ci: retrigger lint-and-test after runner shutdown cancel

Keep es at full en parity for the new Settings temp-directory keys,
update zh-TW/ru hints, and sync the manual path field when loading
temp-dir info.

App.tsx

@@ -12,6 +12,7 @@ import { ToastProvider } from './components/ui/toast';
 import { TooltipProvider } from './components/ui/tooltip';
 import { ScriptAutomationRoot } from './components/scripts/ScriptAutomationRoot';
 import { ExternalMcpApprovalsHost } from './components/ai/ExternalMcpApprovalsHost';
+import { PluginPermissionHost } from './components/plugins/PluginPermissionHost';
 import { PluginHostInteractionHost } from './components/plugins/PluginHostInteractionHost';
 import { PluginHostActionHost } from './components/plugins/PluginHostActionHost';
 import { PluginAuthenticationHost } from './components/plugins/PluginAuthenticationHost';
@@ -88,6 +89,7 @@ function AppWithProviders({ settings, appLock }: { settings: SettingsState; appL
               <ScriptAutomationRoot />
               <ExternalMcpApprovalsHost />
               <PluginAuthenticationHost />
+              <PluginPermissionHost />
               <PluginHostInteractionHost />
               <MultilinePasteConfirmHost />
               <VaultPublisher>

application/app/AppView.tsx

@@ -27,6 +27,7 @@ import { AppHostTreeLayer } from './AppHostTreeLayer';
 import { AppHostEditorLayer } from './AppHostEditorLayer';
 import { AppPluginKeybindingHost } from './AppPluginKeybindingHost';
 import { PluginAIContextHost } from '../../components/plugins/PluginAIContextHost';
+import { PluginAgentHost } from '../../components/plugins/PluginAgentHost';
 import { shouldOpenHostEditOnWorkSurface } from './workTabSurface';
 import { useConnectionLogsStore } from '../state/connectionLogsStore';
 import {
@@ -858,6 +859,7 @@ function AppViewInner({ domains }: AppViewProps) {
           workspaces={workspaces}
         />
         <PluginAIContextHost sessions={sessions} workspaces={workspaces} />
+        <PluginAgentHost sessions={sessions} />
       </div>
 
       {/* Global "quick add / edit snippet" modal, triggered by the

application/i18n/locales/en/ai.ts

@@ -525,6 +525,8 @@ export const enAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Always',
   'ai.chat.slashStopDesc': 'Stop the current AI turn and cancel in-flight tools',
   'ai.chat.slashCompactDesc': 'Summarize earlier conversation context',
+  'ai.chat.slashRenameDesc': 'Rename the current chat (/rename <title>)',
+  'ai.chat.slashChatsDesc': 'List the chats visible to this panel',
   'ai.chat.reject': 'Reject',
   'ai.chat.toolLabel': 'Tool',
   'ai.chat.targetLabel': 'Target',
@@ -587,6 +589,28 @@ export const enAiMessages: Messages = {
   'ai.chat.recent': 'Recent',
   'ai.chat.viewAll': 'View All',
   'ai.chat.untitled': 'Untitled',
+  'ai.chat.renameChat': 'Rename chat',
+  'ai.chat.renameUsage': 'Usage: /rename <new title>',
+  'ai.chat.renameNoActive': 'No active chat to rename.',
+  'ai.chat.renameDone': 'Chat renamed to "{title}".',
+  'ai.chat.exportSessions': 'Export AI chats',
+  'ai.chat.importSessions': 'Import AI chats',
+  'ai.chat.exportDone': 'AI chats exported to {path}.',
+  'ai.chat.exportDoneNoPath': 'AI chats exported.',
+  'ai.chat.exportUnavailable': 'AI chat export is unavailable in this environment.',
+  'ai.chat.importDone': 'Imported {n} AI chat(s).',
+  'ai.chat.importNone': 'No AI chats found in the selected file.',
+  'ai.chat.chatsHeader': 'Chats visible in this panel:',
+  'ai.chat.chatsEmpty': 'No chats visible in this panel.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Terminal',
+  'ai.chat.chatsScopeGlobal': 'Global',
+  'ai.chat.chatsScopeDangling': 'Dissociated',
+  'ai.chat.slashRebindDesc': 'Rebind a disconnected chat to this panel (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Disconnected chats can be restored with /rebind <n>.',
+  'ai.chat.rebindUsage': 'Usage: /rebind <number from /chats>',
+  'ai.chat.rebindDone': 'Chat "{title}" rebound to this panel.',
+  'ai.chat.rebindUnavailable': 'No rebind target in this panel scope.',
   'ai.chat.justNow': 'Just now',
   'ai.chat.minutesAgo': '{n}m ago',
   'ai.chat.hoursAgo': '{n}h ago',
@@ -795,4 +819,27 @@ export const enAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Skip',
   'zmodem.overwrite.cancel': 'Cancel',
   'settings.shortcuts.resetToDefault': 'Reset to default',
+  "ai.toolSettings.immediate": "Changes take effect immediately. Closing this window does not undo them.",
+  "ai.toolSettings.privacyOn": "Text redaction enabled",
+  "ai.toolSettings.privacyOff": "Text redaction disabled",
+  "ai.toolSettings.ruleSummary": "{cidrs} additional IP ranges · {patterns} custom patterns",
+  "ai.toolSettings.configurePrivacy": "Configure privacy",
+  "ai.toolSettings.unsaved": "Unsaved changes",
+  "ai.toolSettings.viewSkills": "View CLI guidance",
+  "ai.toolSettings.viewPrompt": "View setup prompt",
+  "ai.toolSettings.behavior": "MCP behavior",
+  "ai.toolSettings.configureBehavior": "Configure behavior",
+  "ai.toolSettings.configureClients": "Configure clients",
+  "ai.toolSettings.httpOn": "HTTP enabled",
+  "ai.toolSettings.httpOff": "HTTP disabled",
+  "ai.toolSettings.loopback": "Local connections only (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Configure HTTP",
+  "ai.toolSettings.hideSecret": "Hide secret",
+  "ai.toolSettings.showSecret": "Show secret",
+  "ai.toolSettings.manualSetup": "Manual setup",
+  "ai.toolSettings.format": "Format",
+  "ai.toolSettings.connectionDetails": "Connection details",
+  "ai.toolSettings.conflict": "Settings changed in another window. Your draft is preserved. Cancel and reopen to load the saved settings.",
+  "ai.toolSettings.retry": "Retry",
+  "ai.toolSettings.applyingHttp": "Applying HTTP configuration...",
 };

application/i18n/locales/en/core.ts

@@ -161,7 +161,12 @@ export const enCoreMessages: Messages = {
   'settings.system.clearTempFiles': 'Clear temp files',
   'settings.system.clearing': 'Clearing...',
   'settings.system.clearResult': 'Deleted {deleted} file(s), {failed} failed.',
-  'settings.system.tempDirectoryHint': 'Temporary files are created when opening remote files with external applications. They are automatically cleaned up when SFTP sessions close.',
+  'settings.system.tempDirChoose': 'Choose folder',
+  'settings.system.tempDirManual': 'Enter an absolute folder path',
+  'settings.system.tempDirApply': 'Apply',
+  'settings.system.tempDirReset': 'Reset to default',
+  'settings.system.tempDirError': 'Unable to use this folder.',
+  'settings.system.tempDirectoryHint': 'Netcatty creates a Netcatty temp subfolder in the chosen folder for SFTP staging and external editing. Changing the folder during a transfer may affect that transfer.',
   'settings.system.credentials.title': 'Credential Protection',
   'settings.system.credentials.status': 'Status',
   'settings.system.credentials.checking': 'Checking...',
@@ -582,6 +587,8 @@ Highlight the focused split pane:
   'settings.appearance.uiFont.desc': 'Choose the font for the application interface',
   'settings.appearance.windowOpacity': 'Window Opacity',
   'settings.appearance.windowOpacity.desc': 'Adjust the transparency of the entire application window. Lower values also fade terminal text. Some Linux desktop environments may not support this.',
+  'settings.appearance.windowBackgroundBlur': 'Frosted glass background',
+  'settings.appearance.windowBackgroundBlur.desc': 'Blur the desktop behind the window. At 100% opacity the effect is hidden, but your choice is preserved.',
   'settings.appearance.appIcon': 'App Icon',
   'settings.appearance.appIcon.desc': 'Choose a dock/taskbar icon style to make Netcatty easier to spot when switching apps. On Windows, the notification area icon uses the same style. Applies at runtime; the installed app bundle icon is unchanged.',
   'settings.appearance.appIcon.original': 'Original',
@@ -1262,6 +1269,8 @@ Highlight the focused split pane:
   'deepLink.jms.unsupported': 'Unsupported JumpServer protocol: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
   "settings.plugins.manager.installed": "Installed plugins",
+  "settings.plugins.author.official": "Official maintainer",
+  "settings.plugins.author.officialMeaning": "Maintained by the Netcatty project. This is not a safety certification.",
   "settings.plugins.manager.import": "Import .ncpkg",
   "settings.plugins.manager.preview": "Imported packages stay disabled until you review and enable them.",
   "settings.plugins.manager.empty": "Import a local plugin package to get started.",
@@ -1298,19 +1307,23 @@ Highlight the focused split pane:
   "plugins.interaction.closeDraft": "Close draft",
   "settings.plugins.permissions.current": "Matches the current activation",
   "settings.plugins.permissions.inactive": "Inactive for the current activation",
-  "settings.plugins.permissions.title": "Saved grants",
+  "settings.plugins.permissions.note": "Declared capabilities default to Allow. Ask requests a scoped decision; Deny blocks access immediately. Target selection and draft editing still use the host UI.",
+  "settings.plugins.permissions.allow": "Allow",
+  "settings.plugins.permissions.ask": "Ask",
+  "settings.plugins.permissions.deny": "Deny",
+  "settings.plugins.permissions.title": "Permissions",
   "settings.plugins.permissions.refresh": "Refresh",
-  "settings.plugins.permissions.loading": "Loading grants...",
+  "settings.plugins.permissions.loading": "Loading permissions...",
   "settings.plugins.permissions.empty": "No saved grants. One-use decisions are not retained.",
   "settings.plugins.permissions.always": "Until revoked",
   "settings.plugins.permissions.application": "Until Netcatty exits",
   "settings.plugins.permissions.session": "Until the session closes",
   "settings.plugins.permissions.audit": "Recent security events (up to 100)",
   "settings.plugins.permissions.revoke": "Disable and revoke all grants",
-  "settings.plugins.permissions.revokeNote": "This disables the plugin, cancels its work, and removes saved grants. Enable it again to request new access.",
+  "settings.plugins.permissions.revokeNote": "This disables the plugin, cancels its work, and removes saved grants. Your Allow / Ask / Deny settings are retained.",
   "settings.plugins.permissions.unavailable": "Plugin permission management is unavailable",
   "settings.plugins.manager.permissions": "Declared permissions",
-  "settings.plugins.manager.permissionNote": "From the manifest, not a grant. Enabled allows lazy activation; required permissions are requested before first activation and optional permissions when used. Sensitive operations still pass host checks.",
+  "settings.plugins.manager.permissionNote": "Declared supported capabilities default to Allow. Change each capability to Ask or Deny in the permission controls. Host validation and resource scope always apply.",
   "settings.plugins.manager.noPermissions": "No privileged permissions declared.",
   "settings.plugins.manager.required": "Required",
   "settings.plugins.manager.optional": "Optional",
@@ -1353,7 +1366,7 @@ Highlight the focused split pane:
   "settings.plugins.market.sourceOnly": "First-party source example. Build with the local CLI and import the .ncpkg; no downloadable release has been published.",
   "settings.plugins.market.readmeNote": "Pinned to the commit above. HTML is inert and remote images are not loaded. Written by the plugin author.",
   "settings.plugins.manager.noVault": "System key storage is unavailable. Secret and credential operations are blocked; browsing and non-secret plugins still work.",
-  "settings.plugins.manager.sensitive": "Sensitive access: review the data and resource scope before granting.",
+  "settings.plugins.manager.sensitive": "Sensitive access: this capability may expose private data. Its mode can be changed in permission settings.",
   "settings.plugins.manager.dual": "Browser is the default runtime. This package also includes a Node entrypoint with full device authority; developer mode only.",
   "settings.plugins.manager.advancedDeclaration": "Browser entrypoint with advanced permission declarations. Not eligible for normal browser-only mode; review every declared permission.",
   "settings.plugins.market.retry": "Retry",
@@ -1362,7 +1375,7 @@ Highlight the focused split pane:
   "settings.plugins.market.search": "Search name, author or description",
   "settings.plugins.market.noResults": "No matching plugins. Try another search.",
   "settings.plugins.market.manifest": "Compatibility and permissions",
-  "settings.plugins.manager.unbounded": "No narrower resource scope is declared. Check the actual scope in the permission prompt.",
+  "settings.plugins.manager.unbounded": "No narrower resource scope is declared. Host validation and the selected permission mode still apply.",
   "settings.plugins.openView": "Open",
   "settings.plugins.openManager": "Open plugin manager",
   "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
@@ -1415,7 +1428,7 @@ Highlight the focused split pane:
   'plugins.authentication.responseFailedWithMessage': 'Could not send the authentication response: {message}. Try again or cancel the request.',
   'plugins.authentication.continue': 'Continue',
   'plugins.hostActions.select': 'Share selected host metadata',
-  'plugins.hostActions.selectionNote': 'Share saved labels, addresses, usernames, protocols, groups and tags with this plugin. Group selection includes only the hosts selected now. Connecting requires a separate confirmation.',
+  'plugins.hostActions.selectionNote': 'Only the selected hosts\' saved labels, addresses, usernames, protocols, groups and tags are shared. Group selection includes only the hosts selected now. Later edit or connection requests follow this plugin\'s permission settings.',
   'plugins.hostActions.create': 'Review host draft',
   'plugins.hostActions.edit': 'Review host changes',
   'plugins.hostActions.connect': 'Confirm connection',

