "../../../domain/appIconVariant";
 import { resolveNoteFontSelectionFamily, resolveNoteFontSelectionId } from "../../../domain/noteFonts";
 import { DEFAULT_AUTO_IMPORT_SYSTEM_KNOWN_HOSTS } from "../../../domain/systemKnownHostsAutoImport";
-import { cn } from "../../../lib/utils";
+import { cn, isMacPlatform } from "../../../lib/utils";
 import { SectionHeader, SettingsAnchor, SettingsTabContent, SettingRow, Toggle, Select } from "../settings-ui";
 import { FontSelect } from "../FontSelect";
 import { TerminalFontSelect } from "../TerminalFontSelect";
@@ -69,6 +69,8 @@ function SettingsAppearanceTab(props: {
  setShowHostTreeSidebar: (enabled: boolean) => void;
  windowOpacity: number;
  setWindowOpacity: (opacity: number) => void;
+  windowBackgroundBlur: boolean;
+  setWindowBackgroundBlur: (enabled: boolean) => void;
  appIconVariant: AppIconVariant;
  setAppIconVariant: (variant: AppIconVariant) => void;
 }) {
@@ -140,10 +142,13 @@ function SettingsAppearanceTab(props: {
    setShowHostTreeSidebar,
    windowOpacity,
    setWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
    appIconVariant,
    setAppIconVariant,
  } = props;
  const resolvedAppIconVariant = resolveAppIconVariant(appIconVariant);
+  const isMac = isMacPlatform();

  const WINDOW_OPACITY_PRESETS = [
    { label: '100%', value: 1 },
@@ -315,6 +320,19 @@ function SettingsAppearanceTab(props: {
            </div>
          </div>
        </SettingRow>
+        {isMac && (
+          <SettingRow
+            anchorId="appearance-window-background-blur"
+            label={t("settings.appearance.windowBackgroundBlur")}
+            description={t("settings.appearance.windowBackgroundBlur.desc")}
+          >
+            <Toggle
+              checked={windowBackgroundBlur}
+              onChange={setWindowBackgroundBlur}
+              ariaLabel={t("settings.appearance.windowBackgroundBlur")}
+            />
+          </SettingRow>
+        )}
      </div>

      <SectionHeader title={t("settings.appearance.uiTheme")} />
@@ -264,6 +264,7 @@ export const SftpOverlays: React.FC<SftpOverlaysProps> = React.memo(({
              open={showTextEditor}
              onClose={closeTextEditor}
              fileName={textEditorFileName}
+              filePath={textEditorTarget?.fullPath}
              initialContent={textEditorContent}
              onSave={handleSaveTextFile}
              editorWordWrap={editorWordWrap}
@@ -248,7 +248,7 @@ export const useSftpViewFileOps = ({
      hostId: target.hostId,
      remotePath: target.fullPath,
      fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
      content: snapshot.content,
      baselineContent: snapshot.baselineContent,
      wordWrap: snapshot.wordWrap,
@@ -284,7 +284,7 @@ export const useSftpViewFileOps = ({
      hostId: target.hostId,
      remotePath: target.fullPath,
      fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
      content: snapshot.content,
      baselineContent: snapshot.baselineContent,
      wordWrap: snapshot.wordWrap,
@@ -0,0 +1,131 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import ts from 'typescript';
+import type { TextEditorPaneProps } from '../editor/TextEditorPane';
+import type { SftpStateApi } from '../../application/state/useSftpState';
+import { editorTabStore } from '../../application/state/editorTabStore';
+import { activeTabStore } from '../../application/state/activeTabStore';
+import { useSftpViewFileOps } from './hooks/useSftpViewFileOps';
+
+// Keep the real modal state/save flow; replace only Monaco and visual chrome.
+function loadModal(pane: React.ComponentType<TextEditorPaneProps>) {
+  const url = new URL('../TextEditorModal.tsx', import.meta.url);
+  const compiled = ts.transpileModule(readFileSync(url, 'utf8'), { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+    jsx: ts.JsxEmit.ReactJSX, esModuleInterop: true,
+  } }).outputText;
+  const require = createRequire(url);
+  const passthrough = ({ children }: { children: React.ReactNode }) => children;
+  const replacements: Record<string, unknown> = {
+    './editor/TextEditorPane': { TextEditorPane: pane },
+    './ui/dialog': { Dialog: passthrough, DialogContent: passthrough, DialogTitle: passthrough },
+    './ui/toast': { toast: { success() {}, error() {} } },
+    '../application/state/windowInputFocus': { scheduleWindowInputFocus() {} },
+  };
+  const module = { exports: {} as { default: React.ComponentType<Record<string, unknown>> } };
+  new Function('require', 'module', 'exports', compiled)(
+    (id: string) => replacements[id] ?? require(id), module, module.exports,
+  );
+  return module.exports.default;
+}
+
+test('SFTP modal uses full paths, preserves manual selection and saves exact content', async () => {
+  const globals = globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean };
+  const previousAct = globals.IS_REACT_ACT_ENVIRONMENT;
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
+  const previousActiveTab = activeTabStore.getActiveTabId();
+  const detached: Array<{ languageId: string; content: string; remotePath: string }> = [];
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
+    setTimeout, clearTimeout,
+    netcatty: { openEditorWindow: async (snapshot: typeof detached[number]) => {
+      detached.push(snapshot);
+      return { success: true };
+    } },
+  } });
+  globals.IS_REACT_ACT_ENVIRONMENT = true;
+  let paneProps: TextEditorPaneProps | undefined;
+  const Modal = loadModal((props) => { paneProps = props; return null; });
+  let ops: ReturnType<typeof useSftpViewFileOps> | undefined;
+  const original = '# fixture\r\nserver { proxy_pass http://$host; }\r\n';
+  const writes: unknown[][] = [];
+  const connection = { id: 'nginx-fixture', hostId: 'nginx-host', currentPath: '/etc/nginx/conf.d' };
+  const sftpRef = { current: {
+    leftPane: { id: 'nginx-pane', connection }, rightPane: { id: 'nginx-pane', connection },
+    joinPath: (parent: string, name: string) => `${parent}/${name}`,
+    readTextFile: async () => original,
+    writeTextFile: async (...args: unknown[]) => { writes.push(args); },
+  } as unknown as SftpStateApi };
+  function Probe() {
+    ops = useSftpViewFileOps({
+      sftpRef, behaviorRef: { current: '' }, autoSyncRef: { current: false },
+      getOpenerForFileRef: { current: () => null }, setOpenerForExtension() {}, t: (key) => key,
+    });
+    return ops.showTextEditor ? React.createElement(Modal, {
+      open: true, onClose() {}, fileName: ops.textEditorTarget!.file.name,
+      filePath: ops.textEditorTarget!.fullPath, initialContent: ops.textEditorContent,
+      onSave: ops.handleSaveTextFile, editorWordWrap: false, onToggleWordWrap() {},
+      hotkeyScheme: 'pc', keyBindings: [], onPromoteToTab: ops.onPromoteToTab,
+    }) : null;
+  }
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    const file = { name: 'site.conf', size: original.length, type: 'file' as const, lastModified: 0, sizeFormatted: '', lastModifiedFormatted: '' };
+    await act(async () => { await ops!.onEditFileLeft(file); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    assert.equal(paneProps!.fileName, 'site.conf');
+    // Keep the modal mounted: basename and content stay identical, only path changes.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/site.conf'); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    await act(async () => { paneProps!.onLanguageChange('ini'); });
+    await act(async () => { paneProps!.onSave(); });
+    assert.deepEqual(writes, [['left', '/etc/nginx/conf.d/site.conf', original]]);
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    let tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'ini', 'promotion preserves a manual override');
+    assert.equal(tab?.content, original);
+    editorTabStore.close(tab!.id);
+
+    // A generic config can still be switched to Nginx manually.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { paneProps!.onLanguageChange('nginx'); });
+    assert.equal(paneProps!.languageId, 'nginx', 'arbitrary config supports manual Nginx selection');
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'nginx');
+
+    // Legacy snapshots without language still infer from the full target path.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/fallback.conf'); });
+    await act(async () => { ops!.onPromoteToTab({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(editorTabStore.getTabs().find(({ remotePath }) => remotePath.endsWith('/fallback.conf'))?.languageId, 'nginx');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/sites-enabled/example.com'); });
+    await act(async () => { ops!.onPopOut({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(detached.at(-1)?.languageId, 'nginx', 'pop-out fallback also uses the full path');
+    assert.equal(detached.at(-1)?.remotePath, '/etc/nginx/sites-enabled/example.com');
+    assert.equal(detached.at(-1)?.content, original);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    for (const tab of editorTabStore.getTabs().filter(({ sessionId }) => sessionId === connection.id)) editorTabStore.close(tab.id);
+    activeTabStore.setActiveTabId(previousActiveTab);
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+    globals.IS_REACT_ACT_ENVIRONMENT = previousAct;
+    if (previousWindow) Object.defineProperty(globalThis, 'window', previousWindow);
+    else Reflect.deleteProperty(globalThis, 'window');
+  }
+});
+
+test('the SFTP overlay forwards path context to the lazy modal', () => {
+  const overlay = readFileSync(new URL('./SftpOverlays.tsx', import.meta.url), 'utf8');
+  assert.match(overlay, /<LazyTextEditorModal[\s\S]*?filePath=\{textEditorTarget\?\.fullPath\}/);
+  const pane = readFileSync(new URL('../editor/TextEditorPane.tsx', import.meta.url), 'utf8');
+  assert.match(pane, /beforeMount=\{registerNginxLanguage\}/);
+});
@@ -17,6 +17,7 @@ interface ConfirmDialogProps {
  confirmLabel: string;
  busy?: boolean;
  destructive?: boolean;
+  hostSecuritySurface?: boolean;
  onOpenChange: (open: boolean) => void;
  onConfirm: () => void;
 }
@@ -28,6 +29,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
  confirmLabel,
  busy = false,
  destructive = false,
+  hostSecuritySurface = false,
  onOpenChange,
  onConfirm,
 }: ConfirmDialogProps) {
@@ -35,7 +37,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({

  return (
    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
+      <DialogContent data-host-security-surface={hostSecuritySurface ? "" : undefined} className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
        <DialogHeader className="min-w-0 pr-6">
          <DialogTitle className="truncate">{title}</DialogTitle>
        </DialogHeader>
@@ -0,0 +1,58 @@
+# Plugin author presentation
+
+The marketplace displays the catalog's author next to a small avatar. Installed
+views reuse the author row. Missing, loading, unavailable, or invalid imagery
+uses a bundled placeholder. An avatar is presentation metadata, not proof of an
+authenticated GitHub publisher.
+
+The registry binds an image to its reviewed displayed-author subject. Repository
+ownership alone does not establish that subject. The current first-party author
+is the Netcatty project, not an assumed personal GitHub identity. Until an image
+pin is reviewed, its avatar remains null.
+
+## Avatar delivery
+
+Delivery v2 extends the reserved `avatar` field to null or
+`{path, sha256, size}`. The path is exactly `/assets/<sha256>.png` or `.webp`.
+Size is a positive integer no greater than 256KiB. The delivery digest and existing
+id/version/repository/commit tuple bind the reference. Catalog and index identity
+fields do not change. Source-only delivery v1 remains supported.
+
+Only the main process fetches the selected source's same-origin asset. Existing
+URL, credential, redirect, timeout, byte-count, and SHA-256 checks apply. The host
+rechecks the source and selection after asynchronous work. The existing isolated
+icon rasterizer validates and converts PNG or WebP to a bounded PNG data URI,
+using its current queue, pending-work map, and cache. No renderer URL, arbitrary
+file path, GitHub API, or GitHub avatar URL is accepted. Visible rows load lazily.
+
+Installed presentation uses already validated catalog metadata only when source,
+version, package digest, and manifest match the active installation. It does not
+fetch a catalog just because the installed list opens. Without an exact match,
+the declared publisher and placeholder remain visible, without a maintenance
+badge. No installed-data migration or persistent identity cache is added.
+
+## Official maintenance
+
+The borderless gold pill means that the Netcatty project maintains the plugin.
+It does not certify the plugin's safety or grant permissions. It is separate
+from the official marketplace source label.
+
+The main process requires the built-in official source and one of these explicit
+first-party ID and repository pairs:
+
+- `com.netcatty.starter`, `binaricat/Netcatty`
+- `com.netcatty.hello`, `binaricat/Netcatty`
+
+A local import, a third-party copy, an ID prefix, author text, manifest publisher,
+README, or membership in the official marketplace cannot create this badge.
+The renderer consumes the host result through the existing trusted-app IPC
+boundary. No new plugin permission or plugin RPC is introduced.
+
+## Validation scope
+
+Focused registered tests cover source spoofing, exact installed identity,
+hash-bound images, invalid metadata and decoding, redirects, source removal,
+selection changes, cache reuse, lazy loading, stale UI cleanup, placeholders,
+and borderless light/dark theme classes. These tests do not establish native
+layout, actual account identity, live CDN deployment, or successful network access.
+Actual app screenshots and native acceptance remain separately scheduled.
@@ -450,6 +450,13 @@ new child to an opened parent directory without a path race.
 `readDirectory()` likewise keeps its stable SDK/RPC method but fails closed
 unless the main process supplies a native adapter whose inode checks and entry
 enumeration are bound to the same directory handle.
+The host advertises `filesystem.directory-enumeration` only when it supplies that
+adapter. Declare the feature as required, or optional and check
+`context.enabledFeatures.has(PLUGIN_FILESYSTEM_DIRECTORY_ENUMERATION_FEATURE)`.
+The default host supplies no adapter and does not enable this feature. Both the
+SDK and direct RPC return `unsupported` before a permission request or path probe.
+An enabled feature still requires the declared `filesystem.read` directory
+resource and the normal permission, root, symlink and same-handle checks.

 Permission names already use the phase-3 enforcement boundaries: clipboard
 read/write, terminal metadata/output/input and input/output interception, Vault
@@ -0,0 +1,121 @@
+# Plugin foundation landing candidate
+
+Draft #4011 is the single landing vehicle for the accumulated plugin foundation.
+Earlier integration records describe frozen evidence, not the current acceptance
+status. This candidate preserves their source history through ordinary merges.
+The user cancelled the reference-driven row redesign. Installed grid and Settings
+quick-toggle layout are restored exactly to b14, while author presentation and all
+functional/security corrections remain. Cancelled visual commits stay in history
+with attributable reverts; they are not effective changes in the landing tree.
+It does not include global Agent/custom Chat #4006/#4012, model-picker #4002,
+or terminal diagnostic #3999. No older source PR is closed by this preparation.
+
+## Included commits
+
+| Input | Exact input | Ordinary integration |
+| --- | --- | --- |
+| Prior #4011 | `d40b0d3c25ed00a33679e83be948fd1a5aa10bfa` | Starting point; all inherited contributions retained |
+| Current main | `2796d1113a6310fae1779931f242e208a69b95a5` | `db1223d16`; Nginx #4010, macOS appearance #4013, closed-socket MCP reconnect #4016 |
+| Author metadata and preserved visual history | `e4eb33856b335fe0b1d302827b1325ddfc23bdde` | `b3895a477`; preserves original avatar/badge, canonical v2 schema, b14 invalidation, visual-worker patch subsequently reverted |
+| Directory availability | `a36a906292cbe8033bc19b596dcaf7f853a804c7` | `d035cbea3`; no native adapter or expanded permission |
+| Two-profile sync composition | `14ed19d2ed7cd1ecc201c9c910b112e97cc098ff` | `fc37ac48e`; tests only |
+| Restore pre-row layout | `7e7b05620ff800ae459d0bf007bbace6aaebbdbc` | Normal revert of e4 row commit; all six layout paths match parent `b14b65679ffd9c617bb0aa1215d8653c53430243` |
+| Rejected-install catalog refresh | `50fda91424c915c1497e53a87a210e3943cb1e39` | Separate correction after bounded review; service and mounted-row regression only |
+
+The separately published icon branch first reverted its outline correction
+(`530ff0318`), then the e4 row commit (`6e4465f47`). Neither outline correction nor
+those isolated reverts are imported here; foundation never included the outline.
+The e4 and 1f renderer artifacts are historical pre-cancellation evidence, not
+accepted final UI. No further cancelled-design build or screenshot is requested.
+
+The only manual merge conflict was the end of `index.css`. Resolution retains
+both the prior host-security theme block and main's window-background-blur block,
+with their declarations unchanged. Automatic combinations retain main appearance
+wiring alongside plugin settings/theme wiring, all five locales, preload methods,
+the host services and SDK exports. No permission, source, endpoint, sandbox or
+selected-resource restriction is relaxed. Package and lock inputs are unchanged.
+
+`50fda9142` reuses the same selection-token comparison after an install-triggered
+catalog refresh, including an install rejected for a changed/withdrawn selection.
+The rejection is preserved; mounted authors no longer retain withdrawn enrichment.
+The regression makes no package download or execution. It also preserves the
+original synchronous unavailable-source rejection in `list()`: the first aggregate
+runtime run caught that b14 changed it into a Promise rejection. The assertion was
+not weakened. Corrected aggregate runtime: 711 pass, one native skip, zero failures
+or cancellations. The original failed run and fail-before regression are retained.
+
+## Checks and packages
+
+Registered runtime, SDK/contract, Settings and actual connected host entrypoints,
+changed-main MCP/appearance/editor regressions, example preparation, code generation,
+lint and the normal production renderer build are run on this candidate. Exact
+head, commands, counts and CI links are recorded in #4011. Package provenance is
+in [the bounded sample manifest](foundation-packages.json): each archive is built
+twice and whole-byte compared. Assistant is byte-identical to d40; Host changes
+only README wording, with manifest/entrypoint unchanged. Database-owned, Rfam and
+terminal archives change only `browser.js` minified bound identifier spelling.
+Rebuilding the same sources with d40's generated SDK/contract artifacts reproduces
+the exact old archive hashes. Parsing and normalizing lexical bindings yields
+identical ASTs for all three bundles; manifests, protocol and permissions do not
+change. Preparation does not connect, activate or query.
+
+Local checks at pre-restoration1f: runtime 711 pass/one existing native skip; SDK91; Settings and
+connected host/security78; changed-main MCP/appearance/editor71; examples five
+pass/one Docker opt-in skip. Contract/capability/Codex generation has no drift;
+lint zero errors/seven existing warnings; normal production build36.13s. These
+checks do not claim native UI, packaging or encrypted transport acceptance.
+Restoration-focused layout/author tests: six pass; changed-file lint and diff
+checks clean. Two broader Settings runs each had38pass/one PluginLogSettings
+file-entry failure, without a detailed assertion; that file alone passed. Their
+cause remains unclassified and both failed runs are retained. No production log
+change or baseline attribution is made. Every one of the six layout paths exactly matches b14; fourteen functional
+paths (identity/provenance, permissions, directory availability and sync included)
+remain byte-identical to1f. The five sample records remain unchanged. Pre-restoration1f exact CI completed:
+[test40505644082](https://github.com/binaricat/Netcatty/actions/runs/40505644082)
+records15,372pass/50skip/zero failures or cancellations on its successful retry;
+[packages40505644200](https://github.com/binaricat/Netcatty/actions/runs/40505644200)
+passed all four platforms with release skipped. Its original runner shutdown is
+retained. These results do not certify the restored head.
+
+An earlier coding-executor full suite timed out after 15 minutes: 31 failures and
+482 cancellations. Seven failures reproduced on unchanged d40; 24 were not probed
+on that baseline. They remain unresolved evidence, not assumed baseline failures.
+No additional long local full suite is used to conceal them. Clean-run exact-head
+CI is a separate aggregate check and does not diagnose that historical run.
+
+## Acceptance and landing order
+
+1. Foundation: keep #4011 Draft until integrated CI/review and affected native UI
+   acceptance settle. d40 Settings, Host/Vault policy, terminal A/B selection and
+   inert multiline draft isolation, and native chat split/drag ownership passes
+   are historical evidence at their stated heads. They do not certify this new
+   current-main merge tree. The e4/07b reference-driven row design is cancelled;
+   stop its native visual work. Restored layout retains author/avatar presentation.
+   Avatar/catalog behavior and the final install-refresh correction still require
+   their scoped review/acceptance; cancellation does not erase functional gates.
+2. Marketplace distribution: retain static-source identity and v2 delivery checks,
+   but track reviewed registry data, actual hosting/CDN and install/update/source
+   replacement/withdrawal acceptance separately. Current live source-only viewing
+   is not installation or deployment acceptance. Never weaken admitted-source or
+   destination guards to manufacture a pass.
+3. Global Agent: #4006/#4012 remain a separate later increment, with their own
+   scope, review, CI and actual sample smoke. #4002 is also separate.
+
+Historical integration vehicles #3967/#3989/#3993/#3997/#4001/#4004 are superseded
+as landing vehicles, not discarded contributions. Their ancestors and native
+receipts stay available. Unique source PRs remain intact; no premature closures.
+
+Directory enumeration is intentionally unavailable in the default production
+composition until a same-handle adapter exists. The advertised feature now tells
+SDK callers the truth; filesystem permission alone does not enable it. The new
+sync composition test proves local collect/apply/hydrate with real databases, not
+encrypted cloud transport or native cloud-account sync. A native compatibility
+transition needs two properly versioned builds; two 0.0.0 checkouts do not qualify.
+
+Public database acceptance remains blocked by the retained TCP refusal before
+protocol payload; the separately owned local fixture is pending. Source-policy,
+compatibility and database gates must be explicitly reconciled by the parent,
+not silently removed from requirements. Nested log-dialog overlap has source
+coverage but no normal native route in the tested UI. This is code-readiness work,
+not a claim that deployment, every original requirement or the whole project is
+complete. No main merge, Ready transition, release or live metadata publication.
@@ -0,0 +1,177 @@
+[
+  {
+    "name": "assistant",
+    "id": "com.netcatty.assistant",
+    "version": "0.1.0",
+    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "bytes": 17214,
+    "fileCount": 6,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        "ai.invoke",
+        "context.selected.list",
+        "context.selected.read"
+      ]
+    },
+    "features": {
+      "required": [
+        "ai.model-invocation",
+        "context.selected-read"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [],
+    "delta": "Archive byte-identical."
+  },
+  {
+    "name": "database-owned",
+    "id": "com.netcatty.database-minimal",
+    "version": "0.1.0",
+    "sha256": "3c67f529cd5d2843dbf74a62d237b7b7d50d24a466ade85cce76b3adfff919a2",
+    "bytes": 11660,
+    "fileCount": 5,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://10.77.0.20:3306"
+          ],
+          "reason": "Connect only to the prepared disposable fixture."
+        }
+      ]
+    },
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "boundIdentifierAlphaEquivalent": true
+  },
+  {
+    "name": "database-rfam-readonly",
+    "id": "com.netcatty.database-rfam-readonly",
+    "version": "0.1.0",
+    "sha256": "554407c067ced0a6634599b7eccc7c6dbb4f2ff7c523d0bacbbbd4fb78c04612",
+    "bytes": 11003,
+    "fileCount": 5,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
+          ],
+          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
+        }
+      ]
+    },
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "boundIdentifierAlphaEquivalent": true
+  },
+  {
+    "name": "host-actions",
+    "id": "com.netcatty.host-actions",
+    "version": "0.1.0",
+    "sha256": "9713f001449b0c749f518d42f013fa72ead6dd43f8e7ddd7843cc6ecc03027f9",
+    "bytes": 4789,
+    "fileCount": 3,
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "vault.metadata",
+        "vault.write",
+        "ui.interact"
+      ]
+    },
+    "features": {
+      "required": [
+        "vault.host-actions",
+        "commands.interactive"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "README.md"
+    ],
+    "delta": "README wording follows permission policy. Manifest and browser entrypoint are byte-identical."
+  },
+  {
+    "name": "terminal-selection-draft",
+    "id": "com.netcatty.terminal-selection-draft",
+    "version": "0.1.0",
+    "sha256": "aaadd8687b1af1d6e1f9a56c52760ac0d19e7ed4e8212fb7c8775ed052ed74f1",
+    "bytes": 2954,
+    "fileCount": 2,
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "terminal.selection.read",
+        "terminal.input.propose"
+      ]
+    },
+    "features": {
+      "required": [
+        "terminal.selection-sharing",
+        "terminal.input-drafts",
+        "commands.interactive"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "boundIdentifierAlphaEquivalent": true
+  }
+]
@@ -18,10 +18,28 @@ sha256sum /tmp/netcatty-global-agent.ncpkg
 ```

 The reproducible sample SHA-256 is
-`36993b1d566814d3b5304337fab73ff464e422d93ba52909e95e3ceedcad2a6a`.
+`f0edf43523845847d5dbb74b0c4d8cd3bfe8e0f89ca193f28140e6b47dc45ed0`.
 Two independent package builds matched. Build scripts and tests are excluded
 from the six-file installed package.

+The sample reserves transcript space inside the actual 798-by-548-pixel plugin
+viewport measured during native QA. In a scheduled native test environment, run
+`npm run test:plugin-global-agent-layout` for the bounded render regression. It
+loads the real sample HTML/CSS with synthetic history, including the fixture
+notice, and checks transcript scrolling, reachable configuration, and visible
+mouse Stop. It does not load the plugin script or start an Agent/provider. This
+render check remains pending where the normal browser sandbox cannot start;
+do not disable the sandbox to run it. Also verify the installed sample visually
+at the 1188-by-848-pixel app window before accepting the viewport correction.
+
+For the modal-history lifecycle regression, stop the synthetic stream, close
+the modal with the host X, and reopen it without disabling/restarting the
+plugin or waiting for five-minute lease expiry. Select the owned conversation,
+confirm fresh empty targets, and Open. History must load without another model
+request. Repeat with a new conversation. The sample command runtime retains
+only its last host-issued chat handle and releases that exact lease on explicit
+Open; it does not change core expiry, source ownership or duplicate-open guards.
+
 ## Native fixture acceptance (parent-scheduled GUI only)

 1. Use an isolated synthetic profile, no real Notes, hosts, histories or keys.
@@ -1,8 +1,8 @@
 # Host and Vault actions

 Feature: `vault.host-actions`. The SDK registers three methods under
-`context.vault`. Netcatty owns the picker, field-diff review, and connection
-confirmation. Plugin business logic stays in the offline browser sandbox.
+`context.vault`. Netcatty owns the picker, field-diff review, permission routing,
+and normal connection dispatch. Plugin business logic stays in the offline browser sandbox.

 Base: source integration #3981 at
 `4213d8e6726c44e7a479418ece3adf16ea494782`.
@@ -36,10 +36,12 @@ remain behind the typed target reference; its revision is the expected revision.
 Group metadata describes the explicitly selected current member handles. The
 grant never expands when another host joins a group.

-Selection grants metadata access only. Each draft save and each connection
-requires its own host-owned confirmation. A connection confirmation displays the
-saved target and whether saved scripts can run. It does not grant terminal input,
-terminal output, or session access.
+Selection shares the chosen metadata only. Later edit and connection requests
+follow the plugin's Allow, Ask, or Deny settings. Draft saves retain the mandatory
+host editor. Connection Ask displays the saved target and whether saved scripts
+can run; Allow can dispatch without that permission-only dialog. Normal SSH
+authentication remains unchanged. These actions grant no terminal input, output,
+or session access.

 All requests are bounded and cancel on runtime stop, source replacement, revoke,
 Vault lock, owner window replacement, expiry, or user cancellation. The host
@@ -47,7 +49,7 @@ revalidates authority and expected revision after asynchronous work and before
 the Vault write or connection dispatch.

 Bounds reuse `HostInteractionLimits`: one pending request per runtime,
-eight total, ten per minute, a 60-second confirmation deadline, and a 64-KiB
+eight total, ten per minute, a 60-second host-interaction deadline, and a 64-KiB
 request ceiling. Selection adds a maximum of 50 current hosts. Titles use the
 existing 128-character single-line limit. Draft field lengths use
 `ImporterHostDraft`. Unknown properties are rejected by the shared schema.
@@ -86,15 +88,16 @@ It revalidates after asynchronous authentication. AI selected-context handles ar
 text-disclosure handles and cannot target these actions.

 The permission engine gates selection with `vault.metadata`, drafts with
-`vault.write`, and connection requests with `ui.interact`. Every save or connection
-also requires a separate host-owned confirmation and a signed one-use action
-claim. A stored permission grant cannot bypass this review.
+`vault.write`, and connection requests with `ui.interact`. Each committed save or
+connection uses a signed one-use action claim. Permission settings control the
+permission-only prompt; an Allow setting does not bypass the draft editor or
+normal SSH authentication.

 After review, the renderer prepares the existing transaction or connection
 request. It claims action authority after the final asynchronous preparation,
 immediately before persistence or dispatch. This claim is the action's commit
 point. Completion only acknowledges the committed action. Automation changes
-during connection review require fresh confirmation.
+during an Ask connection review require fresh confirmation.
 The connection label uses the same `resolveEffectiveTerminalProtocol` helper as
 the launcher, including Mosh/ET flags and implicit localhost shells. Local
 execution displays an explicit on-device shell notice and omits the remote SSH
@@ -3,8 +3,10 @@
 The plugin manager has Installed, Official marketplace and Third-party marketplace
 pages. Listing a plugin in the official market does not certify it or establish
 that Netcatty maintains it. Remote manifests, publisher names, source names and
-README content cannot create a host-issued official badge. This revision does not
-issue maintainer badges. README text and images remain author content.
+README content cannot create a host-issued official badge. The separate gold
+maintainer badge requires the built-in official source and an exact host-curated
+first-party ID/repository pair. It describes maintenance, not safety certification.
+README text and images remain author content.

 ## Add a source

@@ -33,20 +35,24 @@ manifest, compatibility, browser-runtime admission and archive validation still
 apply. Third-party source consent is not permission consent.

 Delivery v1 is unchanged and source-only. Delivery **v2** has the same fields and
-strict schema as v1, with `schemaVersion: 2` and one extension: each plugin's
-`artifact` can be null or a package reference:
+strict schema as v1, with `schemaVersion: 2`. Each plugin's `artifact` can be null
+or a package reference:

 ```json
 {"path":"/assets/<64-lowercase-hex-sha256>.ncpkg","sha256":"<same-sha256>","size":12345}
 ```

-Packages are at most 32 MiB. The catalog entry must contain
+V2 delivery packages are at most 16 MiB. The catalog entry must contain
 `artifact: {url: "https://plugins.example.com/assets/<same-sha256>.ncpkg", sha256}`.
 The index's current, non-withdrawn version must exactly equal the catalog entry
 and use `distribution: "release"`. Source-only entries retain null delivery
-artifacts and `distribution: "source-only"`. Avatars remain null; remote README
-embeds are not loaded. README and PNG/WebP references retain the v1 bounds.
+artifacts and `distribution: "source-only"`. The reserved `avatar` can also be
+null or a same-origin `/assets/<sha256>.png` or `.webp` reference, with a positive
+size no greater than 256KiB. The host verifies and rasterizes its bytes through
+the existing image infrastructure. Missing or invalid imagery uses a placeholder.
+Remote README embeds are not loaded. README and PNG/WebP references retain the v1 bounds.
 Existing official bootstrap entries are not changed or made installable.
+See [author presentation](author-identity.md) for subject and maintenance authority.

 Before every install, refresh and validate the entire snapshot again. A changed
 selection, withdrawal, unavailable source, altered hash or size prevents install;
@@ -85,6 +85,32 @@ initial-checkpoint evidence.

 ## Latest checks and remaining environment blockers

+- The native candidate `2433cf0130d1c3274c56c39e5765349c2945de01` retains the
+  same idle logging-row marker as `89beeb9` (source blob
+  `4dd5a7cea4ae5a6addc5db5c162038d8fa44075c`). Actual Settings landing plus the
+  existing observer reproduces native-child suppression with no dialog open.
+  This source defect is separate from the worker's earlier GPU exit and does
+  not alone establish the cause of the recorded blank native body.
+- The scoped correction removes only the idle-row marker. Actual logging and
+  Ask dialogs remain marked. A real nested verbose confirmation test also
+  reproduced premature restoration when its parent became accessibility-hidden;
+  that confirmation now opts into the existing marker on its own dialog content.
+  The observer, window trust, permissions and data access are unchanged. The real
+  landing regression verifies idle visible, each security dialog hidden, and
+  restored on dismissal. Focused group **six passed**; Settings boundary group
+  **36 passed**. Both pre-fix failures are retained outside the source tree.
+  Production build and full lint pass (zero lint errors/seven existing warnings).
+  Full TypeScript remains baseline-equivalent at 774 diagnostics with zero
+  added/removed. Exact-head CI and the next frozen native recheck are separate
+  gates; neither is inferred from these local tests.
+- QA-only **Settings Ask QA 0.1.0** uses its supported `location: settings` entry
+  and public SDK to read only its synthetic own setting after an explicit click.
+  Exact archive SHA-256:
+  `9502a58a4804862e4b13de9fc0d1baf6ad8c2bc681c08b5c0664b552ef0aafc4`.
+  Its HTML/CSS/JS each return 200 with proper MIME/CSP through the actual plugin
+  protocol. It contains no raw IPC/test hook or external access. No GUI or running
+  app was changed by this correction; parent will build a new frozen candidate
+  after current cleanup and repeat native Settings acceptance.
 - A registered regression reproduces `Plugin permission decision provider failed`
  on exact `79a9bd6` when a Settings-owned view activates a real `settings.get`
  API configured Ask while main is unfocused. The follow-up uses the existing
@@ -29,6 +29,13 @@ for brand icons. This v1 publishing schema requires **avatar and artifact to
 be null**. The client rejects unsupported delivery metadata rather than
 inventing installable packages or deriving a GitHub avatar URL.

+Delivery v2 retains those fields and admits hash-bound packages plus the reserved
+avatar as null or a positive-size PNG/WebP asset reference of at most 256KiB.
+The host fetches only the selected source's same-origin asset, verifies bytes,
+and reuses its bounded icon rasterizer and cache. The renderer receives a PNG
+data URI. Author imagery does not verify a GitHub account, and no GitHub avatar
+URL is derived. See [author presentation](author-identity.md).
+
 Index is validated with its pinned schema. Plugin/version identities must be
 unique; each catalog entry must exactly equal the index's current, non-withdrawn,
 source-only entry. Withdrawal does not disable, uninstall or delete any existing
@@ -73,7 +80,7 @@ exact SHA-256 bytes; it does not relax those future gates or auto-enable code.
 | README details | Exact delivery `/assets/<hash>.md` | Visible error/Retry, no upstream fallback |
 | Uninstalled brand icons | Existing reviewed bundled previews | Default icon; delivery icon metadata validated but not fetched by UI |
 | Installed brand icons | Host-owned local package decoder | Default icon; no activation/network request |
-| Author avatars | Not implemented; delivery v1 requires null | Existing local presentation; no avatar lookup |
+| Author avatars | Visible-row host fetch of a validated v2 same-origin resource; v1 remains null | Default placeholder; no GitHub lookup or renderer URL fetch |
 | Package artifacts | Not published or admitted by delivery v1 | Source-only; no download action fabricated |
 | Source/README links | Explicit user-opened external HTTPS link | May open GitHub; no background dependency |

@@ -47,6 +47,9 @@ focus handoff is needed. Close, cancel, timeout, lock, hide/blur, reload, crash
 and stale runtime/source fail closed. The dialog uses the existing host security
 surface marker so attached native plugin views yield while it is visible and
 restore through their existing lifecycle on dismissal.
+Ordinary landing rows do not suspend native views. The logging dialog and its
+verbose confirmation are marked security surfaces; the confirmation opts into
+the existing marker because it temporarily accessibility-hides its parent dialog.
 A plugin DOM click never becomes a host gesture. Choosers, drafts, terminal and
 clipboard sharing use their existing host-owned action tokens. Ask integrates
 with that workflow instead of opening a second capability dialog. Allow skips
@@ -0,0 +1,140 @@
+# Settings visibility and current-main acceptance candidate
+
+This isolated branch, `integration/plugin-settings-main-acceptance`, starts at
+frozen #4004 `2433cf0130d1c3274c56c39e5765349c2945de01`. Its Draft PR and private
+renderer provenance record the final exact head and CI. Frozen2433 source,
+artifact, QA workspace/profile and earlier evidence remain intact.
+
+## Inputs and production ownership
+
+Both inputs were ordinarily merged, without conflicts or manual production edits:
+
+| Input | Import | Production files and behavior |
+| --- | --- | --- |
+| Current main `a0cf2b487c9ff0b0472d622e66bc5ee20de32c71` | Merge `c4aedfa9ed8c9f2647ac26f0e6e144edab341c2d` | `domain/workspaceAiScopeHandoff.ts` keeps inherited AI chat on a surviving owner when a workspace dissolves (#4003/e3e2dcfe); `electron/bridges/ai/shellUtils.cjs` narrowly recognizes Oh My Zsh ys two-line idle prompts (#4008/a0cf2b48) |
+| Policy `1551fa8355021b5a811d737d16f81e8070f99f5d` | Merge `714e2397a43dc6c083dce8afeeb7a0475de11384` | `PluginLogSettings.tsx` removes the idle-row security marker and opts the nested verbose confirmation into it; `confirm-dialog.tsx` adds the optional host-only marker with default false |
+
+All four production files exactly match their respective owners. Main has only
+those two new commits since common base f0897c3c. Neither changed file overlaps
+the prior plugin changes. The new prompt utility is not imported by plugin
+production modules; plugin sensitive-input, selection and source guards remain
+unchanged. Existing prompt and live-PTY-byte suffix tests still reject bare
+markers and pending input. These are synthetic tests, not a new native SSH pass.
+
+The input also owns its real Settings landing regression and documentation.
+The existing observer, Ask marker, IPC/window authority, sandbox, resource/source
+controls, AI d33 wiring, schemas, sample bytes and package/lock inputs are
+unchanged. `ModelSelector.tsx` equals2433: separate #4002 is not included. Global
+Agent/custom Chat #4006 and terminal diagnostic #3999 are excluded. No main merge,
+Ready transition, original-PR closure or release is part of this handoff.
+
+The parent reports the1551-vs89 independent delta review scoped clean: idle
+Settings no longer requests suspension, the real logging dialog remains marked,
+its nested verbose portal protects itself while the parent is accessibility-
+hidden, closing the nested dialog leaves the parent protected, and closing all
+dialogs permits restoration. This source-only result is not native resolution
+of the recorded Settings blank body.
+
+## Frozen2433 native results
+
+The parent supplied these results; this coding executor did not run the GUI:
+
+| Case | Result on2433 |
+| --- | --- |
+| Main Ask visible | Passed |
+| Cancel | Passed; zero provider POSTs |
+| Accept | Passed; one provider POST |
+| Stream chunks | Passed; no repeated permission prompts |
+| Content Deny | Passed |
+| Real five-minute chat expiry | Passed |
+| Settings sample body | Blank; not accepted |
+
+The idle-row suppression defect is source-confirmed. The correction requires a
+new native Settings recheck; no native success is inferred from the DOM regression.
+A later GPU exit9 and incomplete cleanup were reported separately. Its cause is
+unclassified; no source hotpatch or sandbox/GPU workaround was used here.
+
+Consumer verification of2433's Library renderer is complete: the parent checked
+the matching full source/backend and all1001 renderer hashes, with native inputs
+unchanged. The earlier producer download failure remains historical evidence,
+not an outstanding consumer transfer blocker. That verified artifact still
+certifies2433 only; it does not include1551 or the new main renderer behavior.
+
+Earlier020 Default Allow cold Send/completion, Stop/Deny/restore and themes,
+677 Host core, and corrected-fixture terminal solo/split results remain scoped
+historical evidence. Terminal Focus is unreliable/unverified and QA sent one
+Enter inA during a palette attempt: no global zero-input/full-terminal-pass claim.
+The historical Rfam attempt failed socket transport before connect resolved;
+authentication/SELECT were not reached and cause/auth/TLS compatibility remain
+unverified. Final source-policy, DB, placement/lifecycle and actual hosting/CDN
+gates remain separately reconciled by the parent.
+
+## Local checks and sample provenance
+
+| Check | Result |
+| --- | --- |
+| Registered plugin runtime | 695 passed, one native skip; zero failed/cancelled |
+| Contract/SDK/CLI | 91 passed |
+| Offline examples | Five passed, one Docker opt-in skip |
+| Changed main owner/scope/prompt/suffix and terminal lifecycle group | 139 passed |
+| Actual mounted AI/permission/selected-context/Host group | 21 passed |
+| Settings boundary and security visibility group | 38 passed |
+| Contract/capability/Codex generation and committed drift | Clean |
+| Lint | Zero errors, seven existing warnings |
+| Five sample archives | Validated, built twice and byte-identical to2433 |
+
+The final exact-head normal production build, renderer inventory, bounded
+credential check, CI and Codex review are recorded in the Draft PR/artifact
+handoff. Local full-suite, native packaging and GUI success are not claimed.
+Locked dependencies, standard patches and the official pinned Electron binary
+were prepared normally; no header, HOME, sandbox or native shim workaround.
+
+[Exact sample IDs, permissions/resources and hashes](settings-main-packages.json)
+preserve all prior provenance, including Assistant7943d4c3, ownedDBf01c6a24,
+Rfamaaca5866, Hostcf04f82d and terminal4c9c2388. Whole archive equality was
+asserted, rather than inferred from unchanged source. The owned10.77.0.20 endpoint
+is packaging-only, not a running fixture. No package was activated or service
+queried by this executor.
+
+The owner's separate QA-only Settings Ask sample has reported SHA-256
+`9502a58a4804862e4b13de9fc0d1baf6ad8c2bc681c08b5c0664b552ef0aafc4`.
+It is not one of these five repository examples and was not rebuilt here. The
+native owner must retain its exact verified manifest/source/permissions and
+fixture provenance; no package ID, permission expansion or hash equivalence is
+invented by this integration.
+
+## Native preparation and bounded recheck
+
+1. After the parent's GUI/Nginx slot is released, use a NEW isolated checkout of
+   the final exact head and a separate synthetic QA profile. Preserve the old2433
+   workspace/profile and recordings. Materialize the new private Library artifact
+   in the consumer's own workspace and verify archive and every renderer hash.
+2. Use the complete matching backend checkout: frontend-only dist does not carry
+   the CJS prompt helper or native dependencies. Match package/lock hashes to
+   independently normally rebuilt native inputs and prepare workspace packages
+   normally. Install dist as a whole; use the ordinary Electron launch without
+   Vite and with normal sandbox/helper settings. This is unpackaged native
+   production-renderer QA, not packaged-binary certification.
+3. Open the verified Settings sample through its existing supported settings
+   entry. Check the idle body is visible/clickable with the logging row present.
+   Open logging and the nested verbose confirmation separately; native content
+   must yield to each, remain hidden after cancelling the nested confirmation,
+   and restore only after the parent closes. Do not enable real verbose logging
+   or collect real content for this check.
+4. In the ready/focused/visible/unlocked Settings owner, exercise its synthetic
+   own-setting Ask operation. Record visible Ask, explicit cancel/accept, exact
+   current operation outcome and restoration. Recheck main Ask briefly. Preserve
+   the2433 main/content/expiry counters and any unrun matrix cases separately.
+5. Use owned synthetic A/B AI chats: form a workspace, prefer B, dissolve while A
+   survives and confirm both histories stay with their owners. Remove A and
+   check bounded fallback to B. Confirm handoff alone does not invoke a model or
+   re-share content. Exercise selected-target invalidation across the transition
+   with inert drafts and no PTY input. Do not treat earlier Focus uncertainty as
+   resolved by this main domain fix.
+6. Record exact source/artifact/sample identities, screenshots/video, request
+   counters, cleanup and unrun cases. No fallback endpoint/probe, real credentials,
+   paid API, security relaxation or unrecognized installation is authorized here.
+
+If main advances after this pinned a0cf snapshot, compare the new delta and assess
+its affected checks before landing. The current candidate deliberately does not
+chase unrelated changes while native preparation is in progress.
@@ -0,0 +1,217 @@
+[
+  {
+    "name": "assistant",
+    "id": "com.netcatty.assistant",
+    "version": "0.1.0",
+    "fileCount": 6,
+    "bytes": 17214,
+    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "contentSha256": "c3e31e9613422bf9a05ccaa5b6f234304208f1a8298b1c1ee19262ba88af6cd0",
+    "features": {
+      "required": [
+        "ai.model-invocation",
+        "context.selected-read"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        "ai.invoke",
+        "context.selected.list",
+        "context.selected.read"
+      ]
+    },
+    "package": "assistant.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395",
+    "changedEntriesFromFrozen677": [
+      "README.md",
+      "panel.css",
+      "panel.js"
+    ],
+    "previous7856Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "database-owned",
+    "id": "com.netcatty.database-minimal",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11660,
+    "sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "contentSha256": "4d628c41c7a231e31cd56dacb822acaaa37f61e1e98b285b0086a4f783be199d",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://10.77.0.20:3306"
+          ],
+          "reason": "Connect only to the prepared disposable fixture."
+        }
+      ]
+    },
+    "package": "database-owned.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "database-rfam-readonly",
+    "id": "com.netcatty.database-rfam-readonly",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11003,
+    "sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "contentSha256": "f542ca7b8e821d684cf7f71f0930458bd3ad97bc94bf654c88b0f353111e9162",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
+          ],
+          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
+        }
+      ]
+    },
+    "package": "database-rfam-readonly.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "host-actions",
+    "id": "com.netcatty.host-actions",
+    "version": "0.1.0",
+    "fileCount": 3,
+    "bytes": 4633,
+    "sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "contentSha256": "d6f8bf3ae9dc417ea838f673966f2e1075fc8f9ef1d939ca85b476b1bb007e6c",
+    "features": {
+      "required": [
+        "vault.host-actions",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "vault.metadata",
+        "vault.write",
+        "ui.interact"
+      ]
+    },
+    "package": "host-actions.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "terminal-selection-draft",
+    "id": "com.netcatty.terminal-selection-draft",
+    "version": "0.1.0",
+    "fileCount": 2,
+    "bytes": 2954,
+    "sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "contentSha256": "99797d8679f34b96580076f922cbec067e511adc0f4ccf396ed129206acb6c4c",
+    "features": {
+      "required": [
+        "terminal.selection-sharing",
+        "terminal.input-drafts",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "terminal.selection.read",
+        "terminal.input.propose"
+      ]
+    },
+    "package": "terminal-selection-draft.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom2433": []
+  }
+]
@@ -5,6 +5,7 @@ import en from "../application/i18n/locales/en.ts";
 import zhCN from "../application/i18n/locales/zh-CN.ts";
 import zhTW from "../application/i18n/locales/zh-TW.ts";
 import { filterSettingsSearchCatalog } from "./settingsSearch.ts";
+import { resolveSettingsPlatform } from "./settingsSearchCatalog.ts";
 import { SETTINGS_SEARCH_CATALOG } from "./settingsSearchCatalog.ts";

 const EN: Record<string, string> = {
@@ -152,3 +153,37 @@ test("Sync status entries retain syncSubTab for navigation", () => {
  assert.ok(backups);
  assert.equal(backups?.entry.syncSubTab, "status");
 });
+
+test("macOS-only settings stay out of search on other platforms", () => {
+  const blurId = "appearance-window-background-blur";
+
+  // Both a targeted query and the default (empty query) list must skip it,
+  // otherwise selecting the hit jumps to a tab with no anchor to focus.