application/i18n/locales/es/ai.ts

@@ -525,6 +525,8 @@ export const esAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Siempre',
   'ai.chat.slashStopDesc': 'Detener el turno actual de IA y cancelar las herramientas en curso',
   'ai.chat.slashCompactDesc': 'Resumir el contexto anterior de la conversación',
+  'ai.chat.slashRenameDesc': 'Renombrar el chat actual (/rename <título>)',
+  'ai.chat.slashChatsDesc': 'Listar los chats visibles en este panel',
   'ai.chat.reject': 'Rechazar',
   'ai.chat.toolLabel': 'Herramienta',
   'ai.chat.targetLabel': 'Destino',
@@ -587,6 +589,28 @@ export const esAiMessages: Messages = {
   'ai.chat.recent': 'Recientes',
   'ai.chat.viewAll': 'Ver todo',
   'ai.chat.untitled': 'Sin título',
+  'ai.chat.renameChat': 'Renombrar chat',
+  'ai.chat.renameUsage': 'Uso: /rename <nuevo título>',
+  'ai.chat.renameNoActive': 'No hay ningún chat activo para renombrar.',
+  'ai.chat.renameDone': 'Chat renombrado a «{title}».',
+  'ai.chat.exportSessions': 'Exportar chats de IA',
+  'ai.chat.importSessions': 'Importar chats de IA',
+  'ai.chat.exportDone': 'Chats de IA exportados a {path}.',
+  'ai.chat.exportDoneNoPath': 'Chats de IA exportados.',
+  'ai.chat.exportUnavailable': 'La exportación de chats de IA no está disponible en este entorno.',
+  'ai.chat.importDone': 'Se importaron {n} chat(s) de IA.',
+  'ai.chat.importNone': 'No se encontraron chats de IA en el archivo seleccionado.',
+  'ai.chat.chatsHeader': 'Chats visibles en este panel:',
+  'ai.chat.chatsEmpty': 'No hay chats visibles en este panel.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Terminal',
+  'ai.chat.chatsScopeGlobal': 'Global',
+  'ai.chat.chatsScopeDangling': 'Desasociado',
+  'ai.chat.slashRebindDesc': 'Reasociar un chat desconectado a este panel (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Los chats desconectados se pueden restaurar con /rebind <n>.',
+  'ai.chat.rebindUsage': 'Uso: /rebind <número de /chats>',
+  'ai.chat.rebindDone': 'Chat «{title}» reasociado a este panel.',
+  'ai.chat.rebindUnavailable': 'No hay destino de reasociación en el ámbito de este panel.',
   'ai.chat.justNow': 'Ahora mismo',
   'ai.chat.minutesAgo': 'hace {n} min',
   'ai.chat.hoursAgo': 'hace {n} h',
@@ -795,4 +819,27 @@ export const esAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Omitir',
   'zmodem.overwrite.cancel': 'Cancelar',
   'settings.shortcuts.resetToDefault': 'Restablecer al predeterminado',
+  "ai.toolSettings.immediate": "Los cambios se aplican inmediatamente. Cerrar esta ventana no los deshace.",
+  "ai.toolSettings.privacyOn": "Ocultación de texto activada",
+  "ai.toolSettings.privacyOff": "Ocultación de texto desactivada",
+  "ai.toolSettings.ruleSummary": "{cidrs} rangos IP adicionales · {patterns} patrones personalizados",
+  "ai.toolSettings.configurePrivacy": "Configurar privacidad",
+  "ai.toolSettings.unsaved": "Cambios sin guardar",
+  "ai.toolSettings.viewSkills": "Ver instrucciones de CLI",
+  "ai.toolSettings.viewPrompt": "Ver instrucciones de conexión",
+  "ai.toolSettings.behavior": "Comportamiento de MCP",
+  "ai.toolSettings.configureBehavior": "Configurar comportamiento",
+  "ai.toolSettings.configureClients": "Configurar clientes",
+  "ai.toolSettings.httpOn": "HTTP activado",
+  "ai.toolSettings.httpOff": "HTTP desactivado",
+  "ai.toolSettings.loopback": "Solo conexiones locales (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Configurar HTTP",
+  "ai.toolSettings.hideSecret": "Ocultar secreto",
+  "ai.toolSettings.showSecret": "Mostrar secreto",
+  "ai.toolSettings.manualSetup": "Configuración manual",
+  "ai.toolSettings.format": "Formato",
+  "ai.toolSettings.connectionDetails": "Detalles de conexión",
+  "ai.toolSettings.conflict": "La configuración cambió en otra ventana. Se conserva el borrador. Cancela y vuelve a abrir para cargar la configuración guardada.",
+  "ai.toolSettings.retry": "Reintentar",
+  "ai.toolSettings.applyingHttp": "Aplicando la configuración HTTP...",
 };

application/i18n/locales/es/core.ts

@@ -161,7 +161,12 @@ export const esCoreMessages: Messages = {
   'settings.system.clearTempFiles': 'Limpiar archivos temporales',
   'settings.system.clearing': 'Limpiando...',
   'settings.system.clearResult': 'Se eliminaron {deleted} archivo(s), {failed} fallaron.',
-  'settings.system.tempDirectoryHint': 'Los archivos temporales se crean al abrir archivos remotos con aplicaciones externas. Se limpian automáticamente cuando las sesiones SFTP se cierran.',
+  'settings.system.tempDirChoose': 'Elegir carpeta',
+  'settings.system.tempDirManual': 'Introduce una ruta de carpeta absoluta',
+  'settings.system.tempDirApply': 'Aplicar',
+  'settings.system.tempDirReset': 'Restablecer predeterminado',
+  'settings.system.tempDirError': 'No se puede usar esta carpeta.',
+  'settings.system.tempDirectoryHint': 'Se usa para el almacenamiento temporal de transferencias SFTP y archivos abiertos con aplicaciones externas. Cambiar la carpeta durante una transferencia puede afectar esa transferencia.',
   'settings.system.credentials.title': 'Protección de credenciales',
   'settings.system.credentials.status': 'Estado',
   'settings.system.credentials.checking': 'Comprobando...',
@@ -582,6 +587,8 @@ Resalta el panel dividido enfocado:
   'settings.appearance.uiFont.desc': 'Elige la fuente para la interfaz de la aplicación',
   'settings.appearance.windowOpacity': 'Opacidad de la ventana',
   'settings.appearance.windowOpacity.desc': 'Ajusta la transparencia de toda la ventana de la aplicación. Los valores más bajos también atenúan el texto de la terminal. Algunos entornos de escritorio de Linux pueden no admitir esto.',
+  'settings.appearance.windowBackgroundBlur': 'Fondo de cristal esmerilado',
+  'settings.appearance.windowBackgroundBlur.desc': 'Desenfoca el escritorio detrás de la ventana. Con una opacidad del 100 %, el efecto no es visible, pero se conserva tu elección.',
   'settings.appearance.appIcon': 'Ícono de la aplicación',
   'settings.appearance.appIcon.desc': 'Elige un estilo de ícono para el dock o la barra de tareas que haga más fácil distinguir Netcatty al cambiar de aplicación. En Windows, el icono del área de notificación usa el mismo estilo. Se aplica en tiempo de ejecución; el ícono del paquete instalado no cambia.',
   'settings.appearance.appIcon.original': 'Original',
@@ -1261,6 +1268,8 @@ Resalta el panel dividido enfocado:
   'deepLink.jms.invalid': 'Enlace JumpServer inválido',
   'deepLink.jms.unsupported': 'Protocolo JumpServer no compatible: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
+  "settings.plugins.author.official": "Mantenimiento oficial",
+  "settings.plugins.author.officialMeaning": "Mantenido por el proyecto Netcatty. No es una certificación de seguridad.",
   "settings.plugins.manager.installed": "Plugins instalados",
   "settings.plugins.manager.import": "Importar .ncpkg",
   "settings.plugins.manager.preview": "Los paquetes importados permanecen desactivados hasta que los revises y actives.",
@@ -1298,7 +1307,11 @@ Resalta el panel dividido enfocado:
   "plugins.interaction.closeDraft": "Close draft",
   "settings.plugins.permissions.current": "Coincide con la ejecución actual",
   "settings.plugins.permissions.inactive": "No activa para la ejecución actual",
-  "settings.plugins.permissions.title": "Autorizaciones guardadas",
+  "settings.plugins.permissions.note": "Las capacidades declaradas se permiten de forma predeterminada. Preguntar solicita una decisión con un alcance concreto; Denegar bloquea el acceso de inmediato. La selección de destinos y la edición de borradores siguen usando la interfaz de la aplicación.",
+  "settings.plugins.permissions.allow": "Permitir",
+  "settings.plugins.permissions.ask": "Preguntar",
+  "settings.plugins.permissions.deny": "Denegar",
+  "settings.plugins.permissions.title": "Permisos",
   "settings.plugins.permissions.refresh": "Actualizar",
   "settings.plugins.permissions.loading": "Cargando autorizaciones...",
   "settings.plugins.permissions.empty": "No hay autorizaciones guardadas. Las decisiones de un solo uso no se conservan.",
@@ -1310,7 +1323,7 @@ Resalta el panel dividido enfocado:
   "settings.plugins.permissions.revokeNote": "Desactiva el complemento, cancela su trabajo y elimina las autorizaciones guardadas. Actívelo para solicitar acceso de nuevo.",
   "settings.plugins.permissions.unavailable": "La gestión de permisos no está disponible",
   "settings.plugins.manager.permissions": "Permisos declarados",
-  "settings.plugins.manager.permissionNote": "Del manifiesto, no es una autorización. Activado permite la activación diferida; los permisos obligatorios se solicitan antes del primer uso y los opcionales cuando se necesitan. Las operaciones sensibles siguen verificándose.",
+  "settings.plugins.manager.permissionNote": "Las capacidades declaradas y compatibles se permiten de forma predeterminada. Puede cambiar cada capacidad a Preguntar o Denegar en los controles de permisos. Siempre se verifican los destinos y el alcance de los recursos.",
   "settings.plugins.manager.noPermissions": "No se han declarado permisos privilegiados.",
   "settings.plugins.manager.required": "Obligatorio",
   "settings.plugins.manager.optional": "Opcional",
@@ -1353,7 +1366,7 @@ Resalta el panel dividido enfocado:
   "settings.plugins.market.sourceOnly": "Ejemplo propio con código fuente. Compílalo con la CLI local e importa el .ncpkg; no hay versión publicada para descargar.",
   "settings.plugins.market.readmeNote": "Fijado al commit indicado. El HTML no se ejecuta y las imágenes remotas no se cargan. Contenido del autor.",
   "settings.plugins.manager.noVault": "El almacén de claves del sistema no está disponible. Se bloquean secretos y credenciales; el catálogo y los plugins que no los usan siguen disponibles.",
-  "settings.plugins.manager.sensitive": "Acceso sensible: revisa los datos y el alcance antes de autorizar.",
+  "settings.plugins.manager.sensitive": "Acceso sensible: esta capacidad puede exponer datos privados. Su modo se puede cambiar en los ajustes de permisos.",
   "settings.plugins.manager.dual": "El navegador es la opción predeterminada. El paquete también incluye una entrada Node con acceso completo al dispositivo; solo para desarrollo.",
   "settings.plugins.manager.advancedDeclaration": "Entrada de navegador con permisos avanzados declarados. No se admite en el modo normal; revisa cada permiso.",
   "settings.plugins.market.retry": "Reintentar",
@@ -1362,7 +1375,7 @@ Resalta el panel dividido enfocado:
   "settings.plugins.market.search": "Buscar nombre, autor o descripción",
   "settings.plugins.market.noResults": "No hay plugins coincidentes. Prueba otra búsqueda.",
   "settings.plugins.market.manifest": "Compatibilidad y permisos",
-  "settings.plugins.manager.unbounded": "No se declara un alcance de recursos más limitado. Revisa el alcance real en la solicitud de permiso.",
+  "settings.plugins.manager.unbounded": "No se declara un alcance de recursos más limitado. Se siguen aplicando la validación del anfitrión y el modo de permiso seleccionado.",
   "settings.plugins.openView": "Abrir",
   "settings.plugins.openManager": "Abrir gestor de plugins",
   "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
@@ -1415,7 +1428,7 @@ Resalta el panel dividido enfocado:
   'plugins.authentication.responseFailedWithMessage': 'No se pudo enviar la respuesta de autenticación: {message}. Inténtalo de nuevo o cancela la solicitud.',
   'plugins.authentication.continue': 'Continuar',
   'plugins.hostActions.select': 'Compartir metadatos de los equipos seleccionados',
-  'plugins.hostActions.selectionNote': 'Comparte nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados con este complemento. Los grupos solo incluyen los equipos seleccionados ahora. Conectar requiere otra confirmación.',
+  'plugins.hostActions.selectionNote': 'Solo se comparten los nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados de los equipos seleccionados. Los grupos solo incluyen los equipos seleccionados ahora. Las solicitudes posteriores de edición o conexión siguen los permisos de este complemento.',
   'plugins.hostActions.create': 'Revisar borrador de equipo',
   'plugins.hostActions.edit': 'Revisar cambios del equipo',
   'plugins.hostActions.connect': 'Confirmar conexión',

application/i18n/locales/ru/ai.ts

@@ -464,6 +464,8 @@ export const ruAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Всегда разрешать',
   'ai.chat.slashStopDesc': 'Остановить текущий ход AI и отменить выполняющиеся инструменты',
   'ai.chat.slashCompactDesc': 'Сжать ранний контекст разговора',
+  'ai.chat.slashRenameDesc': 'Переименовать текущий чат (/rename <название>)',
+  'ai.chat.slashChatsDesc': 'Показать чаты, видимые в этой панели',
   'ai.chat.reject': 'Отклонить',
   'ai.chat.toolLabel': 'Инструмент',
   'ai.chat.targetLabel': 'Цель',
@@ -526,6 +528,28 @@ export const ruAiMessages: Messages = {
   'ai.chat.recent': 'Недавние',
   'ai.chat.viewAll': 'Показать всё',
   'ai.chat.untitled': 'Без названия',
+  'ai.chat.renameChat': 'Переименовать чат',
+  'ai.chat.renameUsage': 'Использование: /rename <новое название>',
+  'ai.chat.renameNoActive': 'Нет активного чата для переименования.',
+  'ai.chat.renameDone': 'Чат переименован в «{title}».',
+  'ai.chat.exportSessions': 'Экспортировать чаты ИИ',
+  'ai.chat.importSessions': 'Импортировать чаты ИИ',
+  'ai.chat.exportDone': 'Чаты ИИ экспортированы в {path}.',
+  'ai.chat.exportDoneNoPath': 'Чаты ИИ экспортированы.',
+  'ai.chat.exportUnavailable': 'Экспорт чатов ИИ недоступен в этой среде.',
+  'ai.chat.importDone': 'Импортировано чатов ИИ: {n}.',
+  'ai.chat.importNone': 'В выбранном файле не найдено чатов ИИ.',
+  'ai.chat.chatsHeader': 'Чаты, видимые в этой панели:',
+  'ai.chat.chatsEmpty': 'В этой панели нет видимых чатов.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Терминал',
+  'ai.chat.chatsScopeGlobal': 'Глобально',
+  'ai.chat.chatsScopeDangling': 'Связь потеряна',
+  'ai.chat.slashRebindDesc': 'Привязать потерянный чат к этой панели (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Потерянные чаты можно восстановить командой /rebind <n>.',
+  'ai.chat.rebindUsage': 'Использование: /rebind <номер из /chats>',
+  'ai.chat.rebindDone': 'Чат «{title}» привязан к этой панели.',
+  'ai.chat.rebindUnavailable': 'В области этой панели нет цели для привязки.',
   'ai.chat.justNow': 'Только что',
   'ai.chat.minutesAgo': '{n}м назад',
   'ai.chat.hoursAgo': '{n}ч назад',
@@ -724,4 +748,27 @@ export const ruAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Пропустить',
   'zmodem.overwrite.cancel': 'Отмена',
   'settings.shortcuts.resetToDefault': 'Сбросить по умолчанию',
+  "ai.toolSettings.immediate": "Изменения применяются сразу. Закрытие окна не отменяет их.",
+  "ai.toolSettings.privacyOn": "Скрытие текста включено",
+  "ai.toolSettings.privacyOff": "Скрытие текста выключено",
+  "ai.toolSettings.ruleSummary": "Дополнительные диапазоны IP: {cidrs} · Пользовательские шаблоны: {patterns}",
+  "ai.toolSettings.configurePrivacy": "Настроить приватность",
+  "ai.toolSettings.unsaved": "Есть несохранённые изменения",
+  "ai.toolSettings.viewSkills": "Инструкции CLI",
+  "ai.toolSettings.viewPrompt": "Инструкции подключения",
+  "ai.toolSettings.behavior": "Поведение MCP",
+  "ai.toolSettings.configureBehavior": "Настроить поведение",
+  "ai.toolSettings.configureClients": "Настроить клиенты",
+  "ai.toolSettings.httpOn": "HTTP включён",
+  "ai.toolSettings.httpOff": "HTTP выключен",
+  "ai.toolSettings.loopback": "Только локальные подключения (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Настроить HTTP",
+  "ai.toolSettings.hideSecret": "Скрыть секрет",
+  "ai.toolSettings.showSecret": "Показать секрет",
+  "ai.toolSettings.manualSetup": "Ручная настройка",
+  "ai.toolSettings.format": "Формат",
+  "ai.toolSettings.connectionDetails": "Параметры подключения",
+  "ai.toolSettings.conflict": "Настройки изменены в другом окне. Черновик сохранён. Отмените и откройте окно снова, чтобы загрузить сохранённые настройки.",
+  "ai.toolSettings.retry": "Повторить",
+  "ai.toolSettings.applyingHttp": "Применение настроек HTTP...",
 };