+  const macHits = filterSettingsSearchCatalog("", tEn, { platform: "mac", limit: 500 });
+  assert.ok(macHits.some((hit) => hit.entry.id === blurId));
+
+  for (const platform of ["win", "linux"] as const) {
+    const searched = filterSettingsSearchCatalog("frosted glass", tEn, { platform });
+    assert.equal(searched.some((hit) => hit.entry.id === blurId), false);
+
+    const defaults = filterSettingsSearchCatalog("", tEn, { platform, limit: 500 });
+    assert.equal(defaults.some((hit) => hit.entry.id === blurId), false);
+  }
+});
+
+test("platform-gated entries never hide cross-platform settings", () => {
+  for (const platform of ["mac", "win", "linux"] as const) {
+    const hits = filterSettingsSearchCatalog("opacity", tEn, { platform });
+    assert.ok(
+      hits.some((hit) => hit.entry.id === "appearance-window-opacity"),
+      `window opacity must stay searchable on ${platform}`,
+    );
+  }
+});
+
+test("resolveSettingsPlatform maps Electron-style platform strings", () => {
+  assert.equal(resolveSettingsPlatform("MacIntel"), "mac");
+  assert.equal(resolveSettingsPlatform("Win32"), "win");
+  assert.equal(resolveSettingsPlatform("Linux x86_64"), "linux");
+  assert.equal(resolveSettingsPlatform(""), "linux");
+});
@@ -1,6 +1,9 @@
 import { matchesSearchQuery } from "../lib/searchMatcher";
 import {
  SETTINGS_SEARCH_CATALOG,
+  isSettingsEntryAvailableOn,
+  resolveSettingsPlatform,
+  type SettingsPlatform,
  type SettingsSearchEntry,
  type SettingsTabId,
 } from "./settingsSearchCatalog";
@@ -61,16 +64,22 @@ export function filterSettingsSearchCatalog(
    catalog?: readonly SettingsSearchEntry[];
    includePlugins?: boolean;
    limit?: number;
+    /** Platform whose settings UI will receive the jump; defaults to the host. */
+    platform?: SettingsPlatform;
  },
 ): SettingsSearchHit[] {
  const catalog = options?.catalog ?? SETTINGS_SEARCH_CATALOG;
  const includePlugins = options?.includePlugins ?? true;
  const limit = options?.limit ?? 40;
+  const platform = options?.platform ?? resolveSettingsPlatform();
  const trimmed = query.trim();

  const hits: SettingsSearchHit[] = [];
  for (const entry of catalog) {
    if (!includePlugins && entry.tab === "plugins") continue;
+    // Platform-gated settings are hidden from search where their anchor is not
+    // rendered, so a hit always has a real control to focus.
+    if (!isSettingsEntryAvailableOn(entry, platform)) continue;
    const hit = buildSettingsSearchHit(entry, t);
    if (!trimmed) {
      hits.push(hit);
@@ -31,6 +31,8 @@ export const SYNC_SETTINGS_SUB_TAB_IDS = ["providers", "status"] as const;

 export type SyncSettingsSubTabId = (typeof SYNC_SETTINGS_SUB_TAB_IDS)[number];

+export type SettingsPlatform = "mac" | "win" | "linux";
+
 export type SettingsSearchEntry = {
  /** Stable id; also used as `data-settings-anchor` on the target element. */
  id: string;
@@ -47,8 +49,33 @@ export type SettingsSearchEntry = {
  sectionKey?: string;
  /** Extra English/Chinese aliases that are not full i18n strings. */
  keywords?: readonly string[];
+  /**
+   * Platforms where the destination actually renders. Omit for cross-platform
+   * entries. Entries must not be offered on a platform whose settings UI hides
+   * the anchor, otherwise search jumps to a tab with nothing to highlight.
+   */
+  platforms?: readonly SettingsPlatform[];
 };

+/** Resolve the host platform in the same terms the settings UI branches on. */
+export function resolveSettingsPlatform(
+  platform?: string,
+): SettingsPlatform {
+  const value = platform
+    ?? (typeof navigator !== "undefined" ? navigator.platform : "");
+  if (/mac|iphone|ipad/i.test(value)) return "mac";
+  if (/win/i.test(value)) return "win";
+  return "linux";
+}
+
+export function isSettingsEntryAvailableOn(
+  entry: SettingsSearchEntry,
+  platform: SettingsPlatform,
+): boolean {
+  if (!entry.platforms?.length) return true;
+  return entry.platforms.includes(platform);
+}
+
 export const SETTINGS_SEARCH_CATALOG: readonly SettingsSearchEntry[] = [
  // Application
  {
@@ -108,6 +135,14 @@ export const SETTINGS_SEARCH_CATALOG: readonly SettingsSearchEntry[] = [
    descriptionKey: "settings.appearance.windowOpacity.desc",
    keywords: ["transparency", "透明"],
  },
+  {
+    id: "appearance-window-background-blur",
+    tab: "appearance",
+    labelKey: "settings.appearance.windowBackgroundBlur",
+    descriptionKey: "settings.appearance.windowBackgroundBlur.desc",
+    keywords: ["blur", "frosted glass", "vibrancy", "模糊", "毛玻璃"],
+    platforms: ["mac"],
+  },
  {
    id: "appearance-theme",
    tab: "appearance",
@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  isWindowBackgroundBlurActive,
+} from './windowBackgroundBlur';
+
+test('window background blur is visible only with a translucent surface', () => {
+  assert.equal(isWindowBackgroundBlurActive(true, 1), false);
+  assert.equal(isWindowBackgroundBlurActive(true, 0.99), true);
+  assert.equal(isWindowBackgroundBlurActive(true, 0.5), true);
+  assert.equal(isWindowBackgroundBlurActive(true, Number.NaN), false);
+});
+
+test('window background blur becomes inactive without losing the request state', () => {
+  assert.equal(isWindowBackgroundBlurActive(true, 0.85), true);
+  assert.equal(isWindowBackgroundBlurActive(true, 1), false);
+  assert.equal(isWindowBackgroundBlurActive(false, 0.85), false);
+});
@@ -0,0 +1,6 @@
+export function isWindowBackgroundBlurActive(
+  requested: boolean,
+  windowOpacity: number,
+): boolean {
+  return requested && Number.isFinite(windowOpacity) && windowOpacity < 1;
+}
@@ -108,7 +108,7 @@ test('handoffDissolvedWorkspaceAIScope retargets inherited chat when its pane is
  });
 });

-test('handoffDissolvedWorkspaceAIScope retargets inherited chat when original pane also survives', () => {
+test('handoffDissolvedWorkspaceAIScope keeps inherited chat on its surviving owner pane', () => {
  const result = handoffDissolvedWorkspaceAIScope({
    activeSessionIdMap: {
      'workspace:ws-1': 'chat-a',
@@ -132,12 +132,52 @@ test('handoffDissolvedWorkspaceAIScope retargets inherited chat when original pa
    preferredTerminalId: 'term-b',
  });

-  assert.equal(result.changed, true);
-  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-a');
-  assert.equal(result.activeSessionIdMap['terminal:term-a'], null);
-  assert.equal(result.sessions[0]?.scope.targetId, 'term-b');
+  assert.equal(result.activeSessionIdMap['terminal:term-a'], 'chat-a');
+  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-b');
+  assert.equal(result.sessions[0]?.scope.type, 'terminal');
+  assert.equal(result.sessions[0]?.scope.targetId, 'term-a');
+  assert.equal(result.sessions[0]?.updatedAt, 1);
  assert.equal(result.sessions[1]?.scope.targetId, 'term-b');
-  assert.deepEqual(result.panelViewByScope['terminal:term-b'], {
+  assert.deepEqual(result.panelViewByScope['terminal:term-a'], {
+    mode: 'session',
+    sessionId: 'chat-a',
+  });
+  assert.equal(result.panelViewByScope['terminal:term-b'], undefined);
+});
+
+test('handoffDissolvedWorkspaceAIScope keeps owner history when the other pane is preferred', () => {
+  const result = handoffDissolvedWorkspaceAIScope({
+    activeSessionIdMap: {
+      'workspace:ws-1': 'chat-a',
+      'terminal:term-b': 'chat-b',
+    },
+    sessions: [
+      {
+        id: 'chat-a',
+        scope: { type: 'terminal', targetId: 'term-a', hostIds: ['host-a'] },
+        updatedAt: 1,
+      },
+      {
+        id: 'chat-b',
+        scope: { type: 'terminal', targetId: 'term-b', hostIds: ['host-b'] },
+        updatedAt: 1,
+      },
+    ],
+    workspaceId: 'ws-1',
+    terminalIds: ['term-a', 'term-b'],
+    preferredTerminalId: 'term-b',
+    panelViewByScope: {
+      'workspace:ws-1': { mode: 'session', sessionId: 'chat-a' },
+    },
+  });
+
+  assert.equal(result.changed, true);
+  assert.equal(result.activeSessionIdMap['terminal:term-a'], 'chat-a');
+  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-b');
+  assert.equal(result.sessions[0]?.scope.targetId, 'term-a');
+  assert.equal(result.sessions[1]?.id, 'chat-b');
+  assert.equal(result.sessions[1]?.scope.targetId, 'term-b');
+  assert.deepEqual(result.panelViewByScope['terminal:term-a'], {
    mode: 'session',
    sessionId: 'chat-a',
  });
@@ -78,13 +78,15 @@ export function seedWorkspaceAIActiveSessionFromMembers(input: {
 }

 /**
- * When a workspace tab dissolves, copy its active chat onto the preferred
- * surviving terminal before the workspace scope key is pruned. Also remint
- * workspace-scoped chats and the handed-off active chat when it still lives
- * under a different terminal (including one that also survives dissolve),
- * clear that previous terminal selection so ownership filters do not hide the
- * chat, and seed a session panel view so terminal scopes do not fall back to
- * a blank draft.
+ * When a workspace tab dissolves, copy its active chat onto a surviving
+ * terminal before the workspace scope key is pruned. An inherited chat that
+ * is already terminal-scoped to a pane still in `terminalIds` stays on that
+ * owner, even when focus/preferred is a different survivor. Otherwise the
+ * target is the preferred survivor, or the first remaining terminal when the
+ * original pane is gone. Workspace-scoped chats are reminted onto that
+ * target, duplicate terminal map entries for the same chat are cleared, and
+ * a session panel view is seeded so terminal scopes do not fall back to a
+ * blank draft.
 */
 export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoffLike>(input: {
  activeSessionIdMap: AIActiveSessionIdMap;
@@ -99,7 +101,7 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
  panelViewByScope: Record<string, AIPanelViewHandoffLike>;
  changed: boolean;
 } {
-  const preferredTerminalId = (
+  const fallbackTerminalId = (
    input.preferredTerminalId
    && input.terminalIds.includes(input.preferredTerminalId)
      ? input.preferredTerminalId
@@ -109,6 +111,17 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
  const workspaceKey = buildAIScopeKey('workspace', input.workspaceId);
  const workspaceActive = input.activeSessionIdMap[workspaceKey];
  const hasWorkspaceActive = typeof workspaceActive === 'string' && workspaceActive.length > 0;
+  const activeSession = hasWorkspaceActive
+    ? input.sessions.find((session) => session.id === workspaceActive)
+    : undefined;
+  const survivingOwnerTerminalId = (
+    activeSession?.scope.type === 'terminal'
+    && activeSession.scope.targetId
+    && input.terminalIds.includes(activeSession.scope.targetId)
+      ? activeSession.scope.targetId
+      : null
+  );
+  const handoffTargetTerminalId = survivingOwnerTerminalId ?? fallbackTerminalId;
  const previousPanelViewByScope = (
    input.panelViewByScope as Record<string, AIPanelViewHandoffLike> | undefined
  ) ?? {};
@@ -118,8 +131,8 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
  };
  let mapChanged = false;

-  if (preferredTerminalId && hasWorkspaceActive) {
-    const terminalKey = buildAIScopeKey('terminal', preferredTerminalId);
+  if (handoffTargetTerminalId && hasWorkspaceActive) {
+    const terminalKey = buildAIScopeKey('terminal', handoffTargetTerminalId);
    let map = nextMap;
    let changed = false;
    if (map[terminalKey] !== workspaceActive) {
@@ -145,24 +158,23 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff

  let sessionsChanged = false;
  const nextSessions = input.sessions.map((session) => {
-    if (!preferredTerminalId) return session;
+    if (!handoffTargetTerminalId) return session;

    const isWorkspaceScoped = (
      session.scope.type === 'workspace'
      && session.scope.targetId === input.workspaceId
    );
-    // Inherited member chats stay terminal-scoped under the original pane.
-    // Prefer the focused survivor even when that original pane also survives
-    // dissolve, otherwise B's history ownership filter excludes A's chat.
+    // Keep an inherited chat on its owner when that pane survives. Remint
+    // only when the handoff target is a different terminal (original pane gone).
    const isInheritedActiveChatOnOtherTerminal = (
      hasWorkspaceActive
      && session.id === workspaceActive
      && session.scope.type === 'terminal'
      && Boolean(session.scope.targetId)
-      && session.scope.targetId !== preferredTerminalId
+      && session.scope.targetId !== handoffTargetTerminalId
    );
    if (!isWorkspaceScoped && !isInheritedActiveChatOnOtherTerminal) return session;
-    if (session.scope.type === 'terminal' && session.scope.targetId === preferredTerminalId) {
+    if (session.scope.type === 'terminal' && session.scope.targetId === handoffTargetTerminalId) {
      return session;
    }

@@ -172,7 +184,7 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
      scope: {
        ...session.scope,
        type: 'terminal',
-        targetId: preferredTerminalId,
+        targetId: handoffTargetTerminalId,
      },
      updatedAt: Date.now(),
    };
@@ -182,8 +194,8 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
  const nextPanelViewByScope: Record<string, AIPanelViewHandoffLike> = {
    ...previousPanelViewByScope,
  };
-  if (preferredTerminalId && hasWorkspaceActive) {
-    const terminalKey = buildAIScopeKey('terminal', preferredTerminalId);
+  if (handoffTargetTerminalId && hasWorkspaceActive) {
+    const terminalKey = buildAIScopeKey('terminal', handoffTargetTerminalId);
    const workspacePanelView = previousPanelViewByScope[workspaceKey];
    const terminalPanelView = previousPanelViewByScope[terminalKey];
    const nextView: AIPanelViewHandoffLike = (
@@ -71,9 +71,17 @@ const POSIX_PROMPT_PATTERN = /^(?:[^\s@]+@[^\s:]+(?::[^\n\r]*)?|\[[^\s@\]]+@[^\s

 // Host line of a two-line bash PS1 (`\u@\h: \w` then a following `$` or `#`).
 // Same user@host[:path] class as POSIX_PROMPT_PATTERN's first alternative,
-// without a prompt marker on this line. A bare `$`/`#` alone is not a prompt.
+// without a prompt marker on this line. Oh My Zsh `ys` uses a different host
+// line (`# user @ host ...`), matched separately below. A bare `$`/`#` alone
+// is not a prompt.
 const POSIX_PROMPT_HOST_LINE_PATTERN = /^[^\s@]+@[^\s:]+(?::[^\n\r]*)?$/;

+// Oh My Zsh `ys` status line: a decorative `#`, then `user @ host` with
+// spaces around `@`, then an optional remainder (directory, git, venv, time,
+// exit code). Example: `# user @ host in ~ [12:34:56]`. Arbitrary text before
+// a bare `$`/`#` still does not match.
+const OH_MY_ZSH_YS_HOST_LINE_PATTERN = /^#\s+[^\s@]+\s+@\s+[^\s]+(?:\s+[^\n\r]+)?$/;
+
 // Alpine's default ash PS1 omits the username: `\h:\w\$ ` -> `localhost:~# `.
 // Require a hostname and a home/absolute path, excluding prompt delimiters
 // within the path so partially entered commands do not count as idle prompts.
@@ -124,12 +132,15 @@ function extractTrailingIdlePrompt(output) {
    return lastLine;
  }

-  // Two-line PS1 (`export PS1="\u@\h: \w\n$ "`). Bash emits the newline as
-  // CR and the PTY's ONLCR adds another, so the bytes are `\r\r\n`. The
-  // CR-to-LF normalize above turns that into blank lines between the host
-  // line and `$`/`#`. Keep those blanks in the cache: getFreshIdlePrompt
-  // uses the same normalize, and hasExpectedPromptSuffix compares this
-  // CR-as-LF form against live PTY bytes. A lone `$` must not satisfy endsWith.
+  // Two-line PS1. Classic bash is `export PS1="\u@\h: \w\n$ "`. Oh My Zsh
+  // `ys` paints `# user @ host ...` and then a bare `$` or `#`. Bash emits
+  // the newline as CR and the PTY's ONLCR adds another, so the bytes are
+  // `\r\r\n`. The CR-to-LF normalize above turns that into blank lines
+  // between the host line and `$`/`#`. Keep those blanks in the cache:
+  // getFreshIdlePrompt uses the same normalize, and hasExpectedPromptSuffix
+  // compares this CR-as-LF form against live PTY bytes. A lone `$`/`#` must
+  // not satisfy endsWith; the previous non-empty line has to be a recognized
+  // host line (classic `user@host[:path]` or Oh My Zsh `ys`).
  if (rightTrimmed === "$" || rightTrimmed === "#") {
    let hostIndex = lines.length - 1;
    while (hostIndex >= 0 && lines[hostIndex].replace(/\s+$/, "") === "") {
@@ -137,7 +148,13 @@ function extractTrailingIdlePrompt(output) {
    }
    const previousLine = hostIndex >= 0 ? lines[hostIndex] : "";
    const previousRightTrimmed = previousLine.replace(/\s+$/, "");
-    if (POSIX_PROMPT_HOST_LINE_PATTERN.test(previousRightTrimmed)) {
+    // Same optional "(name) " env prefix as isDefaultPosixPromptLine (#3947).
+    // Recognition only; the returned prompt keeps the visible prefix.
+    const previousHostLine = previousRightTrimmed.replace(/^\([^()\n\r]+\)\s+/, "");
+    if (
+      POSIX_PROMPT_HOST_LINE_PATTERN.test(previousHostLine)
+      || OH_MY_ZSH_YS_HOST_LINE_PATTERN.test(previousHostLine)
+    ) {
      return `${lines.slice(hostIndex).join("\n")}\n${lastLine}`;
    }
  }
@@ -202,8 +219,9 @@ function trackSessionIdlePrompt(session, chunk) {
 // Return `session.lastIdlePrompt` only if the PTY's recent rolling tail
 // still ends with it. The cached prompt is updated only when
 // extractTrailingIdlePrompt recognizes a known shape (PowerShell, cmd.exe,
-// `user@host[:path][#$]`, two-line `user@host[:path]` + `$`/`#`,
-// RHEL `[user@host path][#$]`, or Alpine `host:path[#$]`);
+// `user@host[:path][#$]`, two-line classic `user@host[:path]` or Oh My Zsh
+// `ys` (`# user @ host ...`) + `$`/`#`, RHEL `[user@host path][#$]`, or
+// Alpine `host:path[#$]`);
 // a remote shell switch into another shell, an oh-my-posh / starship / custom
 // PS1, or any unrecognized prompt would
 // otherwise leave a stale value behind, which `resolveEffectiveShellKind`
@@ -262,6 +262,83 @@ test("trackSessionIdlePrompt and getFreshIdlePrompt accept a two-line user@host
  assert.equal(getFreshIdlePrompt(ptySession), "user@host: /home/foo\n\n\n$ ");
 });

+test("extractTrailingIdlePrompt recognizes an Oh My Zsh ys two-line idle prompt", () => {
+  // ys paints `# user @ host ...` then a bare `$` or `#`. Spaces around `@`
+  // and the leading decorative `#` are required; a lone marker is not a prompt.
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\n$ "),
+    "# user @ host in ~ [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\n# user @ host in ~ [12:34:56]\n# "),
+    "# user @ host in ~ [12:34:56]\n# ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~/proj on git:main [12:34:56]\n$ "),
+    "# user @ host in ~/proj on git:main [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\n# ys @ ys-mbp in ~/.oh-my-zsh on git:master x [21:47:42] C:127\n$ "),
+    "# ys @ ys-mbp in ~/.oh-my-zsh on git:master x [21:47:42] C:127\n$ ",
+  );
+  // Same CR / CRLF blank lines as the classic two-line PS1.
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\r\r\n$ "),
+    "# user @ host in ~ [12:34:56]\n\n\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\r\n# "),
+    "# user @ host in ~ [12:34:56]\n\n# ",
+  );
+  // Optional "(name) " env prefix is stripped only for recognition (#3947).
+  assert.equal(
+    extractTrailingIdlePrompt("(venv) # user @ host in ~ [12:34:56]\n$ "),
+    "(venv) # user @ host in ~ [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("(venv) user@host: /home/foo\n$ "),
+    "(venv) user@host: /home/foo\n$ ",
+  );
+
+  assert.equal(extractTrailingIdlePrompt("$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# "), "");
+  assert.equal(extractTrailingIdlePrompt("welcome\r\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("not a host line\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("user @ host in ~\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# user host in ~ [12:34:56]\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# user@host in ~ [12:34:56]\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("copied output\n# "), "");
+  assert.equal(extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\n$ ls"), "");
+  assert.equal(extractTrailingIdlePrompt("# user @ host in ~ [12:34:56] $"), "");
+  assert.equal(extractTrailingIdlePrompt("echo $"), "");
+  assert.equal(extractTrailingIdlePrompt("price is 5$"), "");
+  assert.equal(extractTrailingIdlePrompt("(venv) not a host line\n$ "), "");
+});
+
+test("trackSessionIdlePrompt and getFreshIdlePrompt accept an Oh My Zsh ys two-line prompt", () => {
+  const session = {};
+  const prompt = "# user @ host in ~ [12:34:56]\n$ ";
+  trackSessionIdlePrompt(session, `welcome\r\n${prompt}`);
+  assert.equal(getFreshIdlePrompt(session), prompt);
+
+  const extra = {};
+  trackSessionIdlePrompt(extra, "# user @ host in ~/proj on git:main [12:34:56]\r\r\n$ ");
+  assert.equal(
+    getFreshIdlePrompt(extra),
+    "# user @ host in ~/proj on git:main [12:34:56]\n\n\n$ ",
+  );
+
+  const root = {};
+  trackSessionIdlePrompt(root, "# user @ host in ~ [12:34:56]\n# ");
+  assert.equal(getFreshIdlePrompt(root), "# user @ host in ~ [12:34:56]\n# ");
+
+  const bare = {};
+  assert.equal(trackSessionIdlePrompt(bare, "$ "), "");
+  assert.equal(getFreshIdlePrompt(bare), "");
+  assert.equal(trackSessionIdlePrompt(bare, "not a host line\n$ "), "");
+  assert.equal(getFreshIdlePrompt(bare), "");
+});
+
 test("extractTrailingIdlePrompt still recognizes a classic single-line POSIX prompt", () => {
  assert.equal(extractTrailingIdlePrompt("welcome\r\nuser@host:~$ "), "user@host:~$ ");
 });
@@ -0,0 +1,51 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+const { createRequire, wrap } = require("node:module");
+
+// Execute the real driver/registry source with only config repair and SDK
+// inference replaced. No user config is read and no SDK process is launched.
+function loadSource(name, replacements) {
+  const filename = require.resolve(name); const local = createRequire(filename);
+  const module = { exports: {} };
+  const wrapper = vm.runInThisContext(wrap(fs.readFileSync(filename, "utf8")), { filename });
+  wrapper(module.exports, (id) => replacements[id] ?? local(id), module, filename, path.dirname(filename));
+  return module.exports;
+}
+
+function fixture() {
+  const repairs = []; const sends = []; const errors = [];
+  const driver = loadSource("./claudeDriver.cjs", { "./claudeConfig.cjs": { ensureClaudeConfig: () => repairs.push("repair") } });
+  const run = driver.runClaudeTurn;
+  driver.runClaudeTurn = (args) => run({ ...args, queryFn: ({ options }) => {
+    sends.push(options);
+    return (async function* () { yield { type: "stream_event", event: { type: "content_block_delta", delta: { type: "text_delta", text: "Synthetic" } } }; })();
+  } });
+  const registry = loadSource("./index.cjs", { "./claudeDriver.cjs": driver });
+  const emitter = new Proxy({ emitError: (error) => errors.push(error) }, { get: (target, key) => target[key] ?? (() => {}) });
+  const env = Object.freeze({ CLAUDE_CONFIG_DIR: "/synthetic/selected-profile", ANTHROPIC_BASE_URL: "http://127.0.0.1:1", ANTHROPIC_API_KEY: "FIXTURE_ONLY_MARKER" });
+  const ctx = { prompt: "Synthetic", env, emitter, toolIntegrationMode: "mcp", cwd: "/synthetic/turn", binPath: "/synthetic/official-claude",
+    abortController: new AbortController(), assertSessionValid: () => {}, injectedMcpServers: [{ name: "selected-only", command: "host-managed", args: [], env: [] }] };
+  return { repairs, sends, errors, env, ctx, run: (overrides) => registry.getDriver("claude").runTurn({ ...ctx, ...overrides }) };
+}
+
+for (const explicitProfile of [true, false]) test(`delegated registry turn skips config repair with ${explicitProfile ? "explicit" : "default"} host profile`, async () => {
+  const f = fixture(); const env = explicitProfile ? f.env : { ANTHROPIC_API_KEY: "FIXTURE_ONLY_MARKER" };
+  await f.run({ delegatedAgent: true, env });
+  assert.deepEqual(f.repairs, []); assert.equal(f.sends.length, 1); assert.deepEqual(f.errors, []);
+  const options = f.sends[0]; assert.equal(options.env, env);
+  assert.equal(options.cwd, f.ctx.cwd); assert.equal(options.pathToClaudeCodeExecutable, f.ctx.binPath);
+  assert.deepEqual(options.tools, []); assert.deepEqual(options.settingSources, []);
+  assert.equal(options.strictMcpConfig, true); assert.equal(options.persistSession, false);
+  assert.deepEqual(Object.keys(options.mcpServers), ["selected-only"]);
+});
+
+for (const delegatedAgent of [undefined, false]) test(`builtin registry turn retains repair when delegated flag is ${String(delegatedAgent)}`, async () => {
+  const f = fixture(); await f.run({ delegatedAgent });
+  assert.deepEqual(f.repairs, ["repair"]); assert.equal(f.sends.length, 1); assert.deepEqual(f.errors, []);
+  assert.equal(f.sends[0].env, f.env); assert.equal(f.sends[0].settingSources, undefined);
+});
@@ -5,7 +5,7 @@
 *
 * - Spawns the user's system `claude` binary via an ABSOLUTE pathToClaudeCodeExecutable
 *   (SDK existsSync-checks it; PATH is not resolved — issue #205).
- * - Repairs ~/.claude.json before spawn (ensureClaudeConfig).
+ * - Repairs ~/.claude.json before builtin turns only (ensureClaudeConfig).
 * - Bypasses the SDK's built-in permission system and BLOCKS built-in
 *   side-effect tools so the agent can only act through the injected netcatty
 *   MCP server (approval/scope/blocklist enforced there).
@@ -244,8 +244,10 @@ function buildClaudePromptInput(prompt, attachments) {
 * @param {object} args.emitter  createStreamEmitter(...)
 * @param {Function} [args.queryFn] inject @anthropic-ai/claude-agent-sdk query (for tests)
 */
-async function runClaudeTurn({ prompt, attachments, options, emitter, queryFn, assertSessionValid }) {
-  ensureClaudeConfig();
+async function runClaudeTurn({ prompt, attachments, options, emitter, queryFn, assertSessionValid, delegatedAgent = false }) {
+  // A delegated turn may use the selected host profile for authentication, but
+  // must not repair or delete unrelated files in the main process's home.
+  if (!delegatedAgent) ensureClaudeConfig();
  let query = queryFn;
  if (!query) {
    let sdk;
@@ -1,6 +1,12 @@
 const test = require("node:test");
 const assert = require("node:assert/strict");
+// SDK queries in this file are synthetic. Never repair real user config.
+const configPath = require.resolve("./claudeConfig.cjs");
+const priorConfigModule = require.cache[configPath];
+require.cache[configPath] = { id: configPath, filename: configPath, loaded: true, exports: { ensureClaudeConfig() {} } };
 const { translateClaudeMessage, buildClaudeQueryOptions, buildClaudePromptInput, classifyClaudeSpawnError, listClaudeModels, mapClaudeModels, parseClaudeSettings, splitClaudeModelSelection } = require("./claudeDriver.cjs");
+if (priorConfigModule) require.cache[configPath] = priorConfigModule;
+else delete require.cache[configPath];

 function collector() {
  const events = [];
@@ -46,7 +46,8 @@ const DRIVER_REGISTRY = {
        toolIntegrationMode: ctx.toolIntegrationMode,
        delegatedAgent: ctx.delegatedAgent === true,
      });
-      return claude.runClaudeTurn({ prompt: ctx.prompt, attachments: ctx.attachments, options, emitter: ctx.emitter, assertSessionValid: ctx.assertSessionValid });
+      return claude.runClaudeTurn({ prompt: ctx.prompt, attachments: ctx.attachments, options, emitter: ctx.emitter,
+        assertSessionValid: ctx.assertSessionValid, delegatedAgent: ctx.delegatedAgent === true });
    },
    async listModels(ctx) {
      return claude.listClaudeModels({
@@ -3,6 +3,14 @@
 const test = require("node:test");
 const assert = require("node:assert/strict");
 const { createAiPrivacyService } = require("../../../shared/aiPrivacyService.cjs");
+// Load the query-only Claude fixture with config repair replaced. Its live
+// prompt guard tests must never read or repair the executor's actual profile.
+const configPath = require.resolve("./claudeConfig.cjs");
+const priorConfigModule = require.cache[configPath];
+require.cache[configPath] = { id: configPath, filename: configPath, loaded: true, exports: { ensureClaudeConfig() {} } };
+const claudeDriver = require("./claudeDriver.cjs");
+if (priorConfigModule) require.cache[configPath] = priorConfigModule;
+else delete require.cache[configPath];

 function fixture() {
  const privacy = createAiPrivacyService();
@@ -172,7 +180,7 @@ for (const pausedMethod of ["initialize", "session/new"]) {

 test("query and argv drivers reject invalid sessions at their outbound handoff", async (t) => {
  const cases = [
-    ["claude", (f) => require("./claudeDriver.cjs").runClaudeTurn({ ...f, options: {}, queryFn: (input) => { f.sends.push(input); } })],
+    ["claude", (f) => claudeDriver.runClaudeTurn({ ...f, options: {}, queryFn: (input) => { f.sends.push(input); } })],
    ["codebuddy", (f) => require("./codebuddyDriver.cjs").runCodebuddyTurn({ ...f, options: {}, queryFn: (input) => { f.sends.push(input); } })],
    ["cursor-cli", (f) => require("./cursorCliDriver.cjs").runCursorCliTurn({ ...f, binPath: "/bin/cursor", workspaceCwd: "/tmp", spawnImpl: (...input) => { f.sends.push(input); } })],
    ["grok-cli", (f) => require("./grokDriver.cjs").runGrokTurn({ ...f, binPath: "/bin/grok", spawnImpl: (...input) => { f.sends.push(input); } })],
@@ -2218,6 +2218,32 @@ test("delegated Agent entry rejects unverified runtimes and Skills before native
  assert.equal(validated, 1);
 });

+test("actual SDK entry derives delegated mode from main authority, ignoring caller flag spoofing", async (t) => {
+  const { PluginAgentMcpDelegations } = require("../../../plugins/agent/mcpDelegation.cjs");
+  const registry = new PluginAgentMcpDelegations(); t.after(() => registry.shutdown());
+  const chat = "plugin-agent:11111111-1111-4111-8111-111111111111";
+  const tag = "22222222-2222-4222-8222-222222222222";
+  registry.register(chat, { turnTag: tag, senderId: 7, tools: [], assertCurrent() {}, dispatch() {} });
+  const h = createPrivacyStreamHarness(createTestPrivacy(false));
+  const directory = fs.mkdtempSync(nodePath.join(os.tmpdir(), "netcatty-claude-flag-"));
+  t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
+  h.ctx.tempDirBridge = { getTempDir: () => directory };
+  Object.assign(h.ctx.mcpServerBridge, {
+    isPluginAgentConversation: (id) => registry.isReserved(id),
+    assertPluginAgentCaller: (...args) => registry.assertCaller(...args),
+    getPluginAgentMcpConfiguration: (...args) => registry.configuration(...args),
+    onPluginAgentRelease: (...args) => registry.onRelease(...args),
+  });
+  const handler = h.handlers.get("netcatty:ai:sdk-agent:stream");
+  const payload = { requestId: `plugin-agent_${tag}_fixture`, chatSessionId: chat, sdkBackend: "claude", toolIntegrationMode: "mcp", prompt: "Synthetic", delegatedAgent: false };
+  assert.equal((await handler({ sender: { id: 7 } }, payload)).ok, true);
+  assert.equal(h.turns[0].delegatedAgent, true, "caller cannot turn off delegated protection");
+  assert.equal((await h.stream({ delegatedAgent: true })).ok, true);
+  assert.equal(h.turns[1].delegatedAgent, false, "builtin caller cannot opt into the delegated branch");
+  await assert.rejects(handler({ sender: { id: 99 } }, { ...payload, requestId: `plugin-agent_${tag}_foreign`, delegatedAgent: true }));
+  assert.equal(h.turns.length, 2, "a spoofed flag cannot replace current sender/turn authority");
+});
+
 test("delegated native cancellation is exact-request and cannot mark replacement chat work cancelled", async () => {
  const broad = [];
  const { handlers, ctx } = registerWithStubbedCtx({ mcpServerBridge: {
@@ -0,0 +1,29 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+
+test("actual plugin broadcast skips destroyed WebContents while its BrowserWindow is still alive", () => {
+  // Evaluate the actual registrar callback with narrow window fixtures. This
+  // models the destruction-event ordering, not an installed Electron crash.
+  const source = fs.readFileSync(path.join(__dirname, "../main/registerBridges.cjs"), "utf8");
+  const callbacks = [...source.matchAll(/broadcast: \(channel, payload\) => \{([\s\S]*?)\n      \},/g)];
+  assert.equal(callbacks.length, 1);
+  const received = [];
+  const deadWindow = { isDestroyed: () => true, get webContents() { throw Error("Destroyed BrowserWindow getter"); } };
+  const closingWindow = { isDestroyed: () => false, webContents: {
+    isDestroyed: () => true, send() { throw Error("Object has been destroyed"); },
+  } };
+  const liveWindow = { isDestroyed: () => false, webContents: {
+    isDestroyed: () => false, send: (...args) => received.push(args),
+  } };
+  const broadcast = vm.runInNewContext(`(channel, payload) => {${callbacks[0][1]}\n}`, {
+    electronModule: { BrowserWindow: { getAllWindows: () => [deadWindow, closingWindow, liveWindow] } },
+  });
+  const payload = { host: [], session: [] };
+  assert.doesNotThrow(() => broadcast("netcatty:plugins:scope-catalog-changed", payload));
+  assert.deepEqual(received, [["netcatty:plugins:scope-catalog-changed", payload]]);
+});
@@ -39,6 +39,10 @@ let settingsWindow = null;
 let currentTheme = "light";
 let currentLanguage = "en";
 let currentWindowOpacity = 1;
+let currentWindowBackgroundBlurRequested = false;
+let currentWindowBackgroundColor = null;
+/** Windows this module switched to a transparent backing, so restore is safe. */
+const transparentChromeWindows = new WeakSet();
 let cachedNativeTheme = null;

 let handlersRegistered = false; // Prevent duplicate IPC handler registration
@@ -363,6 +367,7 @@ function registerAppContentWindow(win, options = {}) {
  if (!win || win.isDestroyed?.()) return;
  appContentWindows.add(win);
  if (options.queryDirtyEditors === true) dirtyEditorWindows.add(win);
+  applyWindowBackgroundChromeToWindow(win, { applyBackgroundColor: true });
 }

 function unregisterAppContentWindow(win) {
@@ -412,21 +417,84 @@ function clampWindowOpacity(opacity) {
 function applyWindowOpacityToWindow(win) {
  if (!win || win.isDestroyed?.()) return;
  try {
-    win.setOpacity?.(currentWindowOpacity);
+    win.setOpacity?.(isWindowBackgroundBlurActive() ? 1 : currentWindowOpacity);
  } catch {
    // ignore
  }
+  applyWindowBackgroundChromeToWindow(win, { applyBackgroundColor: true });
 }

 function applyWindowOpacity(opacity) {
  currentWindowOpacity = clampWindowOpacity(opacity);
-  for (const win of getAppContentWindowList()) applyWindowOpacityToWindow(win);
+  for (const win of getAppContentWindowList()) {
+    applyWindowOpacityToWindow(win);
+  }
  if (settingsWindow && !settingsWindow.isDestroyed()) {
    applyWindowOpacityToWindow(settingsWindow);
  }
  return currentWindowOpacity;
 }

+function isWindowBackgroundBlurActive() {
+  return process.platform === "darwin"
+    && currentWindowBackgroundBlurRequested
+    && currentWindowOpacity < 1;
+}
+
+function applyWindowBackgroundChromeToWindow(win, options = {}) {
+  if (!win || win.isDestroyed?.()) return;
+  try {
+    if (isWindowBackgroundBlurActive()) {
+      win.setVibrancy?.("hud");
+      win.setBackgroundColor?.("#00000000");
+      transparentChromeWindows.add(win);
+      return;
+    }
+    if (process.platform === "darwin") win.setVibrancy?.(null);
+    if (options.applyBackgroundColor !== true) return;
+    // An explicit theme/background-color push must always repaint, otherwise
+    // the native backing goes stale after theme changes. Registration-time
+    // chrome setup is different: it must not clobber the color the window was
+    // created with before any theme color has been pushed.
+    const wasTransparent = transparentChromeWindows.delete(win);
+    if (options.forceBackgroundColor === true || wasTransparent) {
+      // A window can be asked to drop vibrancy before any theme color has been
+      // pushed (cold start with blur already saved). Falling back to the active
+      // theme keeps the window from staying transparent.
+      const restoreColor = currentWindowBackgroundColor
+        || THEME_COLORS[currentTheme]?.background;
+      if (restoreColor) win.setBackgroundColor?.(restoreColor);
+    }
+  } catch {
+    // ignore platform-specific chrome failures
+  }
+}
+
+function applyWindowBackgroundColor(color) {
+  const normalized = normalizeBackgroundColor(color);
+  if (!normalized) return false;
+  currentWindowBackgroundColor = normalized;
+  for (const win of getAppContentWindowList()) {
+    applyWindowBackgroundChromeToWindow(win, { applyBackgroundColor: true, forceBackgroundColor: true });
+  }
+  if (settingsWindow && !settingsWindow.isDestroyed()) {
+    applyWindowBackgroundChromeToWindow(settingsWindow, { applyBackgroundColor: true, forceBackgroundColor: true });
+  }
+  return true;
+}
+
+function applyWindowBackgroundBlur(enabled) {
+  const supported = process.platform === "darwin";
+  currentWindowBackgroundBlurRequested = supported && enabled === true;
+  for (const win of getAppContentWindowList()) {
+    applyWindowOpacityToWindow(win);
+  }
+  if (settingsWindow && !settingsWindow.isDestroyed()) {
+    applyWindowOpacityToWindow(settingsWindow);
+  }
+  return supported;
+}
+
 function getMainWindowCount() {
  return getMainWindowList().length;
 }
@@ -998,7 +1066,12 @@ const { createWindow } = mainWindowApi;
 const { createSettingsWindowApi } = require("./windowManager/settingsWindow.cjs");
 const settingsWindowApi = createSettingsWindowApi({
  get settingsWindow() { return settingsWindow; },
-  set settingsWindow(value) { settingsWindow = value; },
+  set settingsWindow(value) {
+    settingsWindow = value;
+    if (value) {
+      applyWindowBackgroundChromeToWindow(value, { applyBackgroundColor: true });
+    }
+  },
  get mainWindow() { return mainWindow; },
  get currentTheme() { return currentTheme; },
  get isQuitting() { return isQuitting; },
@@ -1187,21 +1260,12 @@ function registerWindowHandlers(ipcMain, nativeTheme) {
      ? (nativeTheme?.shouldUseDarkColors ? "dark" : "light")
      : theme;
    const themeConfig = THEME_COLORS[effectiveTheme] || THEME_COLORS.light;
-    forEachMainWindow((win) => win.setBackgroundColor(themeConfig.background));
-    if (settingsWindow && !settingsWindow.isDestroyed()) {
-      settingsWindow.setBackgroundColor(themeConfig.background);
-    }
+    applyWindowBackgroundColor(themeConfig.background);
    return true;
  });

  ipcMain.handle("netcatty:setBackgroundColor", (_event, color) => {
-    const normalized = normalizeBackgroundColor(color);
-    if (!normalized) return false;
-    forEachMainWindow((win) => win.setBackgroundColor(normalized));
-    if (settingsWindow && !settingsWindow.isDestroyed()) {
-      settingsWindow.setBackgroundColor(normalized);
-    }
-    return true;
+    return applyWindowBackgroundColor(color);
  });

  ipcMain.handle("netcatty:setWindowOpacity", (_event, opacity) => {
@@ -1209,6 +1273,10 @@ function registerWindowHandlers(ipcMain, nativeTheme) {
    return true;
  });

+  ipcMain.handle("netcatty:setWindowBackgroundBlur", (_event, enabled) => {
+    return applyWindowBackgroundBlur(enabled);
+  });
+
  ipcMain.handle("netcatty:setAppIconVariant", (_event, variant) => {
    const { app, BrowserWindow, nativeImage } = require("electron");
    const appIconManager = require("./appIconManager.cjs");
@@ -1290,6 +1358,7 @@ function registerWindowHandlers(ipcMain, nativeTheme) {
    try {
      const sharedWindowSetting = [
        "netcatty_window_opacity_v1",
+        "netcatty_window_background_blur_v1",
        "netcatty_hotkey_scheme_v1",
        "netcatty_custom_key_bindings_v1",
        "netcatty_hotkey_recording_v1",
@@ -263,11 +263,13 @@ function createMainWindowApi(ctx) {
        minWidth: windowMinimumSize.width,
        minHeight: windowMinimumSize.height,
        backgroundColor,
+        transparent: isMac,
        icon: appIcon,
        show: false,
        frame: isMac,
        titleBarStyle: isMac ? "hiddenInset" : undefined,
        trafficLightPosition: isMac ? { x: 12, y: 12 } : undefined,
+        ...(isMac ? { visualEffectState: "active" } : {}),
        ...windowsChrome,
        webPreferences: {
          preload,
@@ -139,6 +139,7 @@ function createSettingsWindowApi(ctx) {
        minWidth: 820,
        minHeight: 600,
        backgroundColor,
+        transparent: isMac,
        icon: appIcon,
        fullscreenable: !isMac,
        // NOTE: Do NOT set parent - on macOS this causes rendering issues when dragging
@@ -150,6 +151,7 @@ function createSettingsWindowApi(ctx) {
        frame: isMac,
        titleBarStyle: isMac ? "hiddenInset" : undefined,
        trafficLightPosition: isMac ? { x: 12, y: 12 } : undefined,
+        ...(isMac ? { visualEffectState: "active" } : {}),
        ...windowsChrome,
        webPreferences: {
          preload,
@@ -0,0 +1,111 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+const vm = require('node:vm');
+const test = require('node:test');
+
+function loadWindowManager(platform) {
+  const filename = path.resolve(__dirname, '../windowManager.cjs');
+  const loadedModule = { exports: {} };
+  const context = vm.createContext({
+    process: { ...process, platform },
+    console,
+    URL,
+    setTimeout,
+    clearTimeout,
+  });
+  const load = vm.runInContext(
+    `(function(exports, require, module, __filename, __dirname) { ${fs.readFileSync(filename, 'utf8')}\n})`,
+    context,
+  );
+  load(loadedModule.exports, createRequire(filename), loadedModule, filename, path.dirname(filename));
+  const handlers = new Map();
+  loadedModule.exports.registerWindowHandlers({
+    handle: (channel, handler) => handlers.set(channel, handler),
+    on: (channel, handler) => handlers.set(channel, handler),
+  }, {});
+  const state = { opacity: 1, vibrancy: null, background: '#123456' };
+  const win = {
+    isDestroyed: () => false,
+    setOpacity: (value) => { state.opacity = value; },
+    setVibrancy: (value) => { state.vibrancy = value; },
+    setBackgroundColor: (value) => { state.background = value; },
+    webContents: { id: 1, isDestroyed: () => false },
+  };
+  loadedModule.exports.registerMainWindow(win);
+  const invoke = (name, value) => handlers.get(`netcatty:${name}`)({}, value);
+  return { invoke, state };
+}
+
+test('macOS blur keeps native opacity at one and restores normal opacity on disable', () => {
+  const { invoke, state } = loadWindowManager('darwin');
+  assert.equal(state.background, '#123456');
+  invoke('setBackgroundColor', '#123456');
+  invoke('setWindowBackgroundBlur', true);
+  assert.equal(state.vibrancy, null);
+  invoke('setWindowOpacity', 0.7);
+  assert.equal(state.opacity, 1);
+  assert.equal(state.vibrancy, 'hud');
+  assert.equal(state.background, '#00000000');
+  invoke('setWindowOpacity', 0.85);
+  assert.equal(state.opacity, 1);
+  invoke('setWindowBackgroundBlur', false);
+  assert.equal(state.opacity, 0.85);
+  assert.equal(state.vibrancy, null);
+  assert.equal(state.background, '#123456');
+});
+
+test('restoring 100% removes native vibrancy and restores the theme background', () => {
+  const { invoke, state } = loadWindowManager('darwin');
+  invoke('setWindowOpacity', 0.7);
+  invoke('setWindowBackgroundBlur', true);
+  invoke('setBackgroundColor', '#abcdef');
+  assert.equal(state.background, '#00000000');
+  invoke('setWindowOpacity', 1);
+  assert.equal(state.opacity, 1);
+  assert.equal(state.vibrancy, null);
+  assert.equal(state.background, '#abcdef');
+  invoke('setWindowOpacity', 0.7);
+  assert.equal(state.opacity, 1);
+  assert.equal(state.vibrancy, 'hud');
+});
+
+test('unsupported platforms retain the existing opacity behavior', () => {
+  for (const platform of ['win32', 'linux']) {
+    const { invoke, state } = loadWindowManager(platform);
+    invoke('setWindowOpacity', 0.7);
+    assert.equal(invoke('setWindowBackgroundBlur', true), false);
+    assert.equal(state.opacity, 0.7);
+    assert.equal(state.vibrancy, null);
+  }
+});
+
+test('disabling blur before any theme color push restores the current theme background', () => {
+  const { invoke, state } = loadWindowManager('darwin');
+  // No setBackgroundColor / setTheme call yet: currentWindowBackgroundColor is
+  // still null, so the fallback must come from the active theme.
+  invoke('setWindowOpacity', 0.7);
+  invoke('setWindowBackgroundBlur', true);
+  assert.equal(state.background, '#00000000');
+  invoke('setWindowBackgroundBlur', false);
+  assert.equal(state.vibrancy, null);
+  assert.notEqual(state.background, '#00000000');
+  assert.match(String(state.background), /^#[0-9a-fA-F]{6}$/);
+});
+
+test('explicit theme and background-color pushes repaint windows that never used blur', () => {
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    const { invoke, state } = loadWindowManager(platform);
+    assert.equal(state.background, '#123456');
+    // Registration-time chrome setup must leave the creation-time color alone...
+    invoke('setWindowBackgroundBlur', false);
+    assert.equal(state.background, '#123456');
+    // ...but an explicit theme color must always land.