application/i18n/locales/ru/core.ts

@@ -134,7 +134,12 @@ export const ruCoreMessages: Messages = {
   'settings.system.clearTempFiles': 'Очистить временные файлы',
   'settings.system.clearing': 'Очистка...',
   'settings.system.clearResult': 'Удалено файлов: {deleted}, ошибок: {failed}.',
-  'settings.system.tempDirectoryHint': 'Временные файлы создаются при открытии удалённых файлов во внешних приложениях. Они автоматически очищаются при закрытии SFTP-сессий.',
+  'settings.system.tempDirChoose': 'Выбрать папку',
+  'settings.system.tempDirManual': 'Введите абсолютный путь к папке',
+  'settings.system.tempDirApply': 'Применить',
+  'settings.system.tempDirReset': 'Сбросить по умолчанию',
+  'settings.system.tempDirError': 'Не удалось использовать эту папку.',
+  'settings.system.tempDirectoryHint': 'Используется для промежуточного хранения SFTP-передач и файлов, открытых во внешних приложениях. Смена папки во время передачи может повлиять на эту передачу.',
   'settings.system.credentials.title': 'Защита учётных данных',
   'settings.system.credentials.status': 'Статус',
   'settings.system.credentials.checking': 'Проверка...',
@@ -525,6 +530,8 @@ export const ruCoreMessages: Messages = {
   'settings.appearance.uiFont.desc': 'Выберите шрифт для интерфейса приложения',
   'settings.appearance.windowOpacity': 'Прозрачность окна',
   'settings.appearance.windowOpacity.desc': 'Настройте прозрачность всего окна приложения. При низких значениях текст терминала тоже бледнеет. В некоторых средах Linux это может не поддерживаться.',
+  'settings.appearance.windowBackgroundBlur': 'Матовое стекло',
+  'settings.appearance.windowBackgroundBlur.desc': 'Размывает рабочий стол за окном. При непрозрачности 100 % эффект не виден, но ваш выбор сохраняется.',
   'settings.appearance.appIcon': 'Значок приложения',
   'settings.appearance.appIcon.desc': 'Выберите стиль значка для Dock/панели задач, чтобы Netcatty было проще найти при переключении приложений. В Windows значок области уведомлений использует тот же стиль. Применяется во время работы; значок установленного пакета не меняется.',
   'settings.appearance.appIcon.original': 'Оригинал',
@@ -1130,6 +1137,8 @@ export const ruCoreMessages: Messages = {
   'deepLink.jms.unsupported': 'Неподдерживаемый протокол JumpServer: {{protocol}}',
 
   'settings.tab.plugins': 'Плагины',
+  "settings.plugins.author.official": "Официальная поддержка",
+  "settings.plugins.author.officialMeaning": "Поддерживается проектом Netcatty. Это не сертификат безопасности.",
   "settings.plugins.manager.installed": "Установленные плагины",
   "settings.plugins.manager.import": "Импорт .ncpkg",
   "settings.plugins.manager.preview": "Импортированные пакеты отключены до проверки и включения.",
@@ -1179,7 +1188,7 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.permissions.revokeNote": "Плагин будет отключён, его задачи отменены, а сохранённые разрешения удалены. Включите его для нового запроса доступа.",
   "settings.plugins.permissions.unavailable": "Управление разрешениями недоступно",
   "settings.plugins.manager.permissions": "Заявленные разрешения",
-  "settings.plugins.manager.permissionNote": "Из манифеста, а не предоставленные права. Включение допускает отложенную активацию; обязательные разрешения запрашиваются перед ней, необязательные — при использовании. Чувствительные операции проверяются приложением.",
+  "settings.plugins.manager.permissionNote": "Заявленные поддерживаемые возможности по умолчанию разрешены. Для каждой можно выбрать запрос или запрет в настройках разрешений. Проверки приложения и область ресурсов действуют всегда.",
   "settings.plugins.manager.noPermissions": "Привилегированные разрешения не заявлены.",
   "settings.plugins.manager.required": "Обязательно",
   "settings.plugins.manager.optional": "Необязательно",
@@ -1222,7 +1231,7 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.market.sourceOnly": "Пример из этого проекта. Соберите локальной CLI и импортируйте .ncpkg; готовый пакет для скачивания не опубликован.",
   "settings.plugins.market.readmeNote": "Зафиксирован указанный коммит. HTML не выполняется, внешние изображения не загружаются. Текст автора плагина.",
   "settings.plugins.manager.noVault": "Системное хранилище ключей недоступно. Операции с секретами и учётными данными заблокированы; каталог и плагины без секретов доступны.",
-  "settings.plugins.manager.sensitive": "Чувствительный доступ: проверьте данные и область ресурсов перед разрешением.",
+  "settings.plugins.manager.sensitive": "Чувствительный доступ: эта возможность может раскрыть личные данные. Её режим можно изменить в настройках разрешений.",
   "settings.plugins.manager.dual": "По умолчанию используется браузерная среда. Пакет также содержит вход Node с полным доступом к устройству; только для разработчиков.",
   "settings.plugins.manager.advancedDeclaration": "Браузерная точка входа с заявленными расширенными разрешениями. Не допускается в обычном режиме; проверьте все разрешения.",
   "settings.plugins.market.retry": "Повторить",
@@ -1231,7 +1240,7 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.market.search": "Поиск по имени, автору или описанию",
   "settings.plugins.market.noResults": "Совпадений нет. Измените запрос.",
   "settings.plugins.market.manifest": "Совместимость и разрешения",
-  "settings.plugins.manager.unbounded": "Более узкая область ресурсов не заявлена. Проверьте фактическую область в запросе разрешения.",
+  "settings.plugins.manager.unbounded": "Более узкая область ресурсов не заявлена. Проверки приложения и выбранный режим разрешений продолжают действовать.",
   "settings.plugins.openView": "Открыть",
   "settings.plugins.openManager": "Открыть управление плагинами",
   "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
@@ -1284,7 +1293,7 @@ export const ruCoreMessages: Messages = {
   'plugins.authentication.responseFailedWithMessage': 'Не удалось отправить ответ аутентификации: {message}. Повторите попытку или отмените запрос.',
   'plugins.authentication.continue': 'Продолжить',
   'plugins.hostActions.select': 'Передать метаданные выбранных хостов',
-  'plugins.hostActions.selectionNote': 'Плагину будут переданы сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Подключение требует отдельного подтверждения.',
+  'plugins.hostActions.selectionNote': 'Передаются только метаданные выбранных хостов: сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Дальнейшие запросы изменения или подключения зависят от настроек разрешений плагина.',
   'plugins.hostActions.create': 'Проверить черновик хоста',
   'plugins.hostActions.edit': 'Проверить изменения хоста',
   'plugins.hostActions.connect': 'Подтвердить подключение',

application/i18n/locales/settingsLocales.test.ts

@@ -29,6 +29,16 @@ const ALL_SETTINGS_LOCALES = [
   ...LOCALIZED_SETTINGS_LOCALES,
 ];
 
+test("Host selection disclosure describes later permission-controlled actions without promising another confirmation", () => {
+  const permissionWords: Record<string, RegExp> = { en: /permission settings/i, es: /permisos/i, ru: /разрешени/u, 'zh-CN': /权限设置/u, 'zh-TW': /權限設定/u };
+  const oldPromise = /requires a separate confirmation|requiere otra confirmación|требует отдельного подтверждения|需要单独确认|需要另外確認/iu;
+  for (const locale of ALL_SETTINGS_LOCALES) {
+    const note = locale.messages['plugins.hostActions.selectionNote'];
+    assert.match(note, permissionWords[locale.name], locale.name);
+    assert.doesNotMatch(note, oldPromise, locale.name);
+  }
+});
+
 test("localized settings include names for every default shortcut", () => {
   for (const locale of ALL_SETTINGS_LOCALES) {
     const missing = DEFAULT_KEY_BINDINGS

application/i18n/locales/zh-CN/ai.ts

@@ -525,6 +525,8 @@ export const zhCNAiMessages: Messages = {
   'ai.chat.alwaysAllow': '始终',
   'ai.chat.slashStopDesc': '停止当前 AI 回合并取消进行中的工具',
   'ai.chat.slashCompactDesc': '压缩较早的会话上下文',
+  'ai.chat.slashRenameDesc': '重命名当前聊天（/rename <标题>）',
+  'ai.chat.slashChatsDesc': '列出此面板可见的聊天',
   'ai.chat.reject': '拒绝',
   'ai.chat.toolLabel': '工具',
   'ai.chat.targetLabel': '目标',
@@ -587,6 +589,28 @@ export const zhCNAiMessages: Messages = {
   'ai.chat.recent': '最近',
   'ai.chat.viewAll': '查看全部',
   'ai.chat.untitled': '无标题',
+  'ai.chat.renameChat': '重命名聊天',
+  'ai.chat.renameUsage': '用法：/rename <新标题>',
+  'ai.chat.renameNoActive': '当前没有可重命名的聊天。',
+  'ai.chat.renameDone': '聊天已重命名为「{title}」。',
+  'ai.chat.exportSessions': '导出 AI 会话',
+  'ai.chat.importSessions': '导入 AI 会话',
+  'ai.chat.exportDone': 'AI 会话已导出到 {path}。',
+  'ai.chat.exportDoneNoPath': 'AI 会话已导出。',
+  'ai.chat.exportUnavailable': '当前环境不支持导出 AI 会话。',
+  'ai.chat.importDone': '已导入 {n} 个 AI 会话。',
+  'ai.chat.importNone': '所选文件中没有可导入的 AI 会话。',
+  'ai.chat.chatsHeader': '此面板可见的聊天：',
+  'ai.chat.chatsEmpty': '此面板没有可见的聊天。',
+  'ai.chat.chatsScopeWorkspace': '工作区',
+  'ai.chat.chatsScopeTerminal': '终端',
+  'ai.chat.chatsScopeGlobal': '全局',
+  'ai.chat.chatsScopeDangling': '已断开关联',
+  'ai.chat.slashRebindDesc': '将断联的聊天重绑到此面板（/rebind <序号>）',
+  'ai.chat.chatsRebindHint': '断联的聊天可用 /rebind <序号> 恢复。',
+  'ai.chat.rebindUsage': '用法：/rebind <序号>',
+  'ai.chat.rebindDone': '聊天“{title}”已重绑到此面板。',
+  'ai.chat.rebindUnavailable': '当前面板范围内没有可用的重绑目标。',
   'ai.chat.justNow': '刚刚',
   'ai.chat.minutesAgo': '{n}分钟前',
   'ai.chat.hoursAgo': '{n}小时前',
@@ -795,4 +819,27 @@ export const zhCNAiMessages: Messages = {
   'zmodem.overwrite.skip': '跳过',
   'zmodem.overwrite.cancel': '取消',
   'settings.shortcuts.resetToDefault': '重置为默认',
+  "ai.toolSettings.immediate": "更改立即生效，关闭此窗口不会撤销。",
+  "ai.toolSettings.privacyOn": "已启用文本脱敏",
+  "ai.toolSettings.privacyOff": "未启用文本脱敏",
+  "ai.toolSettings.ruleSummary": "{cidrs} 个附加 IP 范围 · {patterns} 条自定义规则",
+  "ai.toolSettings.configurePrivacy": "配置隐私",
+  "ai.toolSettings.unsaved": "有未保存的更改",
+  "ai.toolSettings.viewSkills": "查看 CLI 指引",
+  "ai.toolSettings.viewPrompt": "查看接入提示词",
+  "ai.toolSettings.behavior": "MCP 行为",
+  "ai.toolSettings.configureBehavior": "配置行为",
+  "ai.toolSettings.configureClients": "配置客户端",
+  "ai.toolSettings.httpOn": "HTTP 已启用",
+  "ai.toolSettings.httpOff": "HTTP 未启用",
+  "ai.toolSettings.loopback": "仅本地连接（127.0.0.1）",
+  "ai.toolSettings.configureHttp": "配置 HTTP",
+  "ai.toolSettings.hideSecret": "隐藏密钥",
+  "ai.toolSettings.showSecret": "显示密钥",
+  "ai.toolSettings.manualSetup": "手动配置",
+  "ai.toolSettings.format": "格式",
+  "ai.toolSettings.connectionDetails": "连接详情",
+  "ai.toolSettings.conflict": "设置已在另一窗口更改，当前草稿已保留。请取消并重新打开以加载已保存的设置。",
+  "ai.toolSettings.retry": "重试",
+  "ai.toolSettings.applyingHttp": "正在应用 HTTP 配置…",
 };

application/i18n/locales/zh-CN/core.ts

@@ -165,7 +165,12 @@ export const zhCNCoreMessages: Messages = {
   'settings.system.clearTempFiles': '清理临时文件',
   'settings.system.clearing': '清理中...',
   'settings.system.clearResult': '已删除 {deleted} 个文件，{failed} 个失败。',
-  'settings.system.tempDirectoryHint': '临时文件在使用外部应用打开远程文件时创建。SFTP 会话关闭时会自动清理。',
+  'settings.system.tempDirChoose': '选择文件夹',
+  'settings.system.tempDirManual': '输入绝对文件夹路径',
+  'settings.system.tempDirApply': '应用',
+  'settings.system.tempDirReset': '恢复默认',
+  'settings.system.tempDirError': '无法使用此文件夹。',
+  'settings.system.tempDirectoryHint': 'Netcatty 在所选文件夹中创建 Netcatty 临时子文件夹，用于 SFTP 传输暂存和外部编辑文件。传输期间更改文件夹可能影响该传输。',
   'settings.system.credentials.title': '凭据保护',
   'settings.system.credentials.status': '状态',
   'settings.system.credentials.checking': '检查中...',
@@ -586,6 +591,8 @@ Vaults 标签保持扁平，不使用这块背景。
   'settings.appearance.uiFont.desc': '选择软件界面使用的字体',
   'settings.appearance.windowOpacity': '窗口透明度',
   'settings.appearance.windowOpacity.desc': '调节整个应用窗口的透明度，方便叠在其他内容上方。较低时终端文字也会变淡；部分 Linux 桌面环境可能不支持。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊窗口后方的桌面。100% 不透明时效果不可见，但会保留你的开关设置。',
   'settings.appearance.appIcon': '应用图标',
   'settings.appearance.appIcon.desc': '选择 Dock/任务栏图标风格，切换应用时更容易找到 Netcatty。Windows 通知区域图标会使用同一套风格。运行时生效，安装包内的图标不会改变。',
   'settings.appearance.appIcon.original': '原始',
@@ -1177,6 +1184,8 @@ Vaults 标签保持扁平，不使用这块背景。
   'qs.default': '默认',
   'settings.tab.plugins': '插件',
   "settings.plugins.manager.installed": "已安装插件",
+  "settings.plugins.author.official": "官方维护",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 项目维护。这不是安全认证。",
   "settings.plugins.manager.import": "导入 .ncpkg",
   "settings.plugins.manager.preview": "导入的插件保持停用，请检查后再启用。",
   "settings.plugins.manager.empty": "导入本地插件包以开始使用。",
@@ -1213,19 +1222,23 @@ Vaults 标签保持扁平，不使用这块背景。
   "plugins.interaction.closeDraft": "关闭草稿",
   "settings.plugins.permissions.current": "匹配当前运行实例",
   "settings.plugins.permissions.inactive": "对当前运行实例不生效",
-  "settings.plugins.permissions.title": "已保存的授权",
+  "settings.plugins.permissions.note": "已声明且受支持的权限默认允许。询问时显示一次范围明确的确认；拒绝会立即阻止访问。选择目标和编辑草稿仍使用宿主界面。",
+  "settings.plugins.permissions.allow": "允许",
+  "settings.plugins.permissions.ask": "询问",
+  "settings.plugins.permissions.deny": "拒绝",
+  "settings.plugins.permissions.title": "权限",
   "settings.plugins.permissions.refresh": "刷新",
-  "settings.plugins.permissions.loading": "正在读取授权...",
+  "settings.plugins.permissions.loading": "正在加载权限...",
   "settings.plugins.permissions.empty": "没有已保存的授权。单次决定不会保留。",
   "settings.plugins.permissions.always": "直到撤销",
   "settings.plugins.permissions.application": "直到退出 Netcatty",
   "settings.plugins.permissions.session": "直到会话关闭",
   "settings.plugins.permissions.audit": "最近的安全事件（最多 100 条）",
   "settings.plugins.permissions.revoke": "停用并撤销全部授权",
-  "settings.plugins.permissions.revokeNote": "此操作会停用插件、取消其工作并删除已保存的授权。重新启用后可申请新授权。",
+  "settings.plugins.permissions.revokeNote": "此操作会停用插件、取消其工作并删除已保存的授权。允许 / 询问 / 拒绝设置会保留。",
   "settings.plugins.permissions.unavailable": "插件授权管理不可用",
   "settings.plugins.manager.permissions": "声明的权限",
-  "settings.plugins.manager.permissionNote": "来自 manifest，不代表已授权。启用表示允许按需激活；必需权限在首次激活前申请，可选权限在用到时申请。敏感操作仍受宿主检查。",
+  "settings.plugins.manager.permissionNote": "已声明且受支持的权限默认允许。可以在权限设置中逐项改为询问或拒绝；宿主验证和资源范围限制始终生效。",
   "settings.plugins.manager.noPermissions": "未声明特权权限。",
   "settings.plugins.manager.required": "必需",
   "settings.plugins.manager.optional": "可选",
@@ -1268,7 +1281,7 @@ Vaults 标签保持扁平，不使用这块背景。
   "settings.plugins.market.sourceOnly": "第一方源码示例。请用本地 CLI 构建并导入 .ncpkg；尚未发布可下载发行包。",
   "settings.plugins.market.readmeNote": "固定到上面的提交。HTML 不执行，远程图片不加载。内容由插件作者提供。",
   "settings.plugins.manager.noVault": "系统密钥存储不可用。秘密和凭据操作被阻止；浏览市场和不使用秘密的插件仍可使用。",
-  "settings.plugins.manager.sensitive": "敏感访问：授权前请检查涉及的数据和资源范围。",
+  "settings.plugins.manager.sensitive": "敏感访问：此能力可能涉及私密数据，可在权限设置中调整其模式。",
   "settings.plugins.manager.dual": "默认使用浏览器运行时，但包中还包含拥有完整设备权限的 Node 入口；仅限开发者模式。",
   "settings.plugins.manager.advancedDeclaration": "浏览器入口声明了高级权限。不适用于普通浏览器插件模式；请逐项检查声明权限。",
   "settings.plugins.market.retry": "重试",
@@ -1277,7 +1290,7 @@ Vaults 标签保持扁平，不使用这块背景。
   "settings.plugins.market.search": "搜索名称、作者或描述",
   "settings.plugins.market.noResults": "没有匹配插件，请尝试其他关键词。",
   "settings.plugins.market.manifest": "兼容性与权限",
-  "settings.plugins.manager.unbounded": "未声明更细的资源范围。请在权限提示中检查实际授权范围。",
+  "settings.plugins.manager.unbounded": "未声明更细的资源范围，仍受应用校验和所选权限模式约束。",
   "settings.plugins.openView": "打开",
   "settings.plugins.openManager": "打开插件管理",
   "settings.plugins.sources.conflict": "此 ID 已从其他来源安装。请先卸载并明确清理旧来源数据，再换源重装。原来源：",
@@ -1330,7 +1343,7 @@ Vaults 标签保持扁平，不使用这块背景。
   'plugins.authentication.responseFailedWithMessage': '无法发送认证响应：{message}。请重试或取消此请求。',
   'plugins.authentication.continue': '继续',
   'plugins.hostActions.select': '分享所选主机的元数据',
-  'plugins.hostActions.selectionNote': '向此插件分享已保存的名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。连接主机需要单独确认。',
+  'plugins.hostActions.selectionNote': '仅向此插件共享所选主机的元数据：名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。后续编辑或连接请求遵循此插件的权限设置。',
   'plugins.hostActions.create': '预览主机草稿',
   'plugins.hostActions.edit': '预览主机修改',
   'plugins.hostActions.connect': '确认连接',

application/i18n/locales/zh-TW/ai.ts

@@ -515,6 +515,8 @@ export const zhTWAiMessages: Messages = {
   'ai.chat.alwaysAllow': '始終',
   'ai.chat.slashStopDesc': '停止目前 AI 回合並取消進行中的工具',
   'ai.chat.slashCompactDesc': '壓縮較早的對話上下文',
+  'ai.chat.slashRenameDesc': '重新命名目前聊天（/rename <標題>）',
+  'ai.chat.slashChatsDesc': '列出此面板可見的聊天',
   'ai.chat.reject': '拒絕',
   'ai.chat.toolLabel': '工具',
   'ai.chat.targetLabel': '目標',
@@ -577,6 +579,28 @@ export const zhTWAiMessages: Messages = {
   'ai.chat.recent': '最近',
   'ai.chat.viewAll': '檢視全部',
   'ai.chat.untitled': '無標題',
+  'ai.chat.renameChat': '重新命名聊天',
+  'ai.chat.renameUsage': '用法：/rename <新標題>',
+  'ai.chat.renameNoActive': '目前沒有可重新命名的聊天。',
+  'ai.chat.renameDone': '聊天已重新命名為「{title}」。',
+  'ai.chat.exportSessions': '匯出 AI 會話',
+  'ai.chat.importSessions': '匯入 AI 會話',
+  'ai.chat.exportDone': 'AI 會話已匯出到 {path}。',
+  'ai.chat.exportDoneNoPath': 'AI 會話已匯出。',
+  'ai.chat.exportUnavailable': '目前環境不支援匯出 AI 會話。',
+  'ai.chat.importDone': '已匯入 {n} 個 AI 會話。',
+  'ai.chat.importNone': '所選檔案中沒有可匯入的 AI 會話。',
+  'ai.chat.chatsHeader': '此面板可見的聊天：',
+  'ai.chat.chatsEmpty': '此面板沒有可見的聊天。',
+  'ai.chat.chatsScopeWorkspace': '工作區',
+  'ai.chat.chatsScopeTerminal': '終端',
+  'ai.chat.chatsScopeGlobal': '全域',
+  'ai.chat.chatsScopeDangling': '已斷開關聯',
+  'ai.chat.slashRebindDesc': '將斷開關聯的聊天重新綁定到此面板（/rebind <序號>）',
+  'ai.chat.chatsRebindHint': '斷開關聯的聊天可用 /rebind <序號> 恢復。',
+  'ai.chat.rebindUsage': '用法：/rebind <序號>',
+  'ai.chat.rebindDone': '聊天「{title}」已重新綁定到此面板。',
+  'ai.chat.rebindUnavailable': '目前面板範圍內沒有可用的重新綁定目標。',
   'ai.chat.justNow': '剛剛',
   'ai.chat.minutesAgo': '{n}分鐘前',
   'ai.chat.hoursAgo': '{n}小時前',
@@ -785,4 +809,27 @@ export const zhTWAiMessages: Messages = {
   'zmodem.overwrite.skip': '跳過',
   'zmodem.overwrite.cancel': '取消',
   'settings.shortcuts.resetToDefault': '重設為預設值',
+  "ai.toolSettings.immediate": "變更立即生效，關閉此視窗不會復原。",
+  "ai.toolSettings.privacyOn": "已啟用文字遮蔽",
+  "ai.toolSettings.privacyOff": "未啟用文字遮蔽",
+  "ai.toolSettings.ruleSummary": "{cidrs} 個額外 IP 範圍 · {patterns} 條自訂規則",
+  "ai.toolSettings.configurePrivacy": "設定隱私",
+  "ai.toolSettings.unsaved": "有未儲存的變更",
+  "ai.toolSettings.viewSkills": "查看 CLI 指引",
+  "ai.toolSettings.viewPrompt": "查看接入提示詞",
+  "ai.toolSettings.behavior": "MCP 行為",
+  "ai.toolSettings.configureBehavior": "設定行為",
+  "ai.toolSettings.configureClients": "設定用戶端",
+  "ai.toolSettings.httpOn": "HTTP 已啟用",
+  "ai.toolSettings.httpOff": "HTTP 未啟用",
+  "ai.toolSettings.loopback": "僅本機連線（127.0.0.1）",
+  "ai.toolSettings.configureHttp": "設定 HTTP",
+  "ai.toolSettings.hideSecret": "隱藏金鑰",
+  "ai.toolSettings.showSecret": "顯示金鑰",
+  "ai.toolSettings.manualSetup": "手動設定",
+  "ai.toolSettings.format": "格式",
+  "ai.toolSettings.connectionDetails": "連線詳情",
+  "ai.toolSettings.conflict": "設定已在其他視窗變更，目前草稿已保留。請取消並重新開啟以載入已儲存的設定。",
+  "ai.toolSettings.retry": "重試",
+  "ai.toolSettings.applyingHttp": "正在套用 HTTP 設定…",
 };

application/i18n/locales/zh-TW/core.ts

@@ -167,7 +167,12 @@ export const zhTWCoreMessages: Messages = {
   'settings.system.clearTempFiles': '清理臨時檔案',
   'settings.system.clearing': '清理中...',
   'settings.system.clearResult': '已刪除 {deleted} 個檔案，{failed} 個失敗。',
-  'settings.system.tempDirectoryHint': '臨時檔案在使用外部應用程式開啟遠端檔案時建立。SFTP 工作階段關閉時會自動清理。',
+  'settings.system.tempDirChoose': '選擇資料夾',
+  'settings.system.tempDirManual': '輸入絕對資料夾路徑',
+  'settings.system.tempDirApply': '套用',
+  'settings.system.tempDirReset': '恢復預設',
+  'settings.system.tempDirError': '無法使用此資料夾。',
+  'settings.system.tempDirectoryHint': '用於 SFTP 傳輸暫存與外部編輯檔案。傳輸期間變更資料夾可能影響該傳輸。',
   'settings.system.credentials.title': '憑證保護',
   'settings.system.credentials.status': '狀態',
   'settings.system.credentials.checking': '檢查中...',
@@ -588,6 +593,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'settings.appearance.uiFont.desc': '選擇軟體介面使用的字型',
   'settings.appearance.windowOpacity': '視窗透明度',
   'settings.appearance.windowOpacity.desc': '調節整個應用程式視窗的透明度，方便疊在其他內容上方。較低時終端文字也會變淡；部分 Linux 桌面環境可能不支援。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊視窗後方的桌面。100% 不透明時效果不可見，但會保留你的開關設定。',
   'settings.appearance.appIcon': '應用程式圖示',
   'settings.appearance.appIcon.desc': '選擇 Dock/工作列圖示風格，切換應用程式時更容易找到 Netcatty。Windows 通知區域圖示會使用同一套風格。執行時生效，安裝檔內的圖示不會改變。',
   'settings.appearance.appIcon.original': '原始',
@@ -1179,6 +1186,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'qs.default': '預設',
 
   'settings.tab.plugins': '外掛程式',
+  "settings.plugins.author.official": "官方維護",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 專案維護。這不是安全認證。",
   "settings.plugins.manager.installed": "已安裝插件",
   "settings.plugins.manager.import": "導入 .ncpkg",
   "settings.plugins.manager.preview": "導入的插件保持停用，請檢查後再啟用。",
@@ -1216,19 +1225,23 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "plugins.interaction.closeDraft": "關閉草稿",
   "settings.plugins.permissions.current": "符合目前執行個體",
   "settings.plugins.permissions.inactive": "對目前執行個體不生效",
-  "settings.plugins.permissions.title": "已儲存的授權",
+  "settings.plugins.permissions.note": "已宣告且受支援的權限預設允許。詢問時顯示一次範圍明確的確認；拒絕會立即阻止存取。選擇目標和編輯草稿仍使用宿主介面。",
+  "settings.plugins.permissions.allow": "允許",
+  "settings.plugins.permissions.ask": "詢問",
+  "settings.plugins.permissions.deny": "拒絕",
+  "settings.plugins.permissions.title": "權限",
   "settings.plugins.permissions.refresh": "重新整理",
-  "settings.plugins.permissions.loading": "正在讀取授權...",
+  "settings.plugins.permissions.loading": "正在載入權限...",
   "settings.plugins.permissions.empty": "沒有已儲存的授權。單次決定不會保留。",
   "settings.plugins.permissions.always": "直到撤銷",
   "settings.plugins.permissions.application": "直到退出 Netcatty",
   "settings.plugins.permissions.session": "直到工作階段關閉",
   "settings.plugins.permissions.audit": "最近的安全事件（最多 100 筆）",
   "settings.plugins.permissions.revoke": "停用並撤銷全部授權",
-  "settings.plugins.permissions.revokeNote": "此操作會停用外掛、取消其工作並刪除已儲存的授權。重新啟用後可申請新授權。",
+  "settings.plugins.permissions.revokeNote": "此操作會停用外掛、取消其工作並刪除已儲存的授權。允許 / 詢問 / 拒絕設定會保留。",
   "settings.plugins.permissions.unavailable": "外掛授權管理無法使用",
   "settings.plugins.manager.permissions": "聲明的權限",
-  "settings.plugins.manager.permissionNote": "來自 manifest，不代表已授權。啟用表示允許按需激活；必需權限在首次激活前申請，可選權限在用到時申請。敏感操作仍受宿主檢查。",
+  "settings.plugins.manager.permissionNote": "已宣告且受支援的權限預設允許。可以在權限設定中逐項改為詢問或拒絕；宿主驗證和資源範圍限制始終生效。",
   "settings.plugins.manager.noPermissions": "未聲明特權權限。",
   "settings.plugins.manager.required": "必需",
   "settings.plugins.manager.optional": "可選",
@@ -1248,7 +1261,7 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "settings.plugins.manager.browser": "瀏覽器運行時：特權訪問通過宿主權限代理。",
   "settings.plugins.manager.advanced": "高級運行時：擁有完整 Node 文件系統和網絡能力，代理權限無法限制這些訪問。僅供開發預覽。",
   "settings.plugins.manager.data": "本地 KV 僅保留在此設備。只有明確標記為同步的非秘密設置進入加密雲 sidecar。插件包和權限授權不參與同步。",
-  "settings.plugins.manager.unbounded": "未宣告更細的資源範圍。請在權限提示中檢查實際授權範圍。",
+  "settings.plugins.manager.unbounded": "未宣告更細的資源範圍，仍受應用程式驗證和所選權限模式約束。",
   "settings.plugins.openView": "開啟",
   "settings.plugins.openManager": "開啟插件管理",
   "settings.plugins.sources.conflict": "此 ID 已从其他来源安装。请先卸载并明确清理旧来源数据，再换源重装。原来源：",
@@ -1296,7 +1309,7 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "settings.plugins.market.sourceOnly": "第一方源碼示例。請用本地 CLI 構建並導入 .ncpkg；尚未發佈可下載發行包。",
   "settings.plugins.market.readmeNote": "固定到上面的提交。HTML 不執行，遠程圖片不加載。內容由插件作者提供。",
   "settings.plugins.manager.noVault": "系統密鑰存儲不可用。秘密和憑據操作被阻止；瀏覽市場和不使用秘密的插件仍可使用。",
-  "settings.plugins.manager.sensitive": "敏感訪問：授權前請檢查涉及的數據和資源範圍。",
+  "settings.plugins.manager.sensitive": "敏感存取：此能力可能涉及私密資料，可在權限設定中調整其模式。",
   "settings.plugins.manager.dual": "默認使用瀏覽器運行時，但包中還包含擁有完整設備權限的 Node 入口；僅限開發者模式。",
   "settings.plugins.manager.advancedDeclaration": "瀏覽器入口聲明瞭高級權限。不適用於普通瀏覽器插件模式；請逐項檢查聲明權限。",
   "settings.plugins.market.retry": "重試",
@@ -1333,7 +1346,7 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'plugins.authentication.responseFailedWithMessage': '無法送出驗證回應：{message}。請重試或取消此要求。',
   'plugins.authentication.continue': '繼續',
   'plugins.hostActions.select': '分享所選主機的中繼資料',
-  'plugins.hostActions.selectionNote': '向此外掛分享已儲存的名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。連線需要另外確認。',
+  'plugins.hostActions.selectionNote': '僅向此外掛分享所選主機的中繼資料：名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。後續編輯或連線請求遵循此外掛的權限設定。',
   'plugins.hostActions.create': '預覽主機草稿',
   'plugins.hostActions.edit': '預覽主機修改',
   'plugins.hostActions.connect': '確認連線',

application/state/aiScopeCleanup.test.ts

@@ -2,14 +2,9 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 import type {
-  AIPanelView,
   AISession,
 } from "../../infrastructure/ai/types.ts";
-import { createEmptyDraft } from "./aiDraftState.ts";
-import {
-  pruneInactiveScopedSessions,
-  pruneInactiveScopedTransientState,
-} from "./aiScopeCleanup.ts";
+import { pruneInactiveScopedSessions } from "./aiScopeCleanup.ts";
 
 function createSession(id: string, scope: AISession["scope"], externalSessionId?: string): AISession {
   return {
@@ -24,47 +19,6 @@ function createSession(id: string, scope: AISession["scope"], externalSessionId?
   };
 }
 