+    invoke('setBackgroundColor', '#abcdef');
+    assert.equal(state.background, '#abcdef');
+    invoke('setTheme', 'dark');
+    assert.match(String(state.background), /^#[0-9a-fA-F]{6}$/);
+    assert.notEqual(state.background, '#abcdef');
+  }
+});
@@ -240,7 +240,7 @@ function createBridgeRegistrar(context) {
      isTrustedSender: createTrustedPluginBridgeSender({ devServerUrl: effectiveDevServerUrl }),
      broadcast: (channel, payload) => {
        for (const window of electronModule.BrowserWindow.getAllWindows()) {
-          if (!window.isDestroyed()) window.webContents.send(channel, payload);
+          if (!window.isDestroyed() && !window.webContents.isDestroyed()) window.webContents.send(channel, payload);
        }
      },
    });
@@ -37,7 +37,12 @@ function startBridge({ token, authDelayMs = 0, onGetContext = null }) {
    sockets.add(socket);
    socket.on("close", () => sockets.delete(socket));
    let buffer = "";
+    let authenticated = false;
    socket.setEncoding("utf8");
+    const writeLine = (payload) => {
+      if (socket.destroyed) return;
+      socket.write(`${JSON.stringify(payload)}\n`);
+    };
    socket.on("data", (chunk) => {
      buffer += chunk;
      let newlineIdx;
@@ -52,17 +57,29 @@ function startBridge({ token, authDelayMs = 0, onGetContext = null }) {
          token: msg.params?.token,
        });
        const respond = () => {
+          if (socket.destroyed) return;
          if (msg.method === "auth/verify") {
            if (msg.params?.token !== token) {
-              socket.write(`${JSON.stringify({
+              writeLine({
                jsonrpc: "2.0",
                id: msg.id,
                error: { code: -32001, message: "Authentication required. Send auth/verify with valid token first." },
-              })}\n`);
+              });
              socket.destroy();
              return;
            }
-            socket.write(`${JSON.stringify({ jsonrpc: "2.0", id: msg.id, result: { ok: true } })}\n`);
+            authenticated = true;
+            writeLine({ jsonrpc: "2.0", id: msg.id, result: { ok: true } });
+            return;
+          }
+          // Match the app bridge: a call before auth/verify closes the socket.
+          if (!authenticated) {
+            writeLine({
+              jsonrpc: "2.0",
+              id: msg.id,
+              error: { code: -32001, message: "Authentication required. Send auth/verify with valid token first." },
+            });
+            socket.destroy();
            return;
          }
          if (msg.method === "netcatty/getContext" && onGetContext) {
@@ -72,11 +89,11 @@ function startBridge({ token, authDelayMs = 0, onGetContext = null }) {
              return;
            }
          }
-          socket.write(`${JSON.stringify({
+          writeLine({
            jsonrpc: "2.0",
            id: msg.id,
            result: { ok: true, marker: token },
-          })}\n`);
+          });
        };
        if (msg.method === "auth/verify" && authDelayMs > 0) {
          setTimeout(respond, authDelayMs);
@@ -123,19 +123,33 @@ function guardWriteOperation(command, { skipBlocklist = false } = {}) {
 }

 let tcpSocket = null;
-let pendingRequests = new Map(); // id -> { resolve, reject }
+let pendingRequests = new Map(); // id -> { resolve, reject, sock }
 let nextRpcId = 1;
 let tcpBuffer = "";

+// `destroyed` stays false after the peer FIN has already moved readyState to
+// "closed". Writing in that window hits writeAfterFIN and rejects the call
+// with "TCP connection lost" instead of reconnecting.
+function isLiveSocket(sock) {
+  return Boolean(
+    sock
+    && !sock.destroyed
+    && sock.readyState === "open"
+    && sock.writable
+    && !sock.readableEnded
+    && !sock.writableEnded
+  );
+}
+
 function rejectPendingOnSocket(sock, externalMessage) {
-  if (tcpSocket && tcpSocket !== sock) return;
  const managed = !externalDiscoveryPath;
  if (managed && tcpSocket === sock) tcpSocket = null;
  const message = managed ? "Not connected to Netcatty" : externalMessage;
-  for (const { reject: rej } of pendingRequests.values()) {
-    rej(new Error(message));
+  for (const [id, pending] of pendingRequests) {
+    if (pending.sock !== sock) continue;
+    pendingRequests.delete(id);
+    pending.reject(new Error(message));
  }
-  pendingRequests.clear();
 }

 function connectTcp() {
@@ -199,15 +213,16 @@ function connectTcp() {

 function sendRpc(method, params) {
  return new Promise((resolve, reject) => {
-    if (!tcpSocket || tcpSocket.destroyed) {
+    if (!isLiveSocket(tcpSocket)) {
      reject(new Error("Not connected to Netcatty"));
      return;
    }
+    const sock = tcpSocket;
    const id = nextRpcId++;
-    pendingRequests.set(id, { resolve, reject });
+    pendingRequests.set(id, { resolve, reject, sock });
    const msg = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
    debugLog("rpcCall", { id, method });
-    tcpSocket.write(msg);
+    sock.write(msg);
  });
 }

@@ -247,7 +262,12 @@ function dropActiveSocket() {
 let connecting = null;

 async function connectAndAuth() {
-  if (tcpSocket?.destroyed) tcpSocket = null;
+  // Drop the reference only. In-flight requests stay bound to the old socket
+  // and are rejected when that socket closes; they are not replayed.
+  if (!isLiveSocket(tcpSocket)) {
+    tcpSocket = null;
+    tcpBuffer = "";
+  }
  refreshExternalEndpoint();
  tcpBuffer = "";
  try {
@@ -264,8 +284,11 @@ async function connectAndAuth() {
 }

 function ensureConnected() {
-  if (tcpSocket && !tcpSocket.destroyed) return Promise.resolve();
+  // Join an in-flight reconnect before trusting tcpSocket. connectTcp assigns
+  // the socket before auth/verify returns; a second caller must wait for that
+  // re-auth instead of sending on an unauthenticated socket.
  if (connecting) return connecting;
+  if (isLiveSocket(tcpSocket)) return Promise.resolve();
  connecting = connectAndAuth().finally(() => {
    connecting = null;
  });
@@ -36,7 +36,7 @@ class PluginAgentService {
    this.clock = options.clock ?? Date.now;
    this.backends = new Map(); this.selections = new Map(); this.chats = new Map(); this.turns = new Map();
    this.budgets = new Map(); this.pendingOpens = new Set(); this.registrations = []; this.closed = false;
-    this.pendingSelections = new Map(); this.targetManager = null; this.targetSubscriptions = [];
+    this.pendingSelections = new Map(); this.startupTurns = new Map(); this.targetManager = null; this.targetSubscriptions = [];
    this.eventValidator = createDefinitionValidator("PluginAgentEvent");
    this.sessionValidator = createDefinitionValidator("PluginAgentHostSession");
    this.scopes = new DelegatedAgentScopes({ resolveOwner: (ctx) => this.#guard(ctx),
@@ -127,11 +127,33 @@ class PluginAgentService {
  }

  registerRpcCapabilities(registry) {
+    const startupLifetime = async (_context, next) => next();
+    startupLifetime.prepareAuthorization = (context) => {
+      if (context.method !== "agent.send") return undefined;
+      // Registry cleanup runs after its final authority check. Until then the
+      // caller still owns startup cancellation because no handle was delivered.
+      return () => {
+        const turn = this.startupTurns.get(context.permissionOperation);
+        if (!turn) return;
+        try {
+          if (!turn.handoffReady || context.signal.aborted) throw fail("cancelled");
+          this.#assertNow(turn);
+        } catch { this.#end(turn); }
+        turn.detachStartup();
+      };
+    };
+    this.registrations.push(registry.use(startupLifetime));
    for (const [operation, paramsType, resultType] of ROUTES) {
      const input = createDefinitionValidator(paramsType); const output = createDefinitionValidator(resultType);
      this.registrations.push(registry.registerRequest(`agent.${operation}`, async (params, context) => {
        const result = await this[operation](params, context); await this.#guard(context);
-        if (!output(result)) throw fail("internal"); return result;
+        if (!output(result)) throw fail("internal");
+        if (operation === "send") {
+          const turn = this.startupTurns.get(context.permissionOperation);
+          if (!turn || turn.handle !== result.turnHandle) throw fail("cancelled");
+          turn.handoffReady = true;
+        }
+        return result;
      }, { metadata: { capability: "plugin-agent", mutating: !["listBackends", "listChats", "history", "read"].includes(operation), permission: "ai.agent.use" },
        validateParams: (params) => { if (!input(params)) throw fail("invalidArgument"); return Object.freeze(structuredClone(params)); },
        authorization: async (params, context) => {
@@ -254,6 +276,11 @@ class PluginAgentService {
    try { await this.#backendCurrent(turn.chat.backend, ctx); }
    catch (error) { this.#end(turn, "unavailable"); throw error; }
    return this.scopes.dispatch(turn.ticket, ctx, { capabilityId: spec.capabilityId, targets }, async (execution) => {
+      this.#assertNow(turn);
+      // Ask may have waited while the configured backend was edited. Check the
+      // trusted renderer's current revision again before the selected effect.
+      try { await this.#backendCurrent(turn.chat.backend, ctx); }
+      catch (error) { this.#end(turn, "unavailable"); throw error; }
      this.#assertNow(turn); const result = await execute(execution); this.#assertNow(turn); return result;
    });
  }
@@ -267,7 +294,16 @@ class PluginAgentService {
      done: false, reading: false, bytes: 0, toolCalls: 0, generation: ++chat.generation, expiresAt: this.clock() + 300_000, hostHandle: null,
      policyRevision: this.permission.getPolicyRevision(this.database.getActivePlugin(owner.pluginId)), senderId: this.host.getSenderId() };
    chat.activeTurn = turn; this.turns.set(turn.handle, turn);
+    turn.context = { ...context, signal: controller.signal, assertActive: async () => this.#assertNow(turn) };
+    const cancelStartup = () => this.#end(turn);
+    turn.detachStartup = () => {
+      context.signal?.removeEventListener("abort", cancelStartup);
+      if (this.startupTurns.get(context.permissionOperation) === turn) this.startupTurns.delete(context.permissionOperation);
+    };
+    this.startupTurns.set(context.permissionOperation, turn);
+    context.signal?.addEventListener("abort", cancelStartup, { once: true });
    try {
+      context.signal?.throwIfAborted();
      this.#charge(owner); await this.#backendCurrent(chat.backend, context);
      turn.ticket = await this.scopes.begin(chat.scope.handle, context);
      turn.ticket.controller.signal.addEventListener("abort", () => this.#end(turn), { once: true });
@@ -330,7 +366,7 @@ class PluginAgentService {
  #end(turn, reason = "cancelled") {
    if (turn.done) return;
    const wasCurrent = turn.chat.activeTurn === turn;
-    turn.done = true; turn.endEvent = { kind: "end", reason }; clearTimeout(turn.timer); turn.controller.abort();
+    turn.done = true; turn.detachStartup?.(); turn.endEvent = { kind: "end", reason }; clearTimeout(turn.timer); turn.controller.abort();
    if (turn.ticket) this.scopes.finish(turn.ticket);
    turn.registration?.dispose();
    if (wasCurrent) {
@@ -338,7 +374,9 @@ class PluginAgentService {
      try { this.getMcpBridge().applyChatSessionCancelled(turn.chat.record.id, true); } catch {}
    }
    if (turn.hostHandle) void this.host.requestAgent("agent.release", { hostHandle: turn.hostHandle },
-      { ...turn.context, signal: undefined }).catch(() => {});
+      // Cleanup authenticates the owning source, independently of the ended
+      // turn or its completed Send request. The host still checks app lifetime.
+      { ...turn.context, signal: undefined, assertActive: async () => this.source.assertCurrent(turn.owner) }).catch(() => {});
  }
  async stop(params, context) { const turn = await this.#turn(params, context); this.#end(turn); return { ok: true }; }
  async closeChat(params, context) {
@@ -17,7 +17,7 @@ function fixture(t) {
  const manifest = { id: "com.example.agent", publisher: "example", version: "1.0.0", permissions: { required: ["ai.agent.use", "ai.agent.actions"] } };
  let identity = { pluginId: manifest.id, pluginVersion: manifest.version, runtimeId: "r1", runtimeKind: "browser", manifest };
  let sourceId = "source-a"; let time = 1; let locked = false; const modes = new Map(); let focus = "a"; let effects = 0;
-  const audits = []; const decisions = []; const hostRequests = []; const invalidations = new Set();
+  const audits = []; const decisions = []; const hostRequests = []; const releasedHandles = []; const invalidations = new Set();
  const plugin = () => ({ id: manifest.id, enabled: true, activeVersion: manifest.version, manifest,
    source: { id: sourceId, kind: "third-party", origin: "https://synthetic.invalid" }, runtime: { status: "running" } });
  const database = { getActivePlugin: (id) => id === manifest.id ? plugin() : null,
@@ -39,7 +39,7 @@ function fixture(t) {
  const host = { generation: 1, getSenderId: () => 7,
    assertActive: async (context) => { await context.assertActive(); if (locked) throw Error("Locked"); },
    onDidInvalidate: (callback) => { invalidations.add(callback); return () => invalidations.delete(callback); },
-    requestAgent: async (kind, payload) => {
+    requestAgent: async (kind, payload, context) => {
      hostRequests.push({ kind, payload: structuredClone(payload) });
      if (kind === "agent.backends") return { backends: [
        { hostHandle: backendHandle, backend: "catty", label: "Catty fixture", status: "supported", reason: "ready" },
@@ -50,6 +50,7 @@ function fixture(t) {
      if (kind === "agent.targets") return choose();
      if (kind === "agent.run") return run(payload);
      if (kind === "agent.next") return { done: false, event: events.shift() ?? { kind: "end", reason: "completed" }, session: sessions.get(payload.hostHandle) };
+      if (kind === "agent.release") { await context.assertActive(); releasedHandles.push(payload.hostHandle); }
      return { ok: true };
    }, releaseRuntime: () => {}, shutdown: () => {} };
  const delegation = new PluginAgentMcpDelegations();
@@ -72,7 +73,7 @@ function fixture(t) {
      { trustedAgentSenderId: 7, trustedAgentTurnTag: turn.turnHandle }, (context) => { context.beforeExecute(); effects++; return "synthetic"; });
  };
  t.after(() => { service.shutdown(); delegation.shutdown(); permission.shutdown(); fs.rmSync(directory, { recursive: true, force: true }); });
-  return { service, call, open, dispatch, events, sessions, hostRequests, decisions, audits, host, delegation, targetState,
+  return { service, call, open, dispatch, events, sessions, hostRequests, releasedHandles, decisions, audits, host, delegation, targetState,
    effects: () => effects, focusTo: (id) => { focus = id; }, focus: () => focus, modeTo: (value, permission = "ai.agent.actions") => { modes.set(permission, value); },
    approve: (fn) => { approve = fn; }, run: (fn) => { run = fn; }, tick: (ms) => { time += ms; },
    choose: (fn) => { choose = fn; }, resourceChanged: () => { for (const callback of resourceListeners) callback(); },
@@ -83,9 +84,12 @@ function fixture(t) {

 test("registered Agent routes validate opaque authority, report unsupported modes and preserve core-only native history", async (t) => {
  const f = fixture(t); const backends = await f.call("listBackends");
+  assert.deepEqual(f.hostRequests.map((request) => request.kind), ["agent.backends"], "public backend listing never starts native model discovery");
+  await assert.rejects(f.call("listBackends", { delegatedAgent: true }));
  assert.equal(backends.items.find((entry) => entry.backend === "codex").status, "unsupported");
  await assert.rejects(f.call("openChat", { backendRef: randomUUID(), selectionHandle: randomUUID(), permissionMode: "auto" }));
  const chat = await f.open(); const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic conversation" });
+  await assert.rejects(f.call("send", { chatHandle: chat.chatHandle, text: "Spoof delegated mode", delegatedAgent: false }));
  const [handle, session] = [...f.sessions][0];
  session.messages = [{ role: "user", content: "Synthetic conversation" }, { role: "assistant", content: "Synthetic answer" }];
  session.externalSessionId = "NATIVE_PRIVATE_SESSION"; f.events.push({ kind: "text", text: "Synthetic answer" });
@@ -118,6 +122,43 @@ test("actual source policy decides once per tool and targets never follow focus
  assert.equal(f.effects(), 1);
 });

+test("a duplicate owned-history Open cannot replace or cancel an active core chat", async (t) => {
+  const f = fixture(t); const chat = await f.open();
+  const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic active chat" });
+  const active = f.service.turns.get(turn.turnHandle);
+  await assert.rejects(f.open("catty", chat.conversationRef), { code: -32006 });
+  assert.equal(f.service.chats.size, 1); assert.equal(active.chat.activeTurn, active);
+  assert.equal(active.controller.signal.aborted, false); assert.equal(await f.dispatch(turn), "synthetic");
+});
+
+test("backend revision changed during Ask cannot execute the already selected target without any pending event read", async (t) => {
+  const f = fixture(t); f.modeTo("ask"); const chat = await f.open();
+  const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic pending approval" });
+  const internal = f.service.turns.get(turn.turnHandle); const native = new AbortController();
+  f.delegation.onRelease(internal.chat.record.id, turn.turnHandle, () => native.abort());
+  const entered = deferred(); const resume = deferred();
+  f.approve(async (request) => { entered.resolve(); await resume.promise; return { requestId: request.requestId, decision: "allow", scope: "once" }; });
+  const pending = f.dispatch(turn); await entered.promise;
+  const checksBeforeApproval = f.hostRequests.filter((item) => item.kind === "agent.current").length;
+  f.currentTo(false); resume.resolve();
+  const result = await pending.then(() => "executed", () => "rejected");
+  assert.equal(f.effects(), 0); assert.equal(result, "rejected");
+  assert.ok(f.hostRequests.filter((item) => item.kind === "agent.current").length > checksBeforeApproval);
+  assert.equal(native.signal.aborted, true); assert.equal(internal.controller.signal.aborted, true);
+  assert.equal(f.decisions.length, 1);
+});
+
+test("empty-argument environment Ask carries the canonical host operation and selected-target disclosure", async (t) => {
+  const f = fixture(t); f.choose(async () => ({ targets: [] })); f.modeTo("ask");
+  const chat = await f.open(); const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic environment" });
+  const internal = f.service.turns.get(turn.turnHandle);
+  await f.delegation.dispatch("netcatty/getContext", { chatSessionId: internal.chat.record.id },
+    { trustedAgentSenderId: 7, trustedAgentTurnTag: turn.turnHandle }, () => ({ hosts: [], hostCount: 0 }));
+  assert.equal(f.decisions.length, 1);
+  assert.deepEqual(f.decisions[0].displayContext.action, { capabilityId: "session.environment", text: "{}" });
+  assert.deepEqual(f.decisions[0].displayContext.selections, []);
+});
+
 test("Actions Deny keeps model conversation available with no tools; Agent-use Deny prevents host dispatch", async (t) => {
  const f = fixture(t); f.modeTo("deny"); const chat = await f.open();
  const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic model-only intent" });
@@ -158,6 +199,35 @@ test("late start/open completion after release cannot publish handles or affect
  assert.ok((await f.open()).chatHandle); assert.equal(f.service.chats.size, 1);
 });

+test("registered send cancellation during trusted startup revokes the exact turn before a handle can be handed off", async (t) => {
+  const f = fixture(t); const chat = await f.open(); const entered = deferred(); const resume = deferred();
+  const caller = new AbortController();
+  f.run(async () => { entered.resolve(); await resume.promise; return { hostHandle: randomUUID() }; });
+  const pending = f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic cancelled startup" }, { signal: caller.signal });
+  const rejected = assert.rejects(pending); await entered.promise;
+  const internal = [...f.service.turns.values()][0]; const native = new AbortController();
+  f.delegation.onRelease(internal.chat.record.id, internal.handle, () => native.abort());
+  caller.abort(); resume.resolve(); await rejected;
+  assert.equal(internal.chat.activeTurn, null); assert.equal(internal.controller.signal.aborted, true);
+  assert.equal(f.delegation.has(internal.chat.record.id), false); assert.equal(native.signal.aborted, true);
+  assert.equal(internal.hostHandle, null, "late startup completion cannot publish an orphan handle");
+  assert.equal(f.service.startupTurns.size, 0);
+});
+
+test("completed send detaches request lifetime from its live turn and cannot cancel replacement B", async (t) => {
+  const f = fixture(t); const chat = await f.open(); const caller = new AbortController();
+  const first = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic completed handoff" }, { signal: caller.signal });
+  const a = f.service.turns.get(first.turnHandle); caller.abort();
+  assert.equal(f.service.startupTurns.size, 0);
+  assert.equal(a.controller.signal.aborted, false); assert.equal(await f.dispatch(first), "synthetic");
+  await f.call("stop", { turnHandle: first.turnHandle });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.ok(f.releasedHandles.includes(a.hostHandle), "completed request lifetime cannot block exact host-handle cleanup");
+  const second = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic replacement B" });
+  const b = f.service.turns.get(second.turnHandle); caller.abort();
+  assert.equal(b.controller.signal.aborted, false); assert.equal(await f.dispatch(second), "synthetic");
+});
+
 test("worker lifecycle during target confirmation cannot silently bind a replacement connection or leave native work running", async (t) => {
  const f = fixture(t); const chat = await f.open(); const turn = await f.call("send", { chatHandle: chat.chatHandle, text: "Synthetic pending work" });
  const internal = f.service.turns.get(turn.turnHandle); const native = new AbortController();
@@ -0,0 +1,162 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { RegistryCatalogService } = require("./registryCatalogService.cjs");
+const { PluginContributionIconService } = require("./contributionIconService.cjs");
+const { MarketSourcesService } = require("./marketSourcesService.cjs");
+const { OFFICIAL_SOURCE, LOCAL_SOURCE, thirdPartySource } = require("./sourceIdentity.cjs");
+const { catalog, delivery, digest, makeFiles, read } = require("./fixtures/staticDistributionFixture.cjs");
+
+const sourcePng = read(delivery.plugins[0].iconLight.path.slice(1));
+const avatar = { path: `/assets/${digest(sourcePng)}.png`, sha256: digest(sourcePng), size: sourcePng.length };
+function filesFor(entries = catalog, change = () => {}) {
+  const files = makeFiles(entries, (index, sidecar) => {
+    sidecar.schemaVersion = 2;
+    for (const item of sidecar.plugins) {
+      item.avatar = structuredClone(avatar);
+      const entry = entries.find((entry) => entry.id === item.id);
+      if (entry.artifact) {
+        item.artifact = { path: `/assets/${entry.artifact.sha256}.ncpkg`, sha256: entry.artifact.sha256, size: 1 };
+        index.plugins.find((plugin) => plugin.id === item.id).versions[0].distribution = "release";
+      }
+    }
+    change(index, sidecar);
+  });
+  files.set(avatar.path, sourcePng);
+  return files;
+}
+function imageService(rasterizeIcon) {
+  return new PluginContributionIconService({ rasterizeIcon: rasterizeIcon ?? (async () => {
+    const png = Buffer.alloc(24); Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]).copy(png);
+    png.write("IHDR", 12); png.writeUInt32BE(32, 16); png.writeUInt32BE(32, 20); return png;
+  }) });
+}
+function registry(options = {}) {
+  const requests = [];
+  let files = options.files ?? filesFor();
+  const service = new RegistryCatalogService({ ...options,
+    fetch: options.fetch ?? (async (url, init) => {
+      requests.push(url);
+      assert.equal(new URL(url).origin, options.source?.origin ?? OFFICIAL_SOURCE.origin);
+      assert.equal(init.redirect, "manual"); assert.equal(init.credentials, "omit");
+      return files.has(new URL(url).pathname) ? new Response(files.get(new URL(url).pathname)) : new Response(null, { status: 404 });
+    }),
+    resolveAvatar: options.resolveAvatar ?? ((request) => imageServiceSingleton.resolveCatalogAvatar(request)),
+  });
+  const imageServiceSingleton = imageService();
+  return { service, requests, setFiles(value) { files = value; } };
+}
+
+test("v2 avatars use verified same-origin bytes and the shared image cache without GitHub", async () => {
+  const r = registry(); const snapshot = await r.service.list(); assert.equal(snapshot.error, null);
+  const entry = snapshot.entries[0];
+  const values = await Promise.all([r.service.author(entry.id, entry.selectionToken), r.service.author(entry.id, entry.selectionToken)]);
+  assert.deepEqual(values[0], values[1]); assert.match(values[0].avatar, /^data:image\/png;base64,/);
+  assert.equal(values[0].officialMaintained, true); assert.equal(values[0].author, "Netcatty");
+  assert.equal(r.requests.filter((url) => new URL(url).pathname === avatar.path).length, 1);