-test("pruneInactiveScopedTransientState removes closed workspace and terminal scope state", () => {
-  const activeSessionIdMap = {
-    "terminal:open-terminal": "session-open",
-    "terminal:closed-terminal": "session-closed-terminal",
-    "workspace:open-workspace": "session-open-workspace",
-    "workspace:closed-workspace": "session-closed-workspace",
-  };
-  const draftsByScope = {
-    "terminal:open-terminal": createEmptyDraft("catty"),
-    "terminal:closed-terminal": createEmptyDraft("catty"),
-    "workspace:open-workspace": createEmptyDraft("catty"),
-    "workspace:closed-workspace": createEmptyDraft("catty"),
-  };
-  const panelViewByScope = {
-    "terminal:open-terminal": { mode: "draft" },
-    "terminal:closed-terminal": { mode: "session", sessionId: "session-closed-terminal" },
-    "workspace:open-workspace": { mode: "draft" },
-    "workspace:closed-workspace": { mode: "session", sessionId: "session-closed-workspace" },
-  } satisfies Record<string, AIPanelView>;
-
-  const next = pruneInactiveScopedTransientState(
-    activeSessionIdMap,
-    draftsByScope,
-    panelViewByScope,
-    new Set(["open-terminal", "open-workspace"]),
-  );
-
-  assert.deepEqual(next.activeSessionIdMap, {
-    "terminal:open-terminal": "session-open",
-    "workspace:open-workspace": "session-open-workspace",
-  });
-  assert.deepEqual(next.draftsByScope, {
-    "terminal:open-terminal": draftsByScope["terminal:open-terminal"],
-    "workspace:open-workspace": draftsByScope["workspace:open-workspace"],
-  });
-  assert.deepEqual(next.panelViewByScope, {
-    "terminal:open-terminal": panelViewByScope["terminal:open-terminal"],
-    "workspace:open-workspace": panelViewByScope["workspace:open-workspace"],
-  });
-});
-
 test("pruneInactiveScopedSessions reports inactive targets without deleting persisted history", () => {
   const sessions = [
     createSession("terminal-restorable", {

application/state/aiScopeCleanup.ts

@@ -6,7 +6,6 @@ import type {
 
 type DraftsByScope = Partial<Record<string, AIDraft>>;
 type PanelViewByScope = Partial<Record<string, AIPanelView>>;
-type ActiveSessionIdMap = Record<string, string | null>;
 
 function isInactiveScopedTarget(
   scopeKey: string,
@@ -55,41 +54,6 @@ export function pruneInactiveScopedState(
   };
 }
 
-export function pruneInactiveScopedTransientState(
-  activeSessionIdMap: ActiveSessionIdMap,
-  draftsByScope: DraftsByScope,
-  panelViewByScope: PanelViewByScope,
-  activeTargetIds: Set<string>,
-): {
-  activeSessionIdMap: ActiveSessionIdMap;
-  draftsByScope: DraftsByScope;
-  panelViewByScope: PanelViewByScope;
-} {
-  let activeSessionMapChanged = false;
-  const nextActiveSessionIdMap: ActiveSessionIdMap = {};
-
-  for (const [scopeKey, sessionId] of Object.entries(activeSessionIdMap)) {
-    if (isInactiveScopedTarget(scopeKey, activeTargetIds)) {
-      activeSessionMapChanged = true;
-      continue;
-    }
-
-    nextActiveSessionIdMap[scopeKey] = sessionId;
-  }
-
-  const nextScopedState = pruneInactiveScopedState(
-    draftsByScope,
-    panelViewByScope,
-    activeTargetIds,
-  );
-
-  return {
-    activeSessionIdMap: activeSessionMapChanged ? nextActiveSessionIdMap : activeSessionIdMap,
-    draftsByScope: nextScopedState.draftsByScope,
-    panelViewByScope: nextScopedState.panelViewByScope,
-  };
-}
-
 export function pruneInactiveScopedSessions(
   sessions: AISession[],
   activeTargetIds: Set<string>,

application/state/aiSessionsBackup.test.ts

@@ -0,0 +1,147 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import type { AISession } from '../../infrastructure/ai/types';
+import {
+  DebouncedBackupMirror,
+  isMissingOrCorruptSessionsStore,
+  mergeImportedSessions,
+  parseBackupSessions,
+  readLiveSessionsArray,
+  shouldRestoreFromBackup,
+} from './aiSessionsBackup';
+import { prepareRestoredSessions, pruneSessionsForStorage } from './aiStateSnapshots';
+
+function makeSession(id: string, updatedAt = 1_000): AISession {
+  return {
+    id,
+    title: id,
+    agentId: 'catty',
+    scope: { type: 'workspace', targetId: 'ws-1' },
+    messages: [],
+    createdAt: updatedAt,
+    updatedAt,
+  } as never;
+}
+
+test('isMissingOrCorruptSessionsStore distinguishes missing or corrupt stores from valid arrays', () => {
+  assert.equal(isMissingOrCorruptSessionsStore(null), true);
+  assert.equal(isMissingOrCorruptSessionsStore(''), true);
+  assert.equal(isMissingOrCorruptSessionsStore('[]'), false);
+  assert.equal(isMissingOrCorruptSessionsStore('{corrupt'), true);
+  assert.equal(isMissingOrCorruptSessionsStore('{}'), true);
+  assert.equal(isMissingOrCorruptSessionsStore('[{"id":"s1"}]'), false);
+});
+
+test('readLiveSessionsArray normalizes missing and corrupt stores', () => {
+  for (const raw of [null, undefined, '', '{}', 'not-json']) {
+    assert.deepEqual(readLiveSessionsArray(raw), []);
+  }
+  const sessions = [makeSession('s1')];
+  assert.deepEqual(readLiveSessionsArray(JSON.stringify(sessions)), sessions);
+});
+
+test('parseBackupSessions ignores corrupt payloads and drops malformed entries', () => {
+  assert.equal(parseBackupSessions(null), null);
+  assert.equal(parseBackupSessions(''), null);
+  assert.equal(parseBackupSessions('not json'), null);
+  assert.equal(parseBackupSessions('{"id":"s1"}'), null);
+  assert.equal(parseBackupSessions(JSON.stringify([{ id: 's1' }])), null);
+  const sessions = parseBackupSessions(JSON.stringify([
+    { id: 's1' },
+    { nope: true },
+    { id: 'missing-scope', title: 'Missing scope', agentId: 'catty', messages: [], updatedAt: 1000 },
+    { ...makeSession('null-scope'), scope: null },
+    { ...makeSession('missing-title'), title: undefined },
+    { ...makeSession('missing-agent'), agentId: undefined },
+    { ...makeSession('null-message'), messages: [null] },
+    { ...makeSession('incomplete-message'), messages: [{ id: 'm' }] },
+    { ...makeSession('missing-content'), messages: [{ id: 'm', role: 'user', timestamp: 1000 }] },
+    { ...makeSession('invalid-content'), messages: [{ id: 'm', role: 'user', timestamp: 1000, content: null }] },
+    { ...makeSession('invalid-timestamp'), messages: [{ id: 'm', role: 'user', timestamp: null, content: 'hello' }] },
+    null,
+    { ...makeSession('s2'), messages: [{ id: 'm', role: 'user', timestamp: 1000, content: 'hello' }] },
+  ]));
+  assert.deepEqual(sessions?.map((session) => session.id), ['s2']);
+});
+
+test('restore preserves all sessions when cloud sync is enabled', () => {
+  const sessions = Array.from({ length: 51 }, (_, index) => makeSession(`s${index}`, index));
+  assert.deepEqual(prepareRestoredSessions(sessions, true), sessions);
+  const local = prepareRestoredSessions(sessions, false);
+  assert.equal(local.length, 50);
+  assert.equal(local.some(session => session.id === 's0'), false);
+});
+
+test('malformed imports cannot reach pruning or inject broken sessions', () => {
+  const current = [makeSession('live')];
+  const malformed = parseBackupSessions(JSON.stringify([{ id: 's1' }]));
+  assert.deepEqual(mergeImportedSessions(current, pruneSessionsForStorage(malformed ?? [])), current);
+  const valid = parseBackupSessions(JSON.stringify([{ id: 's1' }, makeSession('valid')]));
+  const merged = mergeImportedSessions(current, pruneSessionsForStorage(valid ?? []));
+  assert.deepEqual(new Set(merged.map((session) => session.id)), new Set(['live', 'valid']));
+});
+
+test('restore happens only on a missing or corrupt live store with a non-empty backup', () => {
+  const backup = JSON.stringify([makeSession('s1')]);
+  // Empty (or wiped) store -> restore.
+  assert.equal(shouldRestoreFromBackup(null, backup), true);
+  assert.equal(shouldRestoreFromBackup('', backup), true);
+  assert.equal(shouldRestoreFromBackup('[]', backup), false);
+  assert.equal(shouldRestoreFromBackup('{corrupt', backup), true);
+  // Non-empty live store -> never restore (explicit deletions must win).
+  assert.equal(shouldRestoreFromBackup('[{"id":"live"}]', backup), false);
+  // Empty/corrupt backup -> nothing to restore.
+  assert.equal(shouldRestoreFromBackup(null, null), false);
+  assert.equal(shouldRestoreFromBackup(null, '[]'), false);
+  assert.equal(shouldRestoreFromBackup(null, '{corrupt'), false);
+});
+
+test('mergeImportedSessions keys by id with the newer updatedAt winning', () => {
+  const current = [makeSession('keep', 100), makeSession('older', 100)];
+  const imported = [makeSession('newer', 200), makeSession('older', 50), makeSession('added', 1)];
+  const merged = mergeImportedSessions(current, imported);
+  const byId = new Map(merged.map((session) => [session.id, session]));
+  assert.equal(byId.get('older')?.updatedAt, 100);
+  assert.equal(byId.get('newer')?.updatedAt, 200);
+  assert.equal(byId.has('added'), true);
+  assert.equal(byId.has('keep'), true);
+  // Sorted newest-first for stable history ordering.
+  assert.deepEqual(
+    merged.map((session) => session.updatedAt),
+    [...merged.map((session) => session.updatedAt)].sort((a, b) => b - a),
+  );
+});
+
+test('DebouncedBackupMirror writes once per batch with the last payload', async () => {
+  const writes: string[] = [];
+  const mirror = new DebouncedBackupMirror((json) => writes.push(json), 15);
+  mirror.schedule('{"gen":1}');
+  mirror.schedule('{"gen":2}');
+  await new Promise((resolve) => setTimeout(resolve, 30));
+  mirror.schedule('{"gen":3}');
+  mirror.schedule('{"gen":4}');
+  await new Promise((resolve) => setTimeout(resolve, 40));
+  assert.deepEqual(writes, ['{"gen":2}', '{"gen":4}']);
+});
+
+test('DebouncedBackupMirror flushNow writes the pending payload immediately', () => {
+  const writes: string[] = [];
+  const mirror = new DebouncedBackupMirror((json) => writes.push(json), 60_000);
+  mirror.schedule('{"gen":1}');
+  mirror.flushNow();
+  assert.deepEqual(writes, ['{"gen":1}']);
+  // A second flush with nothing pending is a no-op.
+  mirror.flushNow();
+  assert.deepEqual(writes, ['{"gen":1}']);
+});
+
+test('readLiveSessionsArray treats non-array JSON as empty (corrupt)', () => {
+  assert.deepEqual(readLiveSessionsArray(null), []);
+  assert.deepEqual(readLiveSessionsArray(''), []);
+  assert.deepEqual(readLiveSessionsArray('{}'), []);
+  assert.deepEqual(readLiveSessionsArray('{"sessions":[]}'), []);
+  assert.deepEqual(readLiveSessionsArray('not-json'), []);
+  assert.deepEqual(readLiveSessionsArray('[]'), []);
+  assert.equal(readLiveSessionsArray('[{"id":"a"}]').length, 1);
+});

application/state/aiSessionsBackup.ts

@@ -0,0 +1,156 @@
+import type { AISession } from '../../infrastructure/ai/types';
+
+/**
+ * Renderer-side logic for the AI session durability layer (issue #4015 R2
+ * follow-up): a disk mirror of the localStorage session store plus a
+ * restore-on-empty-store boot path. The IPC plumbing lives in
+ * `electron/bridges/aiSessionsBackupBridge.cjs`; this module keeps the
+ * decisions pure so they can be tested without Electron.
+ */
+
+/** Debounce window: at most one backup write per mutation burst (~2s). */
+export const AI_SESSIONS_BACKUP_DEBOUNCE_MS = 2000;
+
+export interface AiSessionsBackupBridge {
+  aiSessionsBackupWrite?: (payload: { json: string }) => Promise<{ ok: boolean }>;
+  aiSessionsBackupReadLatest?: () => Promise<{ ok: boolean; json?: string }>;
+  aiSessionsBackupExport?: (payload: { json: string }) => Promise<{ success: boolean; filePath?: string }>;
+  aiSessionsBackupImport?: () => Promise<{ success: boolean; json?: string }>;
+}
+
+/** Restore only when the live store is missing or malformed. A valid empty
+ * array represents an intentional deletion and must remain authoritative. */
+export function isMissingOrCorruptSessionsStore(raw: string | null | undefined): boolean {
+  if (raw == null || raw === '') return true;
+  try {
+    return !Array.isArray(JSON.parse(raw));
+  } catch {
+    return true;
+  }
+}
+
+/** Read the live sessions array from a raw localStorage string. Returns [] when
+ * missing/corrupt (including parseable non-arrays such as `{}`), so callers never
+ * treat a non-array as AISession[]. */
+export function readLiveSessionsArray(raw: string | null | undefined): AISession[] {
+  if (isMissingOrCorruptSessionsStore(raw)) return [];
+  try {
+    const parsed = JSON.parse(raw as string);
+    return Array.isArray(parsed) ? parsed as AISession[] : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Parse a backup payload into sessions. Returns null when the payload is
+ * corrupt or malformed (ignored gracefully); also drops entries without a
+ * usable required fields. Backup generations are written by the same serializer as the
+ * live store, so entries are expected to be full AISession objects.
+ */
+
+export function parseBackupSessions(json: string | null | undefined): AISession[] | null {
+  if (typeof json !== 'string' || json === '') return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  const sessions = parsed.filter(
+    (entry): entry is AISession => (
+      typeof entry === 'object' && entry !== null
+      && typeof (entry as AISession).id === 'string'
+      && typeof (entry as AISession).title === 'string'
+      && typeof (entry as AISession).agentId === 'string'
+      && typeof (entry as AISession).scope === 'object'
+      && (entry as AISession).scope !== null
+      && typeof (entry as AISession).scope.type === 'string'
+      && Array.isArray((entry as AISession).messages)
+      && (entry as AISession).messages.every(message => (
+        typeof message === 'object' && message !== null
+        && typeof message.id === 'string'
+        && typeof message.role === 'string'
+        && typeof message.content === 'string'
+        && typeof message.timestamp === 'number'
+        && Number.isFinite(message.timestamp)
+      ))
+      && typeof (entry as AISession).updatedAt === 'number'
+      && Number.isFinite((entry as AISession).updatedAt)
+    ),
+  );
+  return sessions.length > 0 ? sessions : null;
+}
+
+/**
+ * Decide whether to restore on boot: only when the live store is missing or corrupt AND
+ * the backup actually contains at least one session.
+ */
+export function shouldRestoreFromBackup(
+  liveRaw: string | null | undefined,
+  backupJson: string | null | undefined,
+): boolean {
+  if (!isMissingOrCorruptSessionsStore(liveRaw)) return false;
+  const sessions = parseBackupSessions(backupJson);
+  return sessions != null && sessions.length > 0;
+}
+
+/**
+ * Merge an imported backup into the current store: entries are keyed by id
+ * and the newer `updatedAt` wins. Explicit user action, so it may overwrite
+ * the live store (unlike the boot restore, which is empty-only).
+ */
+export function mergeImportedSessions(current: AISession[], imported: AISession[]): AISession[] {
+  const byId = new Map<string, AISession>();
+  for (const session of current) byId.set(session.id, session);
+  for (const session of imported) {
+    const existing = byId.get(session.id);
+    if (!existing || (session.updatedAt ?? 0) >= (existing.updatedAt ?? 0)) {
+      byId.set(session.id, session);
+    }
+  }
+  return Array.from(byId.values()).sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+}
+
+/**
+ * Debounced mirror scheduler. One rolling timer per process: the last
+ * mutation batch wins, and the write happens `debounceMs` after the batch
+ * settles (at most once per batch, per the durability spec).
+ */
+export class DebouncedBackupMirror {
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private pendingJson: string | null = null;
+
+  constructor(
+    private readonly write: (json: string) => void,
+    private readonly debounceMs: number = AI_SESSIONS_BACKUP_DEBOUNCE_MS,
+  ) {}
+
+  schedule(json: string) {
+    this.pendingJson = json;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      const json = this.pendingJson;
+      this.pendingJson = null;
+      if (json != null) this.write(json);
+    }, this.debounceMs);
+  }
+
+  flushNow() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const json = this.pendingJson;
+    this.pendingJson = null;
+    if (json != null) this.write(json);
+  }
+
+  reset() {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    this.pendingJson = null;
+  }
+}

application/state/aiStateSnapshots.test.ts

@@ -16,6 +16,7 @@ import {
   latestAISessionsSnapshot,
   setLatestAIActiveSessionMapSnapshot,
   setLatestAISessionsSnapshot,
+  rebindActiveSessionMap,
 } from './aiStateSnapshots';
 
 test('orphan cleanup keeps durable Catty output while explicit deletion removes it', async () => {
@@ -90,7 +91,9 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   const previousWindow = globalThis.window;
   const previousSessions = latestAISessionsSnapshot;
   const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  t.mock.method(localStorageAdapter, 'read', () => null);
   t.mock.method(localStorageAdapter, 'write', () => true);
+  t.mock.method(localStorageAdapter, 'writeString', () => true);
   Object.defineProperty(globalThis, 'window', {
     configurable: true,
     value: {
@@ -122,8 +125,24 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   try {
     cleanupOrphanedAISessions(new Set(['open', 'resumed-into']));
 
-    assert.equal(latestAISessionsSnapshot, sessions);
+    // Issue #4015 R2: the dropped chat is marked dangling but its record and
+    // its active pointer stay intact so /chats can offer a rebind.
+    const persistedSessions = latestAISessionsSnapshot;
+    assert.ok(persistedSessions);
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-orphan')?.scopeDangling,
+      true,
+    );
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-live')?.scopeDangling,
+      undefined,
+    );
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-resumed')?.scopeDangling,
+      undefined,
+    );
     assert.deepEqual(latestAIActiveSessionMapSnapshot, {
+      'terminal:closed': 'privacy-orphan',
       'terminal:open': 'privacy-live',
       'terminal:resumed-into': 'privacy-resumed',
     });
@@ -158,6 +177,95 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   }
 });
 
+test('orphan cleanup marks dangling chats instead of stripping them, and clears the flag when the target returns', (t) => {
+  const previousSessions = latestAISessionsSnapshot;
+  const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  const read = t.mock.method(localStorageAdapter, 'read', () => null);
+  t.mock.method(localStorageAdapter, 'write', () => true);
+  const writeString = t.mock.method(localStorageAdapter, 'writeString', () => true);
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: { dispatchEvent: () => true, netcatty: {} },
+  });
+  const dangling = {
+    ...makeSession('dangling-chat', 1, []),
+    scope: { type: 'terminal' as const, targetId: 'closed-ws' },
+  };
+  const live = {
+    ...makeSession('live-chat', 2, []),
+    scope: { type: 'terminal' as const, targetId: 'open' },
+  };
+  setLatestAISessionsSnapshot([dangling, live]);
+  setLatestAIActiveSessionMapSnapshot({
+    'terminal:closed-ws': 'dangling-chat',
+    'terminal:open': 'live-chat',
+  });
+
+  try {
+    cleanupOrphanedAISessions(new Set(['open']));
+
+    let persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'dangling-chat')?.scopeDangling, true);
+    assert.equal(persisted.find((s) => s.id === 'live-chat')?.scopeDangling, undefined);
+    // The active pointer survives the dangling marking.
+    assert.deepEqual(latestAIActiveSessionMapSnapshot, {
+      'terminal:closed-ws': 'dangling-chat',
+      'terminal:open': 'live-chat',
+    });
+    assert.ok(writeString.mock.callCount() > 0);
+
+    // The scope target becomes live again → the dangling flag clears.
+    read.mock.mockImplementation(() => null);
+    cleanupOrphanedAISessions(new Set(['open', 'closed-ws']));
+    persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'dangling-chat')?.scopeDangling, undefined);
+  } finally {
+    setLatestAISessionsSnapshot(previousSessions ?? []);
+    setLatestAIActiveSessionMapSnapshot(previousActiveSessionMap ?? {});
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
+test('orphan cleanup with an empty live-target set marks all scoped chats dangling', (t) => {
+  const previousSessions = latestAISessionsSnapshot;
+  const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  t.mock.method(localStorageAdapter, 'read', () => null);
+  t.mock.method(localStorageAdapter, 'write', () => true);
+  t.mock.method(localStorageAdapter, 'writeString', () => true);
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: { dispatchEvent: () => true, netcatty: {} },
+  });
+  const orphan = {
+    ...makeSession('orphan-chat', 1, []),
+    scope: { type: 'terminal' as const, targetId: 'gone' },
+  };
+  setLatestAISessionsSnapshot([orphan]);
+  setLatestAIActiveSessionMapSnapshot({ 'terminal:gone': 'orphan-chat' });
+
+  try {
+    // Empty is a valid observed live set (nothing mounted), not "unknown".
+    cleanupOrphanedAISessions(new Set());
+    const persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'orphan-chat')?.scopeDangling, true);
+  } finally {
+    setLatestAISessionsSnapshot(previousSessions ?? []);
+    setLatestAIActiveSessionMapSnapshot(previousActiveSessionMap ?? {});
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
 test('serializeSessionsForStorage strips oldest ciphertext before dropping visible sessions', async () => {
   const { serializeSessionsForStorage } = await import('./aiStateSnapshots');
   const ciphertext = 'gAAAA'.repeat(50000); // ~250 KB of ciphertext per message
@@ -817,3 +925,65 @@ for (const [budget, expectedCalls] of [[128 * 1024, 160], [0, 161]]) {
     assert.equal(result.sessions.length, budget === 0 ? 1 : 4);
   });
 }
+test('successful store writes schedule a throttled disk backup mirror', async (t) => {
+  const { writeSessionsForStorage, flushBackupMirror, __resetBackupMirrorForTests } =
+    await import('./aiStateSnapshots');
+  __resetBackupMirrorForTests();
+  const backupWrites: string[] = [];
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: {
+      netcatty: {
+        aiSessionsBackupWrite: async (payload: { json: string }) => {
+          backupWrites.push(payload.json);
+          return { ok: true };
+        },
+      },
+    },
+  });
+  const sessions = freezeHistory(makePersistenceHistory(3, 10));
+  const writeString = t.mock.method(localStorageAdapter, 'writeString', () => true);
+  t.mock.method(localStorageAdapter, 'read', () => null);
+  try {
+    assert.equal(writeSessionsForStorage(sessions), true);
+    // Throttled: nothing has been written to disk yet.
+    assert.equal(backupWrites.length, 0);
+    flushBackupMirror();
+    assert.equal(backupWrites.length, 1);
+    // The mirror carries exactly the JSON that landed in localStorage.
+    assert.equal(backupWrites[0], writeString.mock.calls[0].arguments[1]);
+    // Failed store writes never schedule a mirror.
+    writeString.mock.mockImplementation(() => false);
+    assert.equal(writeSessionsForStorage(sessions), false);
+    flushBackupMirror();
+    assert.equal(backupWrites.length, 1);
+  } finally {
+    __resetBackupMirrorForTests();
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
+test('rebindActiveSessionMap drops stale pointers and sets the new scope', () => {
+  const cleaned = rebindActiveSessionMap(
+    {
+      'terminal:old-ws': 'chat-1',
+      'terminal:other': 'chat-2',
+      'workspace:keep': 'chat-1',
+    },
+    'chat-1',
+    'terminal:new-ws',
+  );
+  assert.deepEqual(cleaned, {
+    'terminal:other': 'chat-2',
+    'terminal:new-ws': 'chat-1',
+  });
+  // Idempotent when already bound to the target scope with no other pointers.
+  assert.deepEqual(
+    rebindActiveSessionMap({ 'terminal:new-ws': 'chat-1' }, 'chat-1', 'terminal:new-ws'),
+    { 'terminal:new-ws': 'chat-1' },
+  );
+});

application/state/aiStateSnapshots.ts

@@ -20,10 +20,11 @@ import {
 } from './aiDraftState';
 import {
   pruneInactiveScopedSessions,
-  pruneInactiveScopedTransientState,
+  pruneInactiveScopedState,
 } from './aiScopeCleanup';
 import { emitAIStateChanged } from './aiStateEvents';
 import { getAgentRuntime } from '../../infrastructure/ai/harness/globalAgentRuntime';
+import { DebouncedBackupMirror, readLiveSessionsArray } from './aiSessionsBackup';
 
 /** Typed accessor for the Electron IPC bridge exposed on `window.netcatty`. */
 export interface AIBridge {
@@ -35,6 +36,11 @@ export interface AIBridge {
   aiMcpSetCommandBlocklist?: (blocklist: string[]) => Promise<unknown> | unknown;
   aiMcpSetCommandTimeout?: (timeout: number) => Promise<unknown> | unknown;
   aiMcpSetMaxIterations?: (maxIterations: number) => Promise<unknown> | unknown;
+  /** Durability mirror: write one timestamped backup generation to disk. */
+  aiSessionsBackupWrite?: (payload: { json: string }) => Promise<{ ok: boolean }>;
+  aiSessionsBackupReadLatest?: () => Promise<{ ok: boolean; json?: string }>;
+  aiSessionsBackupExport?: (payload: { json: string }) => Promise<{ success: boolean; filePath?: string }>;
+  aiSessionsBackupImport?: () => Promise<{ success: boolean; json?: string }>;
 }
 
 export function getAIBridge() {
@@ -82,10 +88,13 @@ function isScopeKeyActive(scopeKey: string, activeTargetIds: Set<string>) {
   return activeTargetIds.has(targetId);
 }
 
+/** Last live terminal/workspace target ids observed by orphan cleanup. */
+export let latestAIActiveTargetIdsSnapshot: Set<string> = new Set();
+
 export function cleanupOrphanedAISessions(activeTargetIds: Set<string>) {
+  latestAIActiveTargetIdsSnapshot = activeTargetIds;
   const currentSessions = latestAISessionsSnapshot
-    ?? localStorageAdapter.read<AISession[]>(STORAGE_KEY_AI_SESSIONS)
-    ?? [];
+    ?? readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS));
 
   // Sessions shown by a still-live scope must be protected from cleanup
   // even when their own `scope.targetId` points at a closed terminal —
@@ -111,65 +120,62 @@ export function cleanupOrphanedAISessions(activeTargetIds: Set<string>) {
     cleanupSdkAgentSessions(nextSessionCleanup.orphanedSessionIds);
   }
 
-  if (nextSessionCleanup.sessions !== currentSessions) {
-    setLatestAISessionsSnapshot(nextSessionCleanup.sessions);
-    writeSessionsForStorage(nextSessionCleanup.sessions);
+  // Issue #4015 R2: a dropped chat is recoverable now, so mark it dangling
+  // instead of stripping its record or pointer. `/chats` lists dangling chats
+  // with a rebind affordance; the flag clears when the chat is rebound or its
+  // scope target becomes live again.
+  const orphanedIds = new Set(nextSessionCleanup.orphanedSessionIds);
+  let sessionsMarked = false;
+  const markedSessions = currentSessions.map((session) => {
+    if (orphanedIds.has(session.id)) {
+      if (session.scopeDangling) return session;
+      sessionsMarked = true;
+      return { ...session, scopeDangling: true };
+    }
+    if (
+      session.scopeDangling
+      && (!session.scope.targetId || activeTargetIds.has(session.scope.targetId))
+    ) {
+      sessionsMarked = true;
+      const { scopeDangling: _cleared, ...rest } = session;
+      return rest as AISession;
+    }
+    return session;
+  });
+
+  if (sessionsMarked) {
+    setLatestAISessionsSnapshot(markedSessions);
+    writeSessionsForStorage(markedSessions);
     emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
   }
 
-  const activeSessionIdMap = preCleanupActiveSessionMap;
-  let activeSessionMapChanged = false;
-  const nextActiveSessionIdMap = { ...activeSessionIdMap };
-
-  for (const scopeKey of Object.keys(activeSessionIdMap)) {
-    if (isScopeKeyActive(scopeKey, activeTargetIds)) continue;
-    delete nextActiveSessionIdMap[scopeKey];
-    activeSessionMapChanged = true;
-  }
-
-  if (activeSessionMapChanged) {
-    setLatestAIActiveSessionMapSnapshot(nextActiveSessionIdMap);
-    localStorageAdapter.write(STORAGE_KEY_AI_ACTIVE_SESSION_MAP, nextActiveSessionIdMap);
-    emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
-  }
-
-  const currentActiveSessionIdMap = activeSessionMapChanged
-    ? nextActiveSessionIdMap
-    : activeSessionIdMap;
+  // Issue #4015 R2: keep active-pointer entries for scopes whose target
+  // closed. Clearing them used to make dangling chats invisible (rank 0) and
+  // unrecoverable from the UI; the pointer is rewritten on rebind instead.
   const currentDraftsByScope = latestAIDraftsByScopeSnapshot ?? {};
   const currentPanelViewByScope = latestAIPanelViewByScopeSnapshot ?? {};
-  const prunedScopedTransientState = pruneInactiveScopedTransientState(
-    currentActiveSessionIdMap,
+  const prunedScopedState = pruneInactiveScopedState(
     currentDraftsByScope,
     currentPanelViewByScope,
     activeTargetIds,
   );
 