+  assert.ok(r.requests.every((url) => new URL(url).origin === OFFICIAL_SOURCE.origin));
+  await r.service.author(entry.id, entry.selectionToken);
+  assert.equal(r.requests.length, 5, "cached raster avoids another download");
+});
+
+test("third-party copies, community entries and local imports cannot acquire maintenance authority", async () => {
+  const copied = registry({ source: thirdPartySource("Netcatty official", "https://community.example.com") });
+  const entry = (await copied.service.list()).entries[0];
+  assert.equal((await copied.service.author(entry.id, entry.selectionToken)).officialMaintained, false);
+  const community = structuredClone(catalog[0]); community.id = "com.community.official";
+  community.manifest.id = community.id; community.author = "Netcatty official"; community.manifest.publisher = "netcatty";
+  const r = registry({ files: filesFor([community]) }); const listed = (await r.service.list()).entries[0];
+  assert.equal((await r.service.author(listed.id, listed.selectionToken)).officialMaintained, false);
+  const local = new MarketSourcesService({ database: { getActivePlugin: () => ({ id: catalog[0].id, activeVersion: catalog[0].version,
+    source: LOCAL_SOURCE, archiveSha256: "a".repeat(64), manifest: catalog[0].manifest, runtime: {} }) } });
+  assert.equal((await local.author({ kind: "installed", pluginId: catalog[0].id })).officialMaintained, false);
+  await assert.rejects(local.author({ kind: "installed", pluginId: catalog[0].id, officialMaintained: true }), /Invalid/);
+});
+
+test("avatar failure, redirects and mismatched bytes yield a placeholder without another origin", async () => {
+  for (const kind of ["missing", "hash", "format", "redirect"]) {
+    const files = filesFor(); const requests = [];
+    const r = registry({ files, fetch: async (url) => {
+      requests.push(url); const p = new URL(url).pathname;
+      if (p === avatar.path) {
+        if (kind === "redirect") return new Response(null, { status: 302, headers: { location: "https://avatars.githubusercontent.com/u/1" } });
+        if (kind === "missing") return new Response(null, { status: 404 });
+        if (kind === "hash") return new Response(Buffer.alloc(sourcePng.length));
+      }
+      return new Response(files.get(p));
+    }, ...(kind === "format" ? { resolveAvatar: async () => { throw new Error("Invalid PNG"); } } : {}) });
+    const entry = (await r.service.list()).entries[0]; const value = await r.service.author(entry.id, entry.selectionToken);
+    assert.equal(value.avatar, null, kind); assert.equal(value.officialMaintained, true);
+    assert.ok(requests.every((url) => new URL(url).origin === OFFICIAL_SOURCE.origin));
+  }
+});
+
+test("avatar schema rejects foreign paths, non-raster formats and invalid sizes before fetching", async () => {
+  for (const ref of [
+    { ...avatar, path: "https://avatars.githubusercontent.com/u/1" },
+    { ...avatar, path: `/assets/${avatar.sha256}.svg` },
+    { ...avatar, path: `/assets/${"a".repeat(64)}.png` },
+    { ...avatar, size: 0 }, { ...avatar, size: 256 * 1024 + 1 }, { ...avatar, size: 1.5 },
+  ]) {
+    const r = registry({ files: filesFor(catalog, (_index, delivery) => { delivery.plugins[0].avatar = ref; }) });
+    const result = await r.service.list(); assert.ok(result.error, JSON.stringify(ref));
+    assert.equal(r.requests.length, 4, "invalid delivery cannot cause an avatar request");
+  }
+});
+
+test("v2 package references enforce the publisher's positive 16MiB bound without installing", async () => {
+  const entry = structuredClone(catalog[0]);
+  entry.artifact = { sha256: "a".repeat(64), url: `${OFFICIAL_SOURCE.origin}/assets/${"a".repeat(64)}.ncpkg` };
+  for (const size of [0, 16 * 1024 * 1024, 16 * 1024 * 1024 + 1]) {
+    const r = registry({ files: filesFor([entry], (_index, sidecar) => { sidecar.plugins[0].artifact.size = size; }) });
+    const snapshot = await r.service.list();
+    assert.equal(Boolean(snapshot.error), size !== 16 * 1024 * 1024);
+    assert.equal(r.requests.length, 4, "catalog validation never downloads or installs the package");
+  }
+});
+
+test("a changed selection or removed source cannot publish an in-flight avatar result", async () => {
+  for (const change of ["selection", "source"]) {
+    let release; let entered; let enabled = true;
+    const started = new Promise((resolve) => { entered = resolve; });
+    const gate = new Promise((resolve) => { release = resolve; });
+    const r = registry({ sourceGuard() { if (!enabled) throw new Error("Source removed"); }, resolveAvatar: async () => { entered(); await gate; return "data:image/png;base64,eA=="; } });
+    const entry = (await r.service.list()).entries[0]; const pending = r.service.author(entry.id, entry.selectionToken); await started;
+    if (change === "selection") { r.setFiles(filesFor(catalog, (_i, sidecar) => { sidecar.plugins[0].avatar = null; })); await r.service.refresh(); }
+    else enabled = false;
+    release(); await assert.rejects(pending, /changed|removed/);
+  }
+});
+
+test("installed presentation requires exact source/version/package/manifest and rejects replacement during load", async () => {
+  const entry = structuredClone(catalog[0]); entry.artifact = { sha256: "a".repeat(64), url: `${OFFICIAL_SOURCE.origin}/assets/${"a".repeat(64)}.ncpkg` };
+  let plugin = { id: entry.id, activeVersion: entry.version, archiveSha256: entry.artifact.sha256, source: OFFICIAL_SOURCE, manifest: entry.manifest, runtime: {} };
+  const requests = []; const files = filesFor([entry]);
+  const database = { getActivePlugin: () => plugin, db: { prepare: () => ({ get: () => undefined }) } };
+  const service = new MarketSourcesService({ database, fetch: async (url) => { requests.push(url); return new Response(files.get(new URL(url).pathname)); } });
+  const query = { kind: "installed", pluginId: entry.id };
+  assert.equal((await service.author(query)).officialMaintained, false); assert.equal(requests.length, 0);
+  await service.list(); assert.equal((await service.author(query)).officialMaintained, true);
+  for (const patch of [{ activeVersion: "9.0.0" }, { archiveSha256: "b".repeat(64) }, { manifest: { ...entry.manifest, publisher: "other" } }, { source: LOCAL_SOURCE }]) {
+    const saved = plugin; plugin = { ...plugin, ...patch };
+    assert.equal((await service.author(query)).officialMaintained, false); plugin = saved;
+  }
+  let release; let entered;
+  const started = new Promise((resolve) => { entered = resolve; });
+  service.catalogs.get("official").resolveAvatar = async () => { entered(); await new Promise((resolve) => { release = resolve; }); return null; };
+  const pending = service.author(query); await started; plugin = { ...plugin, archiveSha256: "b".repeat(64) }; release();
+  await assert.rejects(pending, /Installed plugin changed/);
+});
+
+test("avatar decoding validates bytes and uses the existing bounded rasterizer", async () => {
+  let calls = 0;
+  const service = imageService(async () => { calls++; throw new Error("Decode failed"); });
+  const request = { sourceId: "official", reference: avatar, read: async () => sourcePng };
+  await assert.rejects(service.resolveCatalogAvatar(request), /Decode failed/); assert.equal(calls, 1);
+  await assert.rejects(service.resolveCatalogAvatar({ ...request, read: async () => Buffer.alloc(sourcePng.length) }), /bytes/); assert.equal(calls, 1);
+  await assert.rejects(service.resolveCatalogAvatar({ ...request, reference: { ...avatar, path: `/assets/${avatar.sha256}.webp` } }), /format|signature/); assert.equal(calls, 1);
+  const cached = imageService();
+  await cached.resolveCatalogAvatar(request);
+  await assert.rejects(cached.resolveCatalogAvatar({ ...request, reference: { ...avatar, size: avatar.size + 1 } }), /bytes/);
+  await assert.rejects(cached.resolveCatalogAvatar({ ...request, reference: { ...avatar, path: `/assets/${avatar.sha256}.webp` } }), /format|signature/);
+});
@@ -1,6 +1,7 @@
 "use strict";

 const path = require("node:path");
+const { createHash } = require("node:crypto");

 const { readContainedFile } = require("./pluginProtocol.cjs");
 const { createIsolatedContributionIconRasterizer } = require("./contributionIconRasterizer.cjs");
@@ -214,6 +215,35 @@ class PluginContributionIconService {
    return pending;
  }

+  // Called only with a host-selected, hash-bound registry reference. It shares
+  // the existing decoder, queue, cache and pending work with package icons.
+  async resolveCatalogAvatar({ sourceId, reference, read }) {
+    const key = JSON.stringify(["catalog-avatar", sourceId, reference.path, reference.sha256, reference.size]);
+    if (this.cache.has(key)) return this.cache.get(key);
+    if (this.pending.has(key)) return this.pending.get(key);
+    if (this.pending.size >= MAX_QUEUED_ICON_RASTERIZATIONS + MAX_CONCURRENT_ICON_RASTERIZATIONS) {
+      throw new Error("Plugin image queue is full");
+    }
+    const pending = (async () => {
+      const body = await read();
+      if (!Buffer.isBuffer(body) || body.length !== reference.size || body.length > 256 * 1024
+        || createHash("sha256").update(body).digest("hex") !== reference.sha256) throw new Error("Invalid plugin avatar bytes");
+      const extension = path.extname(reference.path);
+      if (![".png", ".webp"].includes(extension)) throw new Error("Invalid plugin avatar format");
+      const inspected = inspectContributionIconSource(body, extension);
+      if (inspected.mimeType !== (extension === ".png" ? "image/png" : "image/webp")) throw new Error("Plugin avatar format mismatch");
+      const png = await this.rasterizeIcon({ body, ...inspected, maxEdge: MAX_ICON_EDGE });
+      if (!png.length || png.length > MAX_ICON_PNG_BYTES) throw new Error("Plugin avatar output is too large");
+      inspectContributionIconSource(png, ".png", MAX_ICON_EDGE);
+      const value = `data:image/png;base64,${png.toString("base64")}`;
+      if (this.cache.size >= 256) this.cache.clear();
+      this.cache.set(key, value);
+      return value;
+    })().finally(() => this.pending.delete(key));
+    this.pending.set(key, pending);
+    return pending;
+  }
+
  async #resolveUncached({ pluginId, plugin, icon, cacheKey }) {
    const packageRoot = await this.packageStore.preparePackageRoot(plugin);
    const result = Object.freeze({
@@ -14,3 +14,12 @@ The fixture includes no executable plugin package, avatar or credentials.

 Schema revisions must be coordinated with the registry publisher. In particular,
 artifact/avatar are deliberately null in v1; do not expand this consumer alone.
+
+`delivery-v2.schema.json` is vendored without changes from
+`binaricat/netcatty-plugins@2ffed31ad6a430e3711a63a902305063bd2504f8`,
+`schema/delivery-v2.schema.json` (Git blob
+`7a57504fbea272ca0e873725e050d1f15352cb5b`). The v2 consumer retains the pinned v1
+schema and permits positive-size package references up to 16MiB and PNG/WebP avatar references.
+Avatar references require positive size up to 256KiB and exact content-addressed
+paths. No v3 path is added. The original bootstrap bytes remain unchanged, and
+client support does not publish or activate live metadata.
@@ -0,0 +1,222 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Netcatty static delivery v2 (reviewed avatars and packages)",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "registryCommit",
+    "plugins",
+    "catalogSha256",
+    "indexSha256",
+    "sourceLockSha256",
+    "builderSha256"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": 2
+    },
+    "registryCommit": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40}$"
+    },
+    "plugins": {
+      "type": "array",
+      "maxItems": 1000,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "version",
+          "repository",
+          "commit",
+          "readme",
+          "iconLight",
+          "iconDark",
+          "avatar",
+          "artifact"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          },
+          "repository": {
+            "type": "string"
+          },
+          "commit": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40}$"
+          },
+          "readme": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "path",
+              "sha256",
+              "size"
+            ],
+            "properties": {
+              "path": {
+                "type": "string",
+                "pattern": "^/assets/[a-f0-9]{64}\\.(md|png|webp|ncpkg)$"
+              },
+              "sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "size": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 262144
+              }
+            }
+          },
+          "iconLight": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "path",
+                  "sha256",
+                  "size"
+                ],
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "pattern": "^/assets/[a-f0-9]{64}\\.(md|png|webp|ncpkg)$"
+                  },
+                  "sha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "size": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 262144
+                  }
+                }
+              }
+            ]
+          },
+          "iconDark": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "path",
+                  "sha256",
+                  "size"
+                ],
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "pattern": "^/assets/[a-f0-9]{64}\\.(md|png|webp|ncpkg)$"
+                  },
+                  "sha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "size": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 262144
+                  }
+                }
+              }
+            ]
+          },
+          "avatar": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "path",
+                  "sha256",
+                  "size"
+                ],
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "pattern": "^/assets/[a-f0-9]{64}\\.(png|webp)$"
+                  },
+                  "sha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "size": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 262144
+                  }
+                }
+              }
+            ]
+          },
+          "artifact": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "path",
+                  "sha256",
+                  "size"
+                ],
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "pattern": "^/assets/[a-f0-9]{64}\\.ncpkg$"
+                  },
+                  "sha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "size": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 16777216
+                  }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    "catalogSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "indexSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "sourceLockSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "builderSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    }
+  }
+}
@@ -16,14 +16,7 @@ ajv.addSchema(require("./generated/plugin-contract.schema.json"));
 const validateIndex = ajv.compile(require("./distribution/index.schema.json"));
 const deliverySchema = require("./distribution/delivery.schema.json");
 const validateDelivery = ajv.compile(deliverySchema);
-const deliveryV2 = structuredClone(deliverySchema);
-deliveryV2.title = "Netcatty static delivery v2 (hash-bound packages)";
-deliveryV2.properties.schemaVersion.const = 2;
-const packageRef = structuredClone(deliveryV2.properties.plugins.items.properties.readme);
-packageRef.properties.path.pattern = "^/assets/[a-f0-9]{64}\\.ncpkg$";
-packageRef.properties.size.maximum = 32 * 1024 * 1024;
-deliveryV2.properties.plugins.items.properties.artifact = { oneOf: [{ type: "null" }, packageRef] };
-const validateDeliveryV2 = ajv.compile(deliveryV2);
+const validateDeliveryV2 = ajv.compile(require("./distribution/delivery-v2.schema.json"));
 const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const tuple = (entry) => JSON.stringify([entry.id, entry.version, entry.repository, entry.commit]);

@@ -101,9 +94,10 @@ function validateSet(pointer, entries, index, delivery, origin = DISTRIBUTION_OR
    if (!catalogTuples.has(key) || resources.has(key)) throw new Error("Delivery identity does not match catalog tuple");
    assertAsset(plugin.readme, ["md"]);
    for (const icon of [plugin.iconLight, plugin.iconDark]) if (icon !== null) assertAsset(icon, ["png", "webp"]);
+    if (plugin.avatar !== null) assertAsset(plugin.avatar, ["png", "webp"]);
    const entry = entries.find((item) => tuple(item) === key);
    if (plugin.artifact !== null) {
-      assertReference(plugin.artifact, `/assets/${plugin.artifact.sha256}.ncpkg`, 32 * 1024 * 1024);
+      assertReference(plugin.artifact, `/assets/${plugin.artifact.sha256}.ncpkg`, 16 * 1024 * 1024);
      if (!entry.artifact || entry.artifact.sha256 !== plugin.artifact.sha256 || entry.artifact.url !== `${origin}${plugin.artifact.path}`) throw new Error("Package delivery does not match catalog hash and source");
    } else if (entry.artifact) throw new Error("Catalog package has no delivery resource");
    resources.set(key, plugin);
@@ -208,6 +208,12 @@ class PluginFilesystemBroker {
    };
  }
  validatePath(params) { return assertPathParams(params); }
+  validateDirectory(params) {
+    if (typeof this.openDirectoryHandle !== "function") {
+      throw new PluginRpcError(RPC_ERRORS.unsupported, "Secure plugin directory enumeration is unavailable on this runtime");
+    }
+    return assertPathParams(params);
+  }

  describeReadAuthorization(params, resourceKind = "exact") {
    const value = assertPathParams(params);
@@ -350,19 +356,13 @@ class PluginFilesystemBroker {
  }

  async readDirectory(params, context) {
-    const value = assertPathParams(params);
+    const value = this.validateDirectory(params);
    await this.#assertReadable(value.path);
    assertAuthorizedPath(context, "filesystem.read", value.path);
    const { canonical, stats } = await resolveExistingPath(value.path, this.fileSystem);
    await this.#assertReadable(canonical);
    assertAuthorizedPath(context, "filesystem.read", canonical);
    if (!stats.isDirectory()) throw invalidArgument("Plugin filesystem directory target is not a directory");
-    if (!this.openDirectoryHandle) {
-      throw new PluginRpcError(
-        RPC_ERRORS.unsupported,
-        "Secure plugin directory enumeration is unavailable on this runtime",
-      );
-    }
    const directory = await this.openDirectoryHandle(canonical, { signal: context.signal });
    if (
      !directory
@@ -7165,6 +7165,9 @@
    "TerminalInputDraftFeature": {
      "const": "terminal.input-drafts"
    },
+    "FilesystemDirectoryEnumerationFeature": {
+      "const": "filesystem.directory-enumeration"
+    },
    "HostTerminalInputProposalRequest": {
      "type": "object",
      "required": [
@@ -38,6 +38,7 @@ const { HOST_INTERACTION_FEATURE, PluginHostInteractionService } = require("./ho
 const { PluginHostVaultService } = require("./hostVaultService.cjs");
 const { PluginAISourceBinding } = require("./ai/sourceBinding.cjs");
 const HOST_VAULT_FEATURE = require("./generated/plugin-contract.schema.json").$defs.HostVaultFeature.const;
+const DIRECTORY_ENUMERATION_FEATURE = require("./generated/plugin-contract.schema.json").$defs.FilesystemDirectoryEnumerationFeature.const;
 const { PluginPermissionEngine } = require("./permissionEngine.cjs");
 const { PluginProtocol } = require("./pluginProtocol.cjs");
 const { PluginViewHost } = require("./pluginViewHost.cjs");
@@ -101,7 +102,9 @@ function createPluginHostService(options) {
  const paths = createPluginPaths(options.app.getPath("userData"));
  const appRoot = options.appRoot ?? options.app.getAppPath();
  const runtimeDirectory = options.runtimeDirectory ?? path.join(__dirname, "runtime");
-  const supportedFeatures = [...new Set(["terminal.input-drafts", "terminal.selection-sharing", "appearance.theme-packs", "metadata.brand-icon", BYTE_STREAM_FEATURE, ...PLUGIN_AI_CONTEXT_FEATURES, PLUGIN_AGENT_FEATURE, NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, HOST_VAULT_FEATURE, VAULT_PAGES_FEATURE, TERMINAL_SIDEBAR_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])];
+  const supportedFeatures = [...new Set(["terminal.input-drafts", "terminal.selection-sharing", "appearance.theme-packs", "metadata.brand-icon", BYTE_STREAM_FEATURE, ...PLUGIN_AI_CONTEXT_FEATURES, PLUGIN_AGENT_FEATURE, NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, HOST_VAULT_FEATURE, VAULT_PAGES_FEATURE, TERMINAL_SIDEBAR_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])]
+    .filter((feature) => feature !== DIRECTORY_ENUMERATION_FEATURE);
+  if (typeof options.openPluginDirectoryHandle === "function") supportedFeatures.push(DIRECTORY_ENUMERATION_FEATURE);
  const database = new PluginDatabase(paths.database);
  let interactionService;
  let byteStreamService;
@@ -516,7 +519,8 @@ function createPluginHostService(options) {
      themeService,
      interactionService,
      hostVaultService,
-      catalogService: new MarketSourcesService({ database, manager, fetch: options.electron.net?.fetch?.bind(options.electron.net) }),
+      catalogService: new MarketSourcesService({ database, manager, fetch: options.electron.net?.fetch?.bind(options.electron.net),
+        resolveAvatar: (request) => contributionIconService.resolveCatalogAvatar(request) }),
      companionSupervisor,
      contributionIconService,
      contributionService,
@@ -335,6 +335,8 @@ test("host service wires a handle-bound directory adapter without changing the R
    },
  });
  context.after(() => service.manager.shutdown());
+  assert.ok(service.runtimeSupervisor.supportedFeatures.includes("filesystem.directory-enumeration"));
+  assert.ok(service.packageStore.supportedFeatures.includes("filesystem.directory-enumeration"));
  const pluginManifest = {
    id: "com.example.directory",
    name: "directory",
@@ -481,3 +483,27 @@ test("Deny for the privileged development runtime stops its activation through t
  assert.equal(stops, 1); assert.equal(current, identity); assert.equal(service.database.getActivePlugin(manifest.id).enabled, true);
  service.database.privateOwner = privateOwner;
 });
+
+test("production host composition does not advertise or prompt for unavailable directory enumeration", async (context) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-directory-availability-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  let prompts = 0;
+  const feature = "filesystem.directory-enumeration";
+  // Same adapter-free composition as main/registerBridges; even an explicit extra
+  // supportedFeatures entry cannot claim an adapter that was never supplied.
+  const service = createPluginHostService({ ...createOptions(root), supportedFeatures: [feature],
+    requestPermissionDecision: async () => { prompts++; throw new Error("must not prompt"); } });
+  context.after(() => service.manager.shutdown());
+  assert.equal(service.runtimeSupervisor.supportedFeatures.includes(feature), false);
+  assert.equal(service.packageStore.supportedFeatures.includes(feature), false);
+  let authorizations = 0, probes = 0;
+  service.permissionEngine.authorize = async () => { authorizations++; throw new Error("must not authorize"); };
+  service.filesystemBroker.fileSystem = new Proxy({}, { get() { probes++; throw new Error("must not probe"); } });
+  const manifest = { id: "com.example.unavailable-directory", version: "1.0.0",
+    permissions: { optional: [{ permission: "filesystem.read", resources: [root] }] } };
+  const routes = service.rpcRegistry.createRoutes({ pluginId: manifest.id, pluginVersion: manifest.version,
+    runtimeId: "runtime-unavailable", runtimeKind: "browser", manifest });
+  await assert.rejects(routes.requestHandlers["filesystem.readDirectory"]({ path: root }, transportContext()),
+    (error) => error.code === -32012 && /unavailable/.test(error.message));
+  assert.equal(authorizations, 0); assert.equal(prompts, 0); assert.equal(probes, 0);
+});
@@ -2,6 +2,9 @@
 const { PluginSourceRegistry } = require("./sourceRegistry.cjs");
 const { RegistryCatalogService } = require("./registryCatalogService.cjs");
 const { createSourceFetch } = require("./sourceFetch.cjs");
+const { isDeepStrictEqual } = require("node:util");
+
+const installedIdentity = (plugin) => JSON.stringify([plugin?.id, plugin?.activeVersion, plugin?.archiveSha256, plugin?.source, plugin?.manifest, plugin?.runtime?.quarantinedAt]);

 class MarketSourcesService {
  constructor(options) {
@@ -9,6 +12,15 @@ class MarketSourcesService {
    this.manager = options.manager;
    this.registry = new PluginSourceRegistry(options.database);
    this.catalogs = new Map();
+    this.catalogIdentities = new Map();
+    this.changeListeners = new Set();
+  }
+  onDidChange(listener) {
+    this.changeListeners.add(listener);
+    return { dispose: () => this.changeListeners.delete(listener) };
+  }
+  #changed(sourceId) {
+    for (const listener of this.changeListeners) listener({ sourceId });
  }
  #catalog(sourceId = "official") {
    const source = this.registry.get(sourceId);
@@ -22,21 +34,71 @@ class MarketSourcesService {
    }
    return catalog;
  }
-  list(sourceId) { return this.#catalog(sourceId).list(); }
+  #publishCatalogIdentity(sourceId, entries) {
+    // Selection tokens bind the validated entry and its delivery resources.