-  if (prunedScopedTransientState.activeSessionIdMap !== currentActiveSessionIdMap) {
-    setLatestAIActiveSessionMapSnapshot(prunedScopedTransientState.activeSessionIdMap);
-    localStorageAdapter.write(
-      STORAGE_KEY_AI_ACTIVE_SESSION_MAP,
-      prunedScopedTransientState.activeSessionIdMap,
-    );
-    emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
-  }
-
-  if (prunedScopedTransientState.draftsByScope !== currentDraftsByScope) {
+  if (prunedScopedState.draftsByScope !== currentDraftsByScope) {
     for (const scopeKey of Object.keys(currentDraftsByScope)) {
-      if (scopeKey in prunedScopedTransientState.draftsByScope) continue;
+      if (scopeKey in prunedScopedState.draftsByScope) continue;
       bumpDraftMutationVersion(scopeKey);
       bumpDraftUploadGeneration(scopeKey);
     }
-    setLatestAIDraftsByScopeSnapshot(prunedScopedTransientState.draftsByScope);
+    setLatestAIDraftsByScopeSnapshot(prunedScopedState.draftsByScope);
     emitAIStateChanged(AI_STATE_CHANGED_DRAFTS_BY_SCOPE);
   }
 
-  if (prunedScopedTransientState.panelViewByScope !== currentPanelViewByScope) {
+  if (prunedScopedState.panelViewByScope !== currentPanelViewByScope) {
     for (const scopeKey of Object.keys(currentPanelViewByScope)) {
-      if (scopeKey in prunedScopedTransientState.panelViewByScope) continue;
+      if (scopeKey in prunedScopedState.panelViewByScope) continue;
       bumpDraftMutationVersion(scopeKey);
     }
-    setLatestAIPanelViewByScopeSnapshot(prunedScopedTransientState.panelViewByScope);
+    setLatestAIPanelViewByScopeSnapshot(prunedScopedState.panelViewByScope);
     emitAIStateChanged(AI_STATE_CHANGED_PANEL_VIEW_BY_SCOPE);
   }
 }
@@ -349,6 +355,10 @@ export function pruneSessionsForStorage(sessions: AISession[]): AISession[] {
   });
 }
 
+export function prepareRestoredSessions(sessions: AISession[], syncEnabled: boolean): AISession[] {
+  return syncEnabled ? sessions : pruneSessionsForStorage(sessions);
+}
+
 /**
  * Serialize sessions for localStorage under a byte budget, escalating pruning
  * as needed. Returns the JSON to persist plus the (possibly) further-pruned
@@ -486,11 +496,47 @@ export function serializeSessionsForStorage(
  * Returns true when the write succeeded; a false result means the payload
  * could not be persisted even after escalation (it stays memory-only).
  */
+
+// Durability mirror (issue #4015 follow-up): every successful store write
+// also schedules a debounced disk backup so a wiped/recreated profile does
+// not take the chat history with it. The exact JSON that landed in
+// localStorage is mirrored (already byte-budgeted), throttled to at most one
+// write per mutation batch.
+const backupMirror = new DebouncedBackupMirror((json) => {
+  try {
+    void getAIBridge()?.aiSessionsBackupWrite?.({ json })?.catch(() => {});
+  } catch {
+    // Backup failures must never break chat persistence.
+  }
+});
+
+export function flushBackupMirror() {
+  try {
+    backupMirror.flushNow();
+  } catch {
+    // Unload and persistence must remain fail-safe.
+  }
+}
+
+export function __resetBackupMirrorForTests() {
+  backupMirror.reset();
+}
+
+export function scheduleBackupMirror(json: string) {
+  try {
+    backupMirror.schedule(json);
+  } catch {
+    // ignore
+  }
+}
+
 export function writeSessionsForStorage(sessions: AISession[]): boolean {
   // Synced records are authoritative after restart: silently evicting a
   // session or turn here would turn local retention into cloud deletion.
   if (localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled) {
-    return localStorageAdapter.write(STORAGE_KEY_AI_SESSIONS, sessions);
+    const syncedOk = localStorageAdapter.write(STORAGE_KEY_AI_SESSIONS, sessions);
+    if (syncedOk) scheduleBackupMirror(JSON.stringify(sessions));
+    return syncedOk;
   }
   let previousLength = Number.POSITIVE_INFINITY;
   for (const configuredBudget of [MAX_SESSIONS_JSON_BYTES, ...RETRY_SESSIONS_JSON_BYTES]) {
@@ -505,7 +551,10 @@ export function writeSessionsForStorage(sessions: AISession[]): boolean {
     if (budget < 2) break;
     const candidate = serializeSessionsForStorage(sessions, budget);
     if (candidate.json.length >= previousLength) continue;
-    if (localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, candidate.json)) return true;
+    if (localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, candidate.json)) {
+      scheduleBackupMirror(candidate.json);
+      return true;
+    }
     previousLength = candidate.json.length;
   }
   // Last resort: attempt the smallest representation this serializer can
@@ -516,6 +565,7 @@ export function writeSessionsForStorage(sessions: AISession[]): boolean {
     minimalCandidate.json.length < previousLength
     && localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, minimalCandidate.json)
   ) {
+    scheduleBackupMirror(minimalCandidate.json);
     return true;
   }
   console.warn(
@@ -531,6 +581,28 @@ export let latestAIPanelViewByScopeSnapshot: PanelViewByScope | null = null;
 let latestAIDraftMutationVersionByScopeSnapshot: Record<string, number> = {};
 let latestAIDraftUploadGenerationByScopeSnapshot: Record<string, number> = {};
 
+
+/**
+ * Issue #4015 R2: rewrite the active-session map when rebinding a dangling
+ * chat. Drops every pointer that still names `sessionId` under a different
+ * scope key, then sets the new scope as active. Callers must persist and
+ * publish the returned map (do not rebuild from a stale snapshot).
+ */
+export function rebindActiveSessionMap(
+  activeSessionIdMap: Record<string, string | null>,
+  sessionId: string,
+  scopeKey: string,
+): Record<string, string | null> {
+  let next = activeSessionIdMap;
+  for (const [key, id] of Object.entries(activeSessionIdMap)) {
+    if (id !== sessionId || key === scopeKey) continue;
+    if (next === activeSessionIdMap) next = { ...activeSessionIdMap };
+    delete next[key];
+  }
+  if (next[scopeKey] === sessionId) return next;
+  return { ...next, [scopeKey]: sessionId };
+}
+
 export function setLatestAISessionsSnapshot(sessions: AISession[]) {
   latestAISessionsSnapshot = sessions;
 }

application/state/settingsIpcSync.ts

@@ -49,6 +49,7 @@ import {
   STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN,
   STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN_TAB,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_HTTP_NETWORK_PROXY,
   STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
@@ -99,6 +100,7 @@ interface UseSettingsIpcSyncParams {
   setIsHotkeyRecordingState: Dispatch<SetStateAction<boolean>>;
   setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
   setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
   setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
   setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
   setAutoLaunchEnabled: Dispatch<SetStateAction<boolean>>;
@@ -148,6 +150,7 @@ export function useSettingsIpcSync({
   setIsHotkeyRecordingState,
   setGlobalHotkeyEnabled,
   setWindowOpacity,
+  setWindowBackgroundBlur,
   setAppIconVariant,
   setAutoUpdateEnabled,
   setAutoLaunchEnabled,
@@ -279,6 +282,9 @@ export function useSettingsIpcSync({
       if (key === STORAGE_KEY_WINDOW_OPACITY) {
         setWindowOpacity(value);
       }
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && typeof value === 'boolean') {
+        setWindowBackgroundBlur((prev) => (prev === value ? prev : value));
+      }
       if (key === STORAGE_KEY_APP_ICON_VARIANT) {
         const nextVariant = resolveAppIconVariant(value);
         setAppIconVariant((prev) => (prev === nextVariant ? prev : nextVariant));
@@ -371,6 +377,7 @@ export function useSettingsIpcSync({
     setFollowAppTerminalThemeState,
     setGlobalHotkeyEnabled,
     setWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setHotkeyScheme,
     setIsHotkeyRecordingState,

application/state/settingsStorageSync.ts

@@ -53,6 +53,7 @@ import {
   STORAGE_KEY_UI_LANGUAGE,
   STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
 } from '../../infrastructure/config/storageKeys';
 import { resolveAppIconVariant, type AppIconVariant } from '../../domain/appIconVariant';
@@ -116,6 +117,7 @@ interface UseSettingsStorageSyncParams {
   globalHotkeyEnabled: boolean;
   autoUpdateEnabled: boolean;
   windowOpacity: number;
+  windowBackgroundBlur: boolean;
   appIconVariant: AppIconVariant;
   setTheme: Dispatch<SetStateAction<'dark' | 'light' | 'system'>>;
   setLightUiThemeId: Dispatch<SetStateAction<string>>;
@@ -166,6 +168,7 @@ interface UseSettingsStorageSyncParams {
   setExplorerContextMenuEnabledState: (enabled: boolean) => void;
   setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
   setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
   setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
   setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
   setWorkspaceFocusStyleState: Dispatch<SetStateAction<'dim' | 'border'>>;
@@ -184,7 +187,7 @@ export function useSettingsStorageSync({
   sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
   showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
   editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode, applyIncomingCustomAccent,
   setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
   setTerminalThemeId, setTerminalThemeDarkId, setTerminalThemeLightId,
@@ -193,7 +196,7 @@ export function useSettingsStorageSync({
   setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
   setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
   setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState, setJmsDeepLinkEnabledState, setExplorerContextMenuEnabledState,
-  setGlobalHotkeyEnabled, setWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+  setGlobalHotkeyEnabled, setWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
   setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
   applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
 }: UseSettingsStorageSyncParams) {
@@ -208,7 +211,7 @@ export function useSettingsStorageSync({
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   });
   settingsSnapshotRef.current = {
     theme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentVersion,
@@ -218,7 +221,7 @@ export function useSettingsStorageSync({
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   };
 
   // Listen for storage changes from other windows (cross-window sync)
@@ -523,6 +526,12 @@ export function useSettingsStorageSync({
       if (e.key === STORAGE_KEY_WINDOW_OPACITY && e.newValue !== null) {
         setWindowOpacity(e.newValue);
       }
+      if (e.key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && e.newValue !== null) {
+        const newValue = e.newValue === 'true';
+        if (newValue !== s.windowBackgroundBlur) {
+          setWindowBackgroundBlur(newValue);
+        }
+      }
       if (e.key === STORAGE_KEY_APP_ICON_VARIANT && e.newValue !== null) {
         const newValue = resolveAppIconVariant(e.newValue);
         if (newValue !== s.appIconVariant) {
@@ -566,6 +575,7 @@ export function useSettingsStorageSync({
     setGlobalHotkeyEnabled,
     setHostClickBehaviorState,
     setWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setHotkeyScheme,
     setLightUiThemeId,

application/state/systemSettingsEffects.ts

@@ -7,6 +7,7 @@ import {
   STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
   STORAGE_KEY_TOGGLE_WINDOW_HOTKEY,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_HTTP_NETWORK_PROXY,
 } from '../../infrastructure/config/storageKeys';
@@ -17,6 +18,8 @@ import {
 } from '../../domain/httpNetworkProxy';
 import { localStorageAdapter } from '../../infrastructure/persistence/localStorageAdapter';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { isMacPlatform } from '../../lib/utils';
+import { isWindowBackgroundBlurActive } from '../../domain/windowBackgroundBlur';
 import {
   parseWindowOpacityRecord,
   serializeWindowOpacityRecord,
@@ -47,6 +50,7 @@ interface UseSystemSettingsEffectsParams {
   autoLaunchEnabled: boolean;
   windowOpacityRecord: WindowOpacityRecord;
   windowOpacityMutationSourceRef: MutableRefObject<WindowOpacityMutationSource>;
+  windowBackgroundBlur: boolean;
   appIconVariant: AppIconVariant;
   autoUpdateEnabled: boolean;
   httpNetworkProxy: HttpNetworkProxySettings;
@@ -68,6 +72,7 @@ export function useSystemSettingsEffects({
   autoLaunchEnabled,
   windowOpacityRecord,
   windowOpacityMutationSourceRef,
+  windowBackgroundBlur,
   appIconVariant,
   autoUpdateEnabled,
   httpNetworkProxy,
@@ -300,6 +305,49 @@ export function useSystemSettingsEffects({
     persistMountedRef,
   ]);
 
+  // Window chrome also applies in detached sessions, independently of the
+  // OS-level effects disabled there (tray, global shortcuts, autolaunch, ...).
+  // Only the windows that own settings persistence drive the shared native
+  // state; detached/editor windows consume it (see applySharedWindowSetting).
+  useEffect(() => {
+    if (!enabled) return;
+    localStorageAdapter.writeBoolean(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+    if (!persistMountedRef.current) return;
+    notifySettingsChanged(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+  }, [
+    enabled,
+    windowBackgroundBlur,
+    notifySettingsChanged,
+    persistMountedRef,
+  ]);
+
+  const windowBackgroundBlurActive = isMacPlatform() && isWindowBackgroundBlurActive(
+    windowBackgroundBlur,
+    windowOpacityRecord.opacity,
+  );
+
+  // Applies in every app-content window, including detached sessions: the
+  // transparent backing only looks right when the renderer class matches the
+  // native vibrancy the main process put on that window.
+  useEffect(() => {
+    if (typeof document === 'undefined') return;
+    document.documentElement.classList.toggle('window-background-blur', windowBackgroundBlurActive);
+    document.documentElement.style.setProperty('--window-content-opacity', String(windowOpacityRecord.opacity));
+    return () => {
+      document.documentElement.classList.remove('window-background-blur');
+      document.documentElement.style.removeProperty('--window-content-opacity');
+    };
+  }, [windowBackgroundBlurActive, windowOpacityRecord.opacity]);
+
+  // setWindowBackgroundBlur is a main-process handler that retargets every
+  // app-content window, so a single owner must drive it.
+  useEffect(() => {
+    if (!enabled) return;
+    netcattyBridge.get()?.setWindowBackgroundBlur?.(windowBackgroundBlur).catch((err) => {
+      console.warn('[WindowBackgroundBlur] Failed to apply macOS vibrancy:', err);
+    });
+  }, [enabled, windowBackgroundBlur]);
+
   // Persist and sync app icon variant
   useEffect(() => {
     if (!enabled) return;