+    const identity = JSON.stringify(entries.map((entry) => [entry.id, entry.selectionToken]));
+    if (this.catalogIdentities.get(sourceId) !== identity) {
+      this.catalogIdentities.set(sourceId, identity);
+      this.#changed(sourceId);
+    }
+  }
+  list(sourceId = "official") {
+    return this.#catalog(sourceId).list().then((snapshot) => {
+      this.#publishCatalogIdentity(sourceId, snapshot.entries);
+      return snapshot;
+    });
+  }
  readme(id, token, sourceId) { return this.#catalog(sourceId).readme(id, token); }
+  async author(request) {
+    if (!request || typeof request !== "object" || Array.isArray(request)
+      || typeof request.pluginId !== "string" || !/^[a-z0-9][a-z0-9.-]{1,127}$/u.test(request.pluginId)) throw new TypeError("Invalid plugin author request");
+    if (request.kind === "catalog") {
+      if (Object.keys(request).some((key) => !["kind", "pluginId", "selectionToken", "sourceId"].includes(key))) throw new TypeError("Invalid plugin author request");
+      return this.#catalog(request.sourceId).author(request.pluginId, request.selectionToken);
+    }
+    if (request.kind !== "installed" || Object.keys(request).some((key) => !["kind", "pluginId"].includes(key))) throw new TypeError("Invalid installed author request");
+    const plugin = this.options.database.getActivePlugin(request.pluginId);
+    if (!plugin?.activeVersion) return null;
+    const captured = installedIdentity(plugin);
+    let value = { author: plugin.manifest?.publisher ?? "", avatar: null, officialMaintained: false,
+      sourceId: plugin.source.id, version: plugin.activeVersion, archiveSha256: plugin.archiveSha256 ?? null };
+    if (plugin.runtime?.quarantinedAt == null) {
+      try {
+        // Presentation reuses an already validated catalog. It never refreshes
+        // a source merely because the installed list becomes visible.
+        this.registry.get(plugin.source.id);
+        const catalog = this.catalogs.get(plugin.source.id);
+        const entry = catalog?.publicEntries.find((item) => item.id === plugin.id && item.version === plugin.activeVersion
+          && item.artifact?.sha256 === plugin.archiveSha256 && isDeepStrictEqual(item.manifest, plugin.manifest));
+        if (entry) value = await catalog.author(entry.id, entry.selectionToken);
+      } catch { /* No exact current source match confers no maintenance badge. */ }
+    }
+    if (captured !== installedIdentity(this.options.database.getActivePlugin(request.pluginId))) throw new Error("Installed plugin changed while loading its author");
+    return value;
+  }
  install(id, token, sourceId = "official", acceptedSourceId) {
    if (sourceId !== "official" && acceptedSourceId !== sourceId) throw new Error("Review and confirm this third-party source before installing");
-    return this.#catalog(sourceId).install(id, token);
+    const catalog = this.#catalog(sourceId);
+    return catalog.install(id, token).finally(() => {
+      // A rejected stale selection can still have published a newer snapshot.
+      this.#publishCatalogIdentity(sourceId, catalog.publicEntries);
+    });
  }
  listSources() { return this.registry.list(); }
  addSource(payload) { return this.manager.changeMarketSource(() => this.registry.add(payload?.name, payload?.address)); }
-  updateSource(payload) { return this.manager.changeMarketSource(() => this.registry.update(payload?.id, payload?.name, payload?.enabled)); }
+  async updateSource(payload) {
+    const source = await this.manager.changeMarketSource(() => this.registry.update(payload?.id, payload?.name, payload?.enabled));
+    this.#changed(source.id);
+    return source;
+  }
  async removeSource(payload) {
    if (typeof payload?.disablePlugins !== "boolean") throw new Error("Choose whether to disable installed plugins");
    await this.manager.changeMarketSource(() => {
      this.registry.remove(payload.id);
      this.catalogs.delete(payload.id);
+      this.catalogIdentities.delete(payload.id);
    }, payload.disablePlugins ? payload.id : undefined);
+    this.#changed(payload.id);
  }
 }
 module.exports = { MarketSourcesService };
@@ -41,7 +41,9 @@ const CHANNELS = Object.freeze({
  updateSource: "netcatty:plugins:update-source",
  removeSource: "netcatty:plugins:remove-source",
  catalog: "netcatty:plugins:catalog",
+  catalogChanged: "netcatty:plugins:catalog-changed",
  catalogReadme: "netcatty:plugins:catalog-readme",
+  author: "netcatty:plugins:author",
  catalogInstall: "netcatty:plugins:catalog-install",
  install: "netcatty:plugins:install",
  setEnabled: "netcatty:plugins:set-enabled",
@@ -679,6 +681,10 @@ function registerPluginBridge(ipcMain, options) {
  handle(CHANNELS.updateSource, async (_manager, payload) => options.catalogService.updateSource(payload));
  handle(CHANNELS.removeSource, async (_manager, payload) => options.catalogService.removeSource(payload));
  handle(CHANNELS.catalog, async (_manager, payload) => options.catalogService?.list(payload?.sourceId) ?? { entries: [], source: "builtin", error: "Plugin catalog unavailable" });
+  handle(CHANNELS.author, async (_manager, payload) => {
+    if (!options.catalogService) throw new Error("Plugin catalog unavailable");
+    return options.catalogService.author(payload);
+  });
  handle(CHANNELS.catalogReadme, async (_manager, payload) => {
    if (!options.catalogService) throw new Error("Plugin catalog unavailable");
    return options.catalogService.readme(payload?.id, payload?.selectionToken, payload?.sourceId);
@@ -1703,6 +1709,7 @@ function registerPluginBridge(ipcMain, options) {
    publishScopeCatalog(event);
    return null;
  });
+  options.catalogService?.onDidChange?.((event) => options.broadcast?.(CHANNELS.catalogChanged, event));
  contributionService?.onDidChange?.((event) => options.broadcast?.(CHANNELS.contributionsChanged, event));
  contributionService?.onDidPostViewMessage?.((event) => options.broadcast?.(CHANNELS.viewMessagePosted, event));
  viewHost?.onDidClose?.((event) => options.broadcast?.(CHANNELS.viewClosed, event));
@@ -101,6 +101,19 @@ test("plugin management bridge checks sender ownership before invoking manager",
  );
 });

+test("author presentation is a trusted-app-only route and forwards no invented authority", async () => {
+  const ipcMain = createIpcMain(); const calls = [];
+  registerPluginBridge(ipcMain, { manager: { initialize: async () => {} }, isTrustedSender: createTrustedPluginBridgeSender({ devServerUrl: "http://localhost:5173" }),
+    catalogService: { author: async (request) => { calls.push(request); return { author: "Netcatty", avatar: null, officialMaintained: false }; } } });
+  const payload = { kind: "catalog", pluginId: "com.netcatty.starter", selectionToken: "a".repeat(64), sourceId: "official" };
+  for (const url of ["netcatty-plugin://plugin-runtime/index.html", "https://attacker.invalid/"]) {
+    await assert.rejects(ipcMain.handlers.get(CHANNELS.author)({ senderFrame: { url } }, payload), /Untrusted/);
+  }
+  assert.deepEqual(calls, []);
+  const result = await ipcMain.handlers.get(CHANNELS.author)({ senderFrame: { url: "app://netcatty/index.html" } }, payload);
+  assert.equal(result.officialMaintained, false); assert.deepEqual(calls, [payload]);
+});
+
 test("plugin Vault credential catalog updates only through the trusted host bridge", async () => {
  const ipcMain = createIpcMain();
  const updates = [];
@@ -0,0 +1,90 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const { PluginDatabase } = require("./database.cjs");
+const { PluginContributionService } = require("./contributionService.cjs");
+const { PluginSyncSidecarService } = require("./pluginSyncSidecarService.cjs");
+const { registerPluginBridge, CHANNELS } = require("./pluginBridge.cjs");
+const { OFFICIAL_SOURCE, thirdPartySource } = require("./sourceIdentity.cjs");
+
+const id = "com.example.sync-composition";
+const synced = `${id}.synced`, local = `${id}.local`;
+const manifest = {
+  manifestVersion: 1, id, name: "Synthetic sync composition", version: "1.0.0", publisher: "example",
+  engines: { netcatty: ">=0.0.0", api: ">=0.1.0-internal <0.2.0" }, main: { browser: "index.js" },
+  contributes: { settings: [
+    { id: synced, label: "Synced", control: "text", scope: "application", default: "default-sync", sync: true },
+    { id: local, label: "Local", control: "text", scope: "application", default: "default-local", sync: false },
+  ] },
+};
+function install(database, source = OFFICIAL_SOURCE, enabled = true) {
+  database.installVersion({ pluginId: id, version: manifest.version, manifest, source,
+    archiveSha256: "a".repeat(64), packageRelativePath: "synthetic/no-executable-package" }, { enable: enabled });
+}
+function profile(context, label, clock) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `netcatty-sync-composition-${label}-`));
+  const database = new PluginDatabase(path.join(root, "plugins.sqlite"), { clock: () => clock });
+  context.after(() => { database.close(); fs.rmSync(root, { recursive: true, force: true }); });
+  const runtimeSupervisor = {
+    start: async () => { throw new Error("composition test must not execute a plugin"); },
+    request: async () => { throw new Error("composition test must not call a plugin"); },
+    notify: async () => {},
+  };
+  const contributions = new PluginContributionService({ database, runtimeSupervisor, getLocale: () => "en" });
+  const sidecars = new PluginSyncSidecarService({ database, contributionService: contributions });
+  const handlers = new Map();
+  registerPluginBridge({ handle: (name, handler) => handlers.set(name, handler), on() {} }, {
+    manager: { initialize: async () => {}, database }, contributionService: contributions,
+    syncSidecarService: sidecars, isTrustedSender: (event) => event?.trusted === true,
+  });
+  return { database, contributions, sidecars,
+    collect: () => handlers.get(CHANNELS.syncSidecarsCollect)({ trusted: true }),
+    apply: (bundle) => handlers.get(CHANNELS.syncSidecarsApply)({ trusted: true }, bundle),
+    untrustedApply: (bundle) => handlers.get(CHANNELS.syncSidecarsApply)({ trusted: false }, bundle) };
+}
+
+test("two real profiles collect/apply/hydrate only opted-in source-bound settings through registered host entries", async (context) => {
+  for (const state of ["enabled", "disabled", "missing", "other-source"]) {
+    await context.test(state, async (context) => {
+      const a = profile(context, "sender", 200), b = profile(context, "recipient", 100);
+      install(a.database);
+      await a.contributions.updateSetting(id, synced, "synthetic-shared-value");
+      await a.contributions.updateSetting(id, local, "synthetic-device-only-value");
+      const bundle = await a.collect();
+      assert.equal(bundle.entries.filter((entry) => entry.kind === "settings").length, 1);
+      assert.equal(bundle.entries.some((entry) => entry.value === "synthetic-device-only-value"), false);
+      const owner = a.database.privateOwner(id);
+      assert.equal(bundle.entries[0].pluginId, owner);
+      if (state !== "missing") install(b.database,
+        state === "other-source" ? thirdPartySource("Synthetic community", "https://community.example.com") : OFFICIAL_SOURCE,
+        state !== "disabled");
+      await assert.rejects(b.untrustedApply(bundle), /Untrusted/);
+      assert.equal(b.database.listAllSyncSidecars().length, 0, "untrusted sender never applies remote rows");
+      const result = await b.apply(bundle);
+      assert.equal(result.applied, true);
+      assert.equal(b.database.getSetting(id, local, "application", "application"), undefined);
+      if (state === "enabled") {
+        assert.equal(await b.contributions.getSetting(id, synced), "synthetic-shared-value");
+        assert.equal(await b.contributions.getSetting(id, local), "default-local");
+      } else {
+        assert.equal(b.database.getSetting(id, synced, "application", "application"), undefined,
+          "missing, disabled or different-source plugins cannot receive active settings");
+        assert.ok(b.database.listAllSyncSidecars().some((entry) => entry.pluginId === owner), "remote row is retained without execution");
+        await b.sidecars.hydrateInstalledPluginSettings(id);
+        assert.equal(b.database.getSetting(id, synced, "application", "application"), undefined);
+        if (state === "disabled") b.database.setEnabled(id, true);
+        if (state === "missing") install(b.database);
+        await b.sidecars.hydrateInstalledPluginSettings(id);
+        assert.equal(await b.contributions.getSetting(id, synced), state === "other-source" ? "default-sync" : "synthetic-shared-value");
+        if (state === "other-source") assert.notEqual(b.database.privateOwner(id), owner);
+      }
+      const collected = await b.collect();
+      assert.equal(collected.entries.some((entry) => entry.value === "synthetic-device-only-value"), false);
+      assert.equal(await a.contributions.getSetting(id, local), "synthetic-device-only-value", "sender's local-only setting stays local");
+    });
+  }
+});
@@ -3,6 +3,7 @@
 const { createHash } = require("node:crypto");
 const { PluginCatalogService, validateCatalog, MAX_CATALOG_BYTES } = require("./catalogService.cjs");
 const { REGISTRY_URL, fetchDistribution, fetchVerified, tuple } = require("./distributionSnapshot.cjs");
+const { isOfficialMaintained } = require("./sourceIdentity.cjs");
 const tokenFor = (entry) => createHash("sha256").update(JSON.stringify(entry)).digest("hex");

 function prepareSnapshot(value, resources = new Map(), source) {
@@ -19,6 +20,7 @@ class RegistryCatalogService extends PluginCatalogService {
    this.source = "builtin";
    this.error = null;
    this.refreshing = null;
+    this.resolveAvatar = options.resolveAvatar;
  }
  async refresh() {
    if (this.refreshing) return this.refreshing;
@@ -58,6 +60,22 @@ class RegistryCatalogService extends PluginCatalogService {
    return entry;
  }
  artifactSize(entry) { return this.resources.get(tuple(entry))?.artifact?.size; }
+  async author(id, token) {
+    this.sourceGuard();
+    const entry = this.selected(id, token);
+    const reference = this.resources.get(tuple(entry))?.avatar;
+    let avatar = null;
+    if (reference && this.resolveAvatar) {
+      try {
+        avatar = await this.resolveAvatar({ sourceId: this.marketSource.id, reference,
+          read: () => fetchVerified(reference, this.fetch, this.origin) });
+      } catch { /* Missing or invalid imagery uses the same author placeholder. */ }
+    }
+    this.sourceGuard();
+    this.selected(id, token);
+    return { author: entry.author, avatar, officialMaintained: isOfficialMaintained(entry, this.marketSource),
+      sourceId: this.marketSource.id, version: entry.version, archiveSha256: entry.artifact?.sha256 ?? null };
+  }
  async readme(id, token) {
    const entry = this.selected(id, token);
    const resource = this.resources.get(tuple(entry))?.readme;
@@ -5,7 +5,7 @@ import {
  PLUGIN_ERROR_WIRE_CODES,
  pluginErrorToRpcError,
 } from "@netcatty/plugin-sdk";
-import { createMessagePortStreamEnvelope, PLUGIN_HOST_INTERACTION_LIMITS } from "@netcatty/plugin-contract";
+import { createMessagePortStreamEnvelope, PLUGIN_HOST_INTERACTION_LIMITS, PLUGIN_FILESYSTEM_DIRECTORY_ENUMERATION_FEATURE } from "@netcatty/plugin-contract";
 import { createPluginStreamEndpoint } from "./pluginStreamEndpoint.mjs";
 import { connectByteStream } from "./byteStreamClient.mjs";

@@ -415,8 +415,12 @@ function createPluginContext(config, client, runtimeApi) {
      ...options,
    }).then(() => undefined),
    stat: (filePath) => client.request("filesystem.stat", { path: filePath }),
-    readDirectory: (directoryPath) => client.request("filesystem.readDirectory", { path: directoryPath })
-      .then((result) => result.entries),
+    readDirectory: async (directoryPath) => {
+      if (!config.enabledFeatures?.includes(PLUGIN_FILESYSTEM_DIRECTORY_ENUMERATION_FEATURE)) {
+        throw new PluginError("unsupported", "Secure plugin directory enumeration is unavailable on this runtime");
+      }
+      return (await client.request("filesystem.readDirectory", { path: directoryPath })).entries;
+    },
  };
  const companions = {
    start: async (companionId) => {
@@ -78,7 +78,7 @@ test("runtime peer exposes secure host capabilities over the canonical RPC trans
      pluginVersion: "1.0.0",
      netcattyVersion: "1.0.0",
      apiVersion: "0.1.0-internal",
-      enabledFeatures: [],
+      enabledFeatures: ["filesystem.directory-enumeration"],
    },
    async loadPlugin() {
      return {
@@ -128,7 +128,7 @@ test("runtime peer exposes secure host capabilities over the canonical RPC trans
  const initialized = await host.request("plugin.initialize", {
    netcattyVersion: "1.0.0",
    apiVersion: "0.1.0-internal",
-    supportedFeatures: [],
+    supportedFeatures: ["filesystem.directory-enumeration"],
  });
  assert.equal(initialized.pluginId, "com.example.peer");
  const unhandledStream = await host.streams.openOutgoing("unhandled", 1024);
@@ -616,3 +616,23 @@ test("runtime peer routes connection and importer Provider operation maps", asyn
  await peer.dispose();
  host.close();
 });
+
+test("actual SDK directory call rejects an unnegotiated feature without sending host RPC", async (context) => {
+  const { startPluginRuntime } = await import("./runtime/runtimePeer.mjs");
+  const { port1, port2 } = new MessageChannel();
+  let requests = 0;
+  const host = new PluginRpcRouter({ pluginId: "com.example.no-directory", send: (message) => port1.postMessage(message),
+    handlers: { "filesystem.readDirectory": async () => { requests++; return { entries: [] }; }, "log.write": async () => null } });
+  port1.on("message", (message) => host.accept(message));
+  const peer = await startPluginRuntime({ port: port2,
+    config: { pluginId: "com.example.no-directory", pluginVersion: "1.0.0", netcattyVersion: "1.0.0", apiVersion: "0.1.0-internal", enabledFeatures: [] },
+    async loadPlugin() { return { default: { async activate(pluginContext) {
+      assert.equal(pluginContext.enabledFeatures.has("filesystem.directory-enumeration"), false);
+      await assert.rejects(pluginContext.filesystem.readDirectory("/not-probed"),
+        (error) => error.code === "unsupported" && /unavailable/.test(error.message));
+    } } }; } });
+  context.after(async () => { await peer.dispose(); host.close(); port1.close(); port2.close(); });
+  await host.request("plugin.initialize", { netcattyVersion: "1.0.0", apiVersion: "0.1.0-internal", supportedFeatures: [] });
+  await host.request("plugin.activate", {});
+  assert.equal(requests, 0);
+});
@@ -127,7 +127,7 @@ function registerSecurePluginCapabilities(registry, options) {
    options.filesystemBroker.readDirectory(params, context)
  ), {
    metadata: { capability: "filesystem", mutating: false, permission: "filesystem.read" },
-    validateParams: (params) => options.filesystemBroker.validatePath(params),
+    validateParams: (params) => options.filesystemBroker.validateDirectory(params),
    authorization: (params) => options.filesystemBroker.describeReadAuthorization(params, "directory"),
  });
  registry.registerRequest("filesystem.writeFile", (params, context) => (
@@ -6,6 +6,11 @@ const { isIP } = require("node:net");
 const OFFICIAL_ORIGIN = "https://plugins.netcatty.app";
 const OFFICIAL_SOURCE = Object.freeze({ id: "official", kind: "official", name: "Netcatty marketplace", origin: OFFICIAL_ORIGIN });
 const LOCAL_SOURCE = Object.freeze({ id: "local", kind: "local", name: "Local import", origin: null });
+// Curated first-party maintenance authority, independent of manifest publisher text.
+const FIRST_PARTY_PLUGINS = Object.freeze([
+  Object.freeze({ id: "com.netcatty.starter", repository: "binaricat/Netcatty" }),
+  Object.freeze({ id: "com.netcatty.hello", repository: "binaricat/Netcatty" }),
+]);
 const hash = (value) => createHash("sha256").update(value).digest("hex");

 // Source identity is host-owned. Neither a manifest nor a catalog supplies kind/id.
@@ -41,4 +46,11 @@ function privateOwner(source, pluginId) {
  return `source:${hash(assertSource(source).id)}:${pluginId}`;
 }

-module.exports = { OFFICIAL_SOURCE, LOCAL_SOURCE, canonicalSourceOrigin, thirdPartySource, assertSource, privateOwner };
+function isOfficialMaintained(entry, source) {
+  const trusted = assertSource(source);
+  return trusted.id === OFFICIAL_SOURCE.id && trusted.kind === OFFICIAL_SOURCE.kind
+    && trusted.origin === OFFICIAL_SOURCE.origin
+    && FIRST_PARTY_PLUGINS.some((pair) => pair.id === entry.id && pair.repository === entry.repository);
+}
+
+module.exports = { OFFICIAL_SOURCE, LOCAL_SOURCE, canonicalSourceOrigin, thirdPartySource, assertSource, privateOwner, isOfficialMaintained };
@@ -106,6 +106,12 @@ function createPreloadApi(ctx) {
  updatePluginSource: (source) => ipcRenderer.invoke("netcatty:plugins:update-source", source),
  removePluginSource: (id, disablePlugins) => ipcRenderer.invoke("netcatty:plugins:remove-source", { id, disablePlugins }),
  listPluginCatalog: (sourceId) => ipcRenderer.invoke("netcatty:plugins:catalog", { sourceId }),
+  getPluginAuthorPresentation: (request) => ipcRenderer.invoke("netcatty:plugins:author", request),
+  onPluginCatalogChanged: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on("netcatty:plugins:catalog-changed", listener);
+    return () => ipcRenderer.removeListener("netcatty:plugins:catalog-changed", listener);
+  },
  getPluginCatalogReadme: (id, selectionToken, sourceId) => ipcRenderer.invoke("netcatty:plugins:catalog-readme", { id, selectionToken, sourceId }),
  installCatalogPlugin: (id, selectionToken, sourceId, acceptedSourceId) => ipcRenderer.invoke("netcatty:plugins:catalog-install", { id, selectionToken, sourceId, acceptedSourceId }),
  setPluginAIHostReady: (ready) => ipcRenderer.invoke("netcatty:plugins:ai-host-ready", ready),
@@ -1156,6 +1162,9 @@ function createPreloadApi(ctx) {
  setWindowOpacity: async (opacity) => {
    return ipcRenderer.invoke("netcatty:setWindowOpacity", opacity);
  },
+  setWindowBackgroundBlur: async (enabled) => {
+    return ipcRenderer.invoke("netcatty:setWindowBackgroundBlur", enabled);
+  },
  setAppIconVariant: async (variant) => {
    return ipcRenderer.invoke("netcatty:setAppIconVariant", variant);
  },
@@ -6,6 +6,11 @@ explicitly choose connected terminal targets, open a new or owned conversation,
 then Send. Stop cancels the exact turn. Refresh and reselection are explicit;
 expired authority never silently re-shares targets or retries inference.

+The command runtime remembers this sample's current opaque chat handle across
+modal closes. A later explicit Open releases that exact lease before opening
+the selected conversation. View pagehide cleanup is best effort; core source,
+expiry and duplicate-open checks still apply. No handle is stored persistently.
+
 Core stores source-isolated conversation history. The plugin receives text,
 usage and safe activity summaries, never native session IDs, credentials, raw
 tool arguments/results or executable/MCP configuration. Tool actions use the
@@ -0,0 +1,46 @@
+"use strict";
+/* global setImmediate */
+const test = require("node:test");
+const assert = require("node:assert/strict");
+
+async function fixture() {
+  const commands = new Map(); const active = new Set(); const calls = []; let sequence = 0; let failure; let start = async () => {};
+  const plugin = (await import("./src/index.js")).default;
+  plugin.activate({ subscriptions: { add() {} }, commands: { registerCommand: (id, handler) => {
+    commands.set(id.split(".").at(-1), handler); return { dispose() {} };
+  } }, agent: {
+    openChat: async () => { await start(); const chatHandle = `owned-${++sequence}`; calls.push(["open", chatHandle]); active.add(chatHandle); return { chatHandle }; },
+    closeChat: async ({ chatHandle }) => {
+      calls.push(["close", chatHandle]);
+      if (failure) throw Object.assign(Error("Synthetic host error"), { code: failure });
+      if (!active.delete(chatHandle)) throw Object.assign(Error("Unavailable owned handle"), { code: "permission_denied" });
+      return { ok: true };
+    },
+  } });
+  return { call: (name, params) => commands.get(name)(params), active, calls,
+    failClose: (code) => { failure = code; }, delayOpen: (fn) => { start = fn; } };
+}
+
+test("sample serializes modal replacement and a stale Close cannot forget the replacement lease", async () => {
+  const f = await fixture(); let resume; f.delayOpen(() => new Promise((resolve) => { resume = resolve; }));
+  const first = f.call("open");
+  for (let i = 0; i < 3; i++) await new Promise(setImmediate);
+  const second = f.call("open"); f.delayOpen(async () => {}); resume();
+  const a = await first; const b = await second;
+  assert.deepEqual(f.calls, [["open", a.chatHandle], ["close", a.chatHandle], ["open", b.chatHandle]]);
+  await assert.rejects(f.call("close", { chatHandle: a.chatHandle }), { code: "permission_denied" });
+  const c = await f.call("open");
+  assert.deepEqual([...f.active], [c.chatHandle]);
+  assert.deepEqual(f.calls.slice(-2), [["close", b.chatHandle], ["open", c.chatHandle]]);
+});
+
+test("sample recovers revoked owned leases but preserves unknown cleanup failures and activation isolation", async () => {
+  const f = await fixture(); const a = await f.call("open"); f.active.clear();
+  const b = await f.call("open"); assert.notEqual(b.chatHandle, a.chatHandle);
+  f.failClose("unavailable"); const before = f.calls.length;
+  await assert.rejects(f.call("open"), { code: "unavailable" });
+  assert.deepEqual(f.calls.slice(before), [["close", b.chatHandle]], "no replacement Open after an uncertain cleanup failure");
+  const other = await fixture(); await other.call("open"); assert.deepEqual(other.calls, [["open", "owned-1"]]);
+  assert.deepEqual([...f.active], [b.chatHandle], "another activation cannot share the remembered lease");
+  f.failClose(undefined); const c = await f.call("open"); assert.deepEqual([...f.active], [c.chatHandle]);
+});
@@ -2,28 +2,30 @@
 :root[data-theme="dark"] { --background:221 39% 11%; --foreground:210 20% 98%; --muted:219 27% 21%; --muted-foreground:220 13% 91%; --border:218 11% 65%; --primary:213 97% 87%; --primary-foreground:221 39% 11%; }
@media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --background:221 39% 11%; --foreground:210 20% 98%; --muted:219 27% 21%; --muted-foreground:220 13% 91%; --border:218 11% 65%; --primary:213 97% 87%; --primary-foreground:221 39% 11%; } }
 * { box-sizing:border-box; }
+html, body { height:100%; overflow:hidden; }
 body { margin:0; }
-main { max-width:760px; padding:36px; margin:auto; }
-header { margin-bottom:26px; }
-.badge { color:hsl(var(--primary)); font-size:11px; font-weight:700; letter-spacing:1.6px; }
-h1 { font-size:27px; font-weight:650; letter-spacing:-.6px; margin:8px 0; }
+main { max-width:760px; height:100%; min-height:0; padding:12px; margin:auto; display:flex; flex-direction:column; gap:8px; }
 p { color:hsl(var(--muted-foreground)); margin:4px 0; }
-.card { border:1px solid hsl(var(--border)); border-radius:10px; padding:16px 18px; margin:14px 0; background:hsl(var(--muted)); }
-label { display:block; font-size:12px; font-weight:600; color:hsl(var(--muted-foreground)); margin-bottom:8px; }
-#model { font-weight:600; }
-select, textarea { width:100%; background:hsl(var(--background)); color:inherit; border:1px solid hsl(var(--border)); padding:10px 12px; border-radius:7px; font:inherit; }
+.card { border:1px solid hsl(var(--border)); border-radius:10px; padding:10px; margin:0; background:hsl(var(--muted)); }
+.setup { flex:0 1 auto; min-height:0; overflow-y:auto; display:grid; grid-template-columns:minmax(0,1fr) minmax(0,1fr); gap:6px 12px; }
+.setup > div { min-width:0; }
+.setup .actions, #selection { grid-column:1 / -1; margin:0; }
+label { display:block; font-size:12px; font-weight:600; color:hsl(var(--muted-foreground)); margin-bottom:3px; }
+select, textarea { width:100%; background:hsl(var(--background)); color:inherit; border:1px solid hsl(var(--border)); padding:6px 10px; border-radius:7px; font:14px/1.5 system-ui,sans-serif; }
 select:focus,textarea:focus,button:focus-visible { outline:2px solid hsl(var(--primary)); outline-offset:2px; }
-textarea { resize:vertical; min-height:84px; }
-form { margin:22px 0; }
-.actions { display:flex; flex-wrap:wrap; align-items:center; gap:10px; margin-top:12px; }
-button { border:1px solid hsl(var(--border)); border-radius:7px; background:transparent; color:inherit; padding:9px 24px; font:inherit; font-weight:600; cursor:pointer; }
+textarea { display:block; resize:vertical; height:64px; min-height:64px; max-height:16vh; }
+form { flex:none; margin:0; }
+.actions { display:flex; flex-wrap:wrap; align-items:center; gap:8px; margin-top:8px; }
+button { border:1px solid hsl(var(--border)); border-radius:7px; background:transparent; color:inherit; padding:6px 12px; font:14px/1.5 system-ui,sans-serif; font-weight:600; cursor:pointer; }
 #send { border-color:transparent; background:hsl(var(--primary)); color:hsl(var(--primary-foreground)); }
 button:disabled { opacity:.42; cursor:default; }
-#choose-reference { margin-top:10px; }
 #status { margin-left:4px; color:hsl(var(--muted-foreground)); font-size:12px; }
-.response { min-height:160px; }
-pre { white-space:pre-wrap; overflow-wrap:anywhere; font:16px/1.7 system-ui,sans-serif; margin:0 0 12px; }
-.hint,footer { font-size:12px; color:hsl(var(--muted-foreground)); margin-top:8px; }
-footer { padding-top:8px; }
-@media(max-width:520px) { main { padding:22px; } h1 { font-size:23px; } }
+.response { flex:1 0 190px; min-height:190px; display:grid; grid-template-columns:auto minmax(0,1fr); grid-template-rows:minmax(0,1fr) auto; column-gap:12px; overflow:hidden; }
+pre { grid-column:1 / -1; min-height:0; overflow-y:auto; overscroll-behavior:contain; white-space:pre-wrap; overflow-wrap:anywhere; font:14px/1.6 system-ui,sans-serif; margin:0; }
+.hint,footer { font-size:12px; color:hsl(var(--muted-foreground)); }
+.response .hint { min-width:0; margin:6px 0 0; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+.hint:empty { display:none; }
+main > #qa { flex:none; margin:0; }
+footer { flex:none; margin:0; }
+@media(max-width:520px) { .setup { grid-template-columns:minmax(0,1fr); } }
@media (forced-colors: active) { button, select, textarea { border:1px solid ButtonText; } }
@@ -1,8 +1,8 @@
 <!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Global Agent Chat</title><link rel="stylesheet" href="panel.css"></head>
-<body><main><header><span class="badge">AGENT PLATFORM EXAMPLE</span><h1>Global Agent Chat</h1><p>A conversation independent of the active terminal or workspace.</p><p id="qa" class="hint"></p></header>
-<section class="card"><label for="backend">Configured Agent backend</label><select id="backend" disabled></select><button id="refresh" type="button">Refresh backends</button>
-<label for="conversation">Owned conversation</label><select id="conversation"><option value="">New conversation</option></select>
-<div class="actions"><button id="targets" type="button">Choose terminals</button><button id="open" type="button" disabled>Open conversation</button></div><p id="selection" class="hint">No targets selected yet.</p></section>
+<body><main><p id="qa" class="hint"></p>
+<section class="card setup"><div><label for="backend">Configured Agent backend</label><select id="backend" disabled></select></div>
+<div><label for="conversation">Owned conversation</label><select id="conversation"><option value="">New conversation</option></select></div>
+<div class="actions"><button id="refresh" type="button">Refresh backends</button><button id="targets" type="button">Choose terminals</button><button id="open" type="button" disabled>Open conversation</button></div><p id="selection" class="hint">No targets selected yet.</p></section>
 <section class="card response"><pre id="transcript" aria-live="polite"></pre><p id="usage" class="hint"></p><p id="activity" class="hint"></p></section>
 <form id="compose"><label for="prompt">Message</label><textarea id="prompt" maxlength="16384" placeholder="Ask about the selected terminals"></textarea><div class="actions"><button id="send" type="submit" disabled>Send</button><button id="stop" type="button" disabled>Stop</button><span id="status" role="status">Loading configured backends…</span></div></form>
-<footer>Core owns Agent execution and conversation history. Actions follow this plugin's Allow / Ask / Deny setting. Only Catty and Claude Code MCP mode are eligible in this version; other native modes are unavailable here.</footer></main><script src="panel.js"></script></body></html>
+<footer>Actions follow this plugin's Allow / Ask / Deny setting.</footer></main><script src="panel.js"></script></body></html>
@@ -52,6 +52,7 @@ element('open').addEventListener('click', async () => {
    chat = result; const history = await invoke('history', { chatHandle: chat.chatHandle });
    if (closed || run !== generation) return;
    element('transcript').textContent = history.items.map((item) => `${item.role}: ${item.text}`).join('\n\n');
+    element('usage').textContent = ''; element('activity').textContent = '';
    status(`Ready · ${result.backendLabel}`);
  } catch { await closeChat(); if (!closed && run === generation) status('Conversation unavailable. Refresh backends or choose terminals again; your draft is kept.'); }
  finally { if (!closed && run === generation) controls(false); }
@@ -3,9 +3,9 @@
 const test = require("node:test"); const assert = require("node:assert/strict");
 const fs = require("node:fs"); const path = require("node:path"); const { JSDOM } = require("jsdom");

-test("global Chat sample follows host theme and preserves drafts on explicit target expiry without re-sharing or retrying", async (t) => {
+test("global Chat sample follows host theme, preserves expiry drafts and clears status on conversation changes", async (t) => {
  const dom = new JSDOM(fs.readFileSync(path.join(__dirname, "panel.html"), "utf8"), { runScripts: "outside-only" });
-  let now = 1; let environment; let selections = 0; let sends = 0; let disposed = 0;
+  let now = 1; let environment; let selections = 0; let sends = 0; let disposed = 0; let history = [];
  const calls = [];
  dom.window.Date.now = () => now;
  Object.defineProperty(dom.window, "netcattyView", { value: {
@@ -13,7 +13,8 @@ test("global Chat sample follows host theme and preserves drafts on explicit tar
    executeCommand: async (name) => {
      const op = name.split(".").at(-1); calls.push(op);
      if (op === "backends") return { items: [{ backendRef: "host-ref", label: "Synthetic configured Catty", status: "supported", reason: "ready" }] };
-      if (op === "chats" || op === "history") return { items: [] };
+      if (op === "chats") return { items: [] };
+      if (op === "history") return { items: history };
      if (op === "targets") { selections++; return { selectionHandle: "selection", expiresAt: now + 300_000, items: [{ title: "Synthetic terminal" }] }; }
      if (op === "open") return { chatHandle: "chat", backendLabel: "Synthetic Catty", expiresAt: now + 300_000 };
      if (op === "send") { sends++; throw Error("Synthetic denied send"); }
@@ -38,4 +39,15 @@ test("global Chat sample follows host theme and preserves drafts on explicit tar
  send(); await settle(); assert.equal(sends, 1); assert.equal(selections, 2); assert.match(element("status").textContent, /Request ended/);
  await settle(); assert.equal(sends, 1, "a failed inference is never automatically retried");
  assert.equal(element("prompt").value, "Keep this synthetic draft"); assert.ok(calls.includes("history")); assert.equal(disposed, 0);
+  element("usage").textContent = "Previous conversation usage"; element("activity").textContent = "Previous conversation activity";
+  element("open").click(); await settle();
+  assert.equal(element("transcript").textContent, ""); assert.equal(element("usage").textContent, ""); assert.equal(element("activity").textContent, "");
+  history = [{ role: "assistant", text: "Owned synthetic history" }];
+  const owned = dom.window.document.createElement("option"); owned.value = "owned-conversation"; element("conversation").append(owned);
+  element("usage").textContent = "Another conversation usage"; element("activity").textContent = "Another conversation activity";
+  element("conversation").value = owned.value; element("conversation").dispatchEvent(new dom.window.Event("change")); await settle();
+  element("open").click(); await settle();
+  assert.match(element("transcript").textContent, /Owned synthetic history/);
+  assert.equal(element("usage").textContent, ""); assert.equal(element("activity").textContent, "");
+  assert.equal(element("prompt").value, "Keep this synthetic draft"); assert.equal(sends, 1);
 });
@@ -1,9 +1,38 @@
 export default {
  activate(context) {
+    // The command runtime outlives its modal. Pagehide cleanup can lose view
+    // sender authority, so keep the exact owned lease here until explicit Open
+    // or Close replaces it. Core still validates source, expiry and duplicates.
+    let chatHandle;
+    let changes = Promise.resolve();
+    const changeChat = (operation) => {
+      const result = changes.then(operation); changes = result.catch(() => {}); return result;
+    };
+    const forget = (handle) => { if (chatHandle === handle) chatHandle = undefined; };
    const operations = { backends: 'listBackends', targets: 'selectTargets', chats: 'listChats', open: 'openChat',
      send: 'send', read: 'read', history: 'history', stop: 'stop', close: 'closeChat' };
    for (const [name, operation] of Object.entries(operations)) context.subscriptions.add(context.commands.registerCommand(
-      `com.netcatty.globalagent.${name}`, (params = {}) => context.agent[operation](params),
+      `com.netcatty.globalagent.${name}`, (params = {}) => {
+        if (name === 'open') return changeChat(async () => {
+          if (chatHandle) {
+            const previous = chatHandle;
+            try { await context.agent.closeChat({ chatHandle: previous }); }
+            catch (error) {
+              // Missing/expired/revoked handles carry no current authority.
+              // Fresh Open must independently authenticate and select again.
+              // Preserve unknown failures for an explicit retry of this lease.
+              if (error?.code !== 'permission_denied') throw error;
+            }
+            forget(previous);
+          }
+          const result = await context.agent.openChat(params); chatHandle = result.chatHandle; return result;
+        });
+        if (name === 'close') return changeChat(async () => {
+          try { const result = await context.agent.closeChat(params); forget(params.chatHandle); return result; }
+          catch (error) { if (error?.code === 'permission_denied') forget(params.chatHandle); throw error; }
+        });
+        return context.agent[operation](params);
+      },
    ));
  },
 };
@@ -11,9 +11,11 @@ Group results contain the chosen current members and never include future member
 label change for the first chosen host. Netcatty displays editable fields and the
 normalized field diff before either action saves.

-`connect` asks Netcatty to confirm a saved-host connection. The confirmation shows
-whether saved scripts can run. The acknowledgement contains no session identifier
-or terminal data. Selecting metadata never authorizes a connection by itself.
+`connect` requests a saved-host connection under the plugin's permission settings.
+Ask displays the target and whether saved scripts can run; Allow can dispatch
+without that permission-only dialog, and Deny blocks the request. Normal SSH
+authentication still applies. The acknowledgement contains no session identifier
+or terminal data. Selecting metadata does not change those permission settings.

 All sample test resources use synthetic hostnames. Native acceptance must use
 synthetic hosts and must not establish a real host connection.
Author	SHA1	Message	Date
陈奇	6390581d84	fix(agent): publish correlated names for unnamed tool results	2026-10-27 16:40:23 +00:00
陈奇	2671cf9f20	test(plugin-ai): deliver pagehide before closing fixture	2026-10-27 15:05:30 +00:00
陈奇	672a2bf406	merge: integrate verified plugin foundation into global Agent	2026-10-27 14:56:42 +00:00
陈奇	9f09af3bda	Merge selected-context workspace focus correction	2026-10-27 14:29:42 +00:00
陈奇	5931eb14f0	fix(plugins): revalidate selected session context after workspace focus changes	2026-10-27 14:26:01 +00:00
陈奇	f5e2a64dfb	fix(plugins): retain exact sample chat lease across modal reopen	2026-10-27 13:39:03 +00:00
陈奇	ca2280ea8b	docs(plugins): record cancelled row redesign and preserved foundation fixes	2026-10-27 13:12:10 +00:00
陈奇	7e7b05620f	Revert "feat(plugins): share borderless installed settings rows" This reverts commit `e4eb33856b`.	2026-10-27 13:04:03 +00:00
陈奇	25e0c834da	fix(plugins): preserve global chat transcript in compact modal	2026-10-27 12:51:07 +00:00
陈奇	1f0741698d	docs(plugins): consolidate foundation landing ledger and sample provenance	2026-10-27 12:39:52 +00:00
陈奇	50fda91424	fix(plugins): invalidate author identity after rejected install refresh Reuse the selection-token snapshot comparison for list and install, including a rejected stale or withdrawn selection. Preserve synchronous unavailable-source validation before the asynchronous list operation. The loaded-row regression rejects installation without downloading or executing a package.	2026-10-27 12:32:48 +00:00
陈奇	fc37ac48e1	Merge actual two-profile sync composition coverage into plugin foundation landing	2026-10-27 12:29:25 +00:00
陈奇	d035cbea38	Merge honest directory enumeration availability into plugin foundation landing	2026-10-27 12:29:25 +00:00
陈奇	b3895a477d	Merge author identity refresh and borderless plugin rows into plugin foundation landing	2026-10-27 12:29:25 +00:00
陈奇	db1223d161	Merge verified main #4010 #4013 #4016 into plugin foundation landing # Conflicts: # index.css	2026-10-27 12:29:25 +00:00
陈奇	14ed19d2ed	test(plugins): compose two-profile settings sidecar collect and hydration	2026-10-27 12:23:21 +00:00
陈奇	a36a906292	fix(plugins): negotiate directory enumeration only with a secure adapter	2026-10-27 12:23:20 +00:00
陈奇	e4eb33856b	feat(plugins): share borderless installed settings rows Apply the exact six-file patch from implement_plugin_row_layout, based on `0c05a96fa1`. Patch SHA-256: 5c58150fc3a7f72169b1a23ad1410cf37c51051b29bd6600bf30e848a9f366d6. Native visual acceptance remains pending.	2026-10-27 12:19:09 +00:00
陈奇	b14b65679f	fix(plugins): invalidate mounted author identity on catalog changes	2026-10-27 12:18:27 +00:00
陈奇	f8616f5d3a	fix(plugin-agent): clear stale status when conversation history changes	2026-10-27 12:11:17 +00:00
陈奇	0cab1046cf	docs(plugin-agent): record composer correction package hash	2026-10-27 12:06:06 +00:00
陈奇	a56d1ab785	fix(plugins): skip destroyed WebContents during scope broadcasts	2026-10-27 12:04:34 +00:00
陈奇	cbe89995e6	fix(plugins): identify host operation and targets in Ask dialog	2026-10-27 12:02:41 +00:00
陈奇	72383a50c9	fix(plugin-agent): keep composer visible while transcript scrolls	2026-10-27 11:57:35 +00:00
陈奇	0c05a96fa1	fix(plugins): align avatar delivery with registry v2 contract	2026-10-27 11:48:35 +00:00
陈奇	05a773b426	docs(plugins): clarify default directory enumeration boundary	2026-10-27 11:25:54 +00:00
陈奇	da16b90e9e	feat(plugins): add author avatars and host-controlled maintainer badges	2026-10-27 11:25:54 +00:00
陈大猫 Cursor Agent 陈大猫	2796d1113a	fix(mcp): reconnect external calls that race a closed socket (#4016 ) A peer FIN can leave readyState closed while destroyed is still false. Concurrent tool calls wrote into that socket, hit writeAfterFIN, and failed with "TCP connection lost" instead of sharing one reconnect. Treat that socket as down, and make later callers join the in-flight re-auth. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>	2026-10-27 19:01:45 +08:00
陈奇	8bcad28f9d	fix(plugin-agent): skip home config repair for delegated Claude turns	2026-10-27 10:18:51 +00:00
陈奇	59edc87ed4	fix(plugin-agent): wait for stopped driver before replacement turn	2026-10-27 09:30:21 +00:00
陈奇	5944a02238	fix(plugin-agent): bind startup and approved actions to current authority	2026-10-27 09:28:49 +00:00
陈大猫	c743456a0b	Merge pull request #4013 from binaricat/feat/macos-frosted-glass-continued feat(appearance): macOS frosted glass background (continues #4009)	2026-10-27 17:14:30 +08:00
陈奇	b17713ef95	merge: include foundation dialog handoff test gate	2026-10-27 09:10:09 +00:00
陈奇	5db0f90751	test(plugins): await Radix close handoff after the React commit	2026-10-27 08:47:23 +00:00
bincxzandCursor	336ab5ab17	fix(appearance): repaint native background on explicit theme pushes Keeping the restore guard for registration-time chrome setup is right, but it also swallowed explicit setTheme/setBackgroundColor pushes: windows that had never enabled blur stopped repainting their native backing, leaving the color stale after theme changes on every platform. Separate the two call kinds with an explicit forceBackgroundColor flag so registration still preserves the window's creation-time color while theme and background-color pushes always land. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-27 16:46:32 +08:00
bincxzandCursor	ce9fcdfec6	fix(appearance): sync macOS blur across windows and gate search by platform Addresses review feedback on the frosted glass background setting. - Detached #/session-window renderers run with settings sync disabled, so `applySharedWindowSetting` now forwards the blur key. Previously the main process put native vibrancy on those windows while their renderer class stayed stale, leaving them opaque with blur on and double-applying opacity with blur off. - Only settings-owning windows persist the blur preference and drive `setWindowBackgroundBlur`, matching the other OS-effect guards. Detached windows still apply the transparent backing class locally. - Search entries can declare `platforms`; the macOS-only blur setting is filtered out on Windows/Linux so a hit never jumps to a tab whose anchor is not rendered (including the default empty-query list). - Restoring chrome only rewrites the background of windows this module made transparent, falling back to the active theme color when no theme color has been pushed yet. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-27 16:21:07 +08:00
Joseph Hau	de06a6aa4d	feat(appearance): 支持 macOS 毛玻璃窗口背景	2026-10-27 16:21:07 +08:00
陈大猫	dcf642cf39	Merge pull request #4010 from binaricat/feat/nginx-highlighting-4005 feat(editor): add Nginx syntax highlighting	2026-10-27 15:22:51 +08:00
陈奇	d40b0d3c25	docs(plugins): prepare Settings visibility and current-main acceptance handoff	2026-10-27 07:08:50 +00:00
陈奇	714e2397a4	Merge reviewed Settings native-view visibility correction	2026-10-27 06:59:39 +00:00
陈奇	c4aedfa9ed	Merge current main owner handoff and prompt fixes into isolated plugin acceptance	2026-10-27 06:59:39 +00:00
陈奇	1551fa8355	fix(plugins): suspend native views only for active log dialogs	2026-10-27 06:55:01 +00:00
陈大猫	1caf4a6479	feat(editor): add Nginx syntax highlighting	2026-10-27 14:40:29 +08:00
陈大猫 Cursor Agent 陈大猫	a0cf2b487c	fix(mcp): recognize Oh My Zsh ys two-line idle prompts (#4008 ) The two-line idle prompt check only accepted a classic user@host host line, so Oh My Zsh ys (`# user @ host ...` then a bare $/#) never became ready and terminal_execute sent nothing. Match that host line narrowly and still reject a lone marker. Fixes #4007 Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>	2026-10-27 14:31:21 +08:00
陈大猫	e3e2dcfe02	fix(ai): keep dissolved workspace chat on its surviving owner (#4003 ) Fixes #3998 Keep terminal-scoped AI chat on its surviving owner pane when dissolving a workspace; remint onto preferred only when the owner is gone.	2026-10-27 13:58:44 +08:00