application/state/systemSettingsEffects.windowBlur.test.ts

@@ -0,0 +1,139 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { JSDOM } from 'jsdom';
+
+import { STORAGE_KEY_WINDOW_BACKGROUND_BLUR } from '../../infrastructure/config/storageKeys';
+import { DEFAULT_HTTP_NETWORK_PROXY } from '../../domain/httpNetworkProxy';
+import { useSystemSettingsEffects } from './systemSettingsEffects';
+
+type Harness = {
+  dom: JSDOM;
+  params: Parameters<typeof useSystemSettingsEffects>[0];
+  bridgeRequests: boolean[];
+  blurNotifications: unknown[];
+  restore: () => void;
+};
+
+function setUp(enabled: boolean, windowBackgroundBlur: boolean): Harness {
+  const dom = new JSDOM('<html><body><div id="root"></div></body></html>', { url: 'http://localhost' });
+  Object.defineProperty(dom.window.navigator, 'platform', { value: 'MacIntel' });
+  const previousGlobals = new Map<string, PropertyDescriptor | undefined>();
+  const replacements = {
+    window: dom.window,
+    document: dom.window.document,
+    navigator: dom.window.navigator,
+    localStorage: dom.window.localStorage,
+    IS_REACT_ACT_ENVIRONMENT: true,
+  };
+  for (const [key, value] of Object.entries(replacements)) {
+    previousGlobals.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { value, configurable: true });
+  }
+  const bridgeRequests: boolean[] = [];
+  const blurNotifications: unknown[] = [];
+  Object.assign(dom.window, {
+    netcatty: {
+      setWindowBackgroundBlur: async (value: boolean) => { bridgeRequests.push(value); },
+    },
+  });
+  const noop = () => {};
+  const params: Parameters<typeof useSystemSettingsEffects>[0] = {
+    enabled,
+    toggleWindowHotkey: '',
+    globalHotkeyEnabled: false,
+    closeToTray: false,
+    showTrayIcon: false,
+    autoLaunchEnabled: false,
+    windowOpacityRecord: { opacity: 0.7, preferredOpacity: 0.7, version: 1 },
+    windowOpacityMutationSourceRef: { current: 'local' },
+    windowBackgroundBlur,
+    appIconVariant: 'original',
+    autoUpdateEnabled: false,
+    httpNetworkProxy: DEFAULT_HTTP_NETWORK_PROXY,
+    persistMountedRef: { current: true },
+    setHotkeyRegistrationError: noop,
+    setAutoUpdateEnabled: noop,
+    setAppIconVariant: noop,
+    setAutoLaunchEnabled: noop,
+    setAutoLaunchSupported: noop,
+    notifySettingsChanged: (key, value) => {
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) blurNotifications.push(value);
+    },
+  };
+  return {
+    dom,
+    params,
+    bridgeRequests,
+    blurNotifications,
+    restore: () => {
+      for (const [key, descriptor] of previousGlobals) {
+        if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+        else Reflect.deleteProperty(globalThis, key);
+      }
+      dom.window.close();
+    },
+  };
+}
+
+const Probe = (props: Parameters<typeof useSystemSettingsEffects>[0]) => {
+  useSystemSettingsEffects(props);
+  return null;
+};
+
+test('opacity changes and remounts preserve the chosen blur preference', async () => {
+  const harness = setUp(true, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    const opaqueParams = { ...params, windowOpacityRecord: { ...params.windowOpacityRecord, opacity: 1, version: 2 } };
+    await act(async () => { renderer!.update(React.createElement(Probe, opaqueParams)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    assert.deepEqual(bridgeRequests, [true]);
+    assert.deepEqual(blurNotifications, [true]);
+    await act(async () => { renderer!.unmount(); });
+    await act(async () => { renderer = create(React.createElement(Probe, opaqueParams)); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    await act(async () => { renderer!.update(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    await act(async () => { renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false })); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'false');
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.deepEqual(bridgeRequests, [true, true, false]);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});
+
+test('detached session windows only apply the blur class, never own the setting', async () => {
+  // Peer session windows run with enableSystemEffects off. They must still
+  // paint the transparent backing, but persistence, cross-window broadcast and
+  // the (all-windows) native vibrancy IPC stay with the settings owners.
+  const harness = setUp(false, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    assert.equal(document.documentElement.style.getPropertyValue('--window-content-opacity'), '0.7');
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+
+    await act(async () => {
+      renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false }));
+    });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});

application/state/useAIState.ts

@@ -20,6 +20,7 @@ import {
   STORAGE_KEY_AI_AGENT_THINKING_MAP,
   STORAGE_KEY_AI_WEB_SEARCH,
   STORAGE_KEY_AI_QUICK_MESSAGES,
+  STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS,
 } from '../../infrastructure/config/storageKeys';
 import type { AIQuickMessage } from '../../infrastructure/ai/quickMessages';
 import { sanitizeQuickMessages } from '../../infrastructure/ai/quickMessages';
@@ -63,12 +64,17 @@ import {
   bumpDraftUploadGeneration,
   cleanupDeletedAIChatSessions,
   cleanupOrphanedAISessions,
+  latestAIActiveTargetIdsSnapshot,
   getAIBridge,
+  flushBackupMirror,
   getDraftUploadGeneration,
   latestAIActiveSessionMapSnapshot,
   latestAIDraftsByScopeSnapshot,
   latestAIPanelViewByScopeSnapshot,
   latestAISessionsSnapshot,
+  prepareRestoredSessions,
+  scheduleBackupMirror,
+  rebindActiveSessionMap,
   writeSessionsForStorage,
   setLatestAIActiveSessionMapSnapshot,
   setLatestAIDraftsByScopeSnapshot,
@@ -77,6 +83,12 @@ import {
   type DraftsByScope,
   type PanelViewByScope,
 } from './aiStateSnapshots';
+import {
+  isMissingOrCorruptSessionsStore,
+  mergeImportedSessions,
+  parseBackupSessions,
+  readLiveSessionsArray,
+} from './aiSessionsBackup';
 import { AI_STATE_CHANGED_EVENT, emitAIStateChanged } from './aiStateEvents';
 import {
   persistCommandBlocklistSetting,
@@ -168,9 +180,76 @@ export function useAIState() {
   // ── Sessions ──
   const [sessions, setSessionsRaw] = useState<AISession[]>(() =>
     latestAISessionsSnapshot
-      ?? localStorageAdapter.read<AISession[]>(STORAGE_KEY_AI_SESSIONS)
-      ?? []
+      ?? readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))
   );
+  // An explicit empty array is authoritative, even if the backup is stale.
+  // Only a missing or corrupt store can be restored from disk.
+  useEffect(() => {
+    window.addEventListener('beforeunload', flushBackupMirror);
+    return () => window.removeEventListener('beforeunload', flushBackupMirror);
+  }, []);
+  useEffect(() => {
+    const liveRaw = localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS);
+    if (!isMissingOrCorruptSessionsStore(liveRaw)) {
+      if (readLiveSessionsArray(liveRaw).length > 0 && liveRaw != null) scheduleBackupMirror(liveRaw);
+      return;
+    }
+    if (latestAISessionsSnapshot && latestAISessionsSnapshot.length > 0) return;
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupReadLatest) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const liveRaw = localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS);
+        if (!isMissingOrCorruptSessionsStore(liveRaw)) return;
+        const backup = await bridge.aiSessionsBackupReadLatest?.();
+        if (cancelled || !backup?.ok) return;
+        // Re-check after the async gap: a session may have been created
+        // while the backup was being read; never restore over live state.
+        // Cover both persisted storage and in-memory snapshot/React state —
+        // createSession updates the snapshot before the debounced disk write.
+        if (!isMissingOrCorruptSessionsStore(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))) {
+          return;
+        }
+        if ((latestAISessionsSnapshot?.length ?? 0) > 0) return;
+        const syncEnabled = !!localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled;
+        const restored = prepareRestoredSessions(parseBackupSessions(backup.json) ?? [], syncEnabled);
+        if (restored.length === 0) return;
+        // Apply restore synchronously (not inside a setState updater). A
+        // deferred updater would leave didRestore false and skip dangling
+        // marking even when the records later land in React state.
+        if ((latestAISessionsSnapshot?.length ?? 0) > 0) return;
+        if (sessionsRef.current.length > 0) return;
+        if (!isMissingOrCorruptSessionsStore(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))) {
+          return;
+        }
+        setLatestAISessionsSnapshot(restored);
+        writeSessionsForStorage(restored);
+        emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
+        // Restore does not change live terminals/workspaces, so the orphan-
+        // cleanup effect will not run. Reuse the last known live target set
+        // (empty is valid: nothing live) so chats bound to missing scopes
+        // become dangling and /chats can offer /rebind.
+        cleanupOrphanedAISessions(latestAIActiveTargetIdsSnapshot);
+        const nextSessions = latestAISessionsSnapshot ?? restored;
+        sessionsRef.current = nextSessions;
+        setSessionsRaw(nextSessions);
+        setActiveSessionIdMapRaw(
+          latestAIActiveSessionMapSnapshot
+            ?? localStorageAdapter.read<Record<string, string | null>>(STORAGE_KEY_AI_ACTIVE_SESSION_MAP)
+            ?? {},
+        );
+        console.info(
+          `[AIState] Restored ${restored.length} AI session(s) from the disk backup.`,
+        );
+      } catch {
+        // Backup restore must never break startup.
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
   // Ref that always holds the latest sessions for use inside debounced callbacks
   const sessionsRef = useRef(sessions);
   useEffect(() => {
@@ -866,6 +945,101 @@ export function useAIState() {
     });
   }, [persistSessions]);
 
+  // Issue #4015 R2: rebind a dangling chat to the panel's current scope.
+  // Rewrites `scope`, clears the dangling marker and makes the chat the
+  // active session of its new scope so it shows in the scoped history again.
+  const rebindSessionScope = useCallback((
+    sessionId: string,
+    scope: { type: 'terminal' | 'workspace'; targetId: string; hostIds?: string[] },
+  ) => {
+    const scopeKey = `${scope.type}:${scope.targetId}`;
+    setSessionsRaw(prev => {
+      const next = prev.map(s => {
+        if (s.id !== sessionId) return s;
+        const { scopeDangling: _cleared, ...rest } = s;
+        // Replace scope entirely (including hostIds) so history matching follows
+        // the destination terminal/workspace rather than the chat's old host.
+        const nextScope: AISession['scope'] = {
+          type: scope.type,
+          targetId: scope.targetId,
+        };
+        if (scope.hostIds && scope.hostIds.length > 0) {
+          nextScope.hostIds = [...scope.hostIds];
+        }
+        return {
+          ...rest,
+          scope: nextScope,
+          updatedAt: Date.now(),
+        } as AISession;
+      });
+      setLatestAISessionsSnapshot(next);
+      persistSessions(next);
+      return next;
+    });
+    // Drop stale pointers that still reference this chat under its previous
+    // scope key, then restore the active pointer for the new scope.
+    // Compute + persist inside the updater so a deferred React setState still
+    // writes the cleaned map (outer capture would stay null and skip persist).
+    setActiveSessionIdMapRaw(prev => {
+      const next = rebindActiveSessionMap(prev, sessionId, scopeKey);
+      setLatestAIActiveSessionMapSnapshot(next);
+      localStorageAdapter.write(STORAGE_KEY_AI_ACTIVE_SESSION_MAP, next);
+      emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
+      return next;
+    });
+    // Open the rebound chat in this panel; active-map alone loses to an
+    // explicit draft/session panelView that still points elsewhere.
+    setPanelViewByScope((prev) => setSessionView(prev, scopeKey, sessionId));
+  }, [persistSessions, setPanelViewByScope]);
+
+  // Manual durability escape hatch (issue #4015 follow-up): export the
+  // current store to a user-chosen JSON file, or import one back in.
+  // Import is an explicit action, so it may overwrite the live store.
+  const exportSessionsBackup = useCallback(async (): Promise<string | null> => {
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupExport) return null;
+    const result = await bridge.aiSessionsBackupExport({
+      json: JSON.stringify(sessionsRef.current),
+    });
+    return result?.success ? (result.filePath ?? '') : null;
+  }, []);
+
+  const importSessionsBackup = useCallback(async (): Promise<number> => {
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupImport) return 0;
+    const result = await bridge.aiSessionsBackupImport();
+    if (!result?.success || !result.json) return 0;
+    const imported = parseBackupSessions(result.json);
+    if (!imported || imported.length === 0) return 0;
+    // Merge synchronously against the live ref so orphan cleanup sees the
+    // imported chats even if React would defer a setState updater.
+    const syncEnabled = !!localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled;
+    const next = prepareRestoredSessions(mergeImportedSessions(sessionsRef.current, imported), syncEnabled);
+    if (!writeSessionsForStorage(next)) return 0;
+    const persisted = readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS));
+    const importedIds = new Set(imported.map(session => session.id));
+    sessionsRef.current = persisted;
+    setLatestAISessionsSnapshot(persisted);
+    setSessionsRaw(persisted);
+    emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
+    // Import does not change live terminals/workspaces, so the orphan-cleanup
+    // effect will not run. Reuse the last known live target set (empty is
+    // valid: nothing live) to mark chats bound to missing scopes as dangling
+    // so /chats can offer /rebind.
+    cleanupOrphanedAISessions(latestAIActiveTargetIdsSnapshot);
+    const nextSessions =
+      latestAISessionsSnapshot
+      ?? persisted;
+    sessionsRef.current = nextSessions;
+    setSessionsRaw(nextSessions);
+    setActiveSessionIdMapRaw(
+      latestAIActiveSessionMapSnapshot
+        ?? localStorageAdapter.read<Record<string, string | null>>(STORAGE_KEY_AI_ACTIVE_SESSION_MAP)
+        ?? {},
+    );
+    return persisted.filter(session => importedIds.has(session.id)).length;
+  }, []);
+
   const updateSessionExternalSessionId = useCallback((sessionId: string, externalSessionId: string | undefined) => {
     setSessionsRaw(prev => {
       const next = prev.map(s => (
@@ -1370,6 +1544,9 @@ export function useAIState() {
     deleteSession,
     deleteSessionsByTarget,
     updateSessionTitle,
+    rebindSessionScope,
+    exportSessionsBackup,
+    importSessionsBackup,
     updateSessionExternalSessionId,
     addMessageToSession,
     updateLastMessage,
@@ -1432,6 +1609,9 @@ export function useAIState() {
     deleteSession,
     deleteSessionsByTarget,
     updateSessionTitle,
+    rebindSessionScope,
+    exportSessionsBackup,
+    importSessionsBackup,
     updateSessionExternalSessionId,
     addMessageToSession,
     updateLastMessage,

application/state/usePluginAIContextHost.ts

@@ -4,7 +4,7 @@ import { getNotesSnapshot } from './notesStore';
 import { useActiveTabId } from './activeTabStore';
 import { getAppAppLockRuntime } from './appRuntimeBridge';
 import { createTrustedPluginAIHostRuntime } from '../../infrastructure/ai/plugin/trustedHostRuntime';
-import { getConfiguredPluginModel } from '../../infrastructure/ai/plugin/configuredModel';
+import { getConfiguredPluginModel, prepareConfiguredPluginModel } from '../../infrastructure/ai/plugin/configuredModel';
 import { buildSelectedPluginSources } from '../../infrastructure/ai/plugin/selectedSources';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
 
@@ -29,6 +29,7 @@ export function usePluginAIContextHost({ sessions, workspaces }: { sessions: Ter
     const requests = new Map<string, { runtimeId: string; controller: AbortController }>();
     const runtime = createTrustedPluginAIHostRuntime({
       getModel: getConfiguredPluginModel,
+      prepareModel: prepareConfiguredPluginModel,
       isActive: () => mounted && document.visibilityState === 'visible' && getAppAppLockRuntime()?.locked === false,
       chooseSelected: (signal, runtimeId) => new Promise((resolve, reject) => {
         if (chooser) { reject(Error('A host selection is already pending')); return; }

application/state/usePluginAgentHost.ts

@@ -0,0 +1,93 @@
+import { useEffect, useRef, useState } from 'react';
+import type { TerminalSession } from '../../domain/models';
+import type { PluginAgentHostTerminal } from '@netcatty/plugin-contract';
+import { createTrustedPluginAgentRuntime } from '../../infrastructure/ai/pluginAgent/trustedAgentRuntime';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { getAppAppLockRuntime } from './appRuntimeBridge';
+import { LOCAL_STORAGE_ADAPTER_CHANGED_EVENT } from '../../infrastructure/persistence/localStorageAdapter';
+import { STORAGE_KEY_AI_PROVIDERS, STORAGE_KEY_AI_ACTIVE_PROVIDER, STORAGE_KEY_AI_ACTIVE_MODEL, STORAGE_KEY_AI_AGENT_MODEL_MAP,
+  STORAGE_KEY_AI_AGENT_PROVIDER_MAP, STORAGE_KEY_AI_EXTERNAL_AGENTS } from '../../infrastructure/config/storageKeys';
+
+type Choice = { items: PluginAgentHostTerminal[]; confirm: (ids: string[]) => void; cancel: () => void };
+
+// All inventory remains in trusted application UI. Only confirmed metadata is
+// passed to the main-owned worker bindings; focus never determines a target.
+export function usePluginAgentHost(sessions: TerminalSession[]) {
+  const latest = useRef(sessions); latest.current = sessions;
+  const [choice, setChoice] = useState<Choice | null>(null);
+  useEffect(() => {
+    const api = netcattyBridge.get();
+    if (!api?.onPluginAgentHostRequest || !api.setPluginAgentHostReady || !api.respondPluginAgentHost) return;
+    const bridge = { subscribe: api.onPluginAgentHostRequest.bind(api), ready: api.setPluginAgentHostReady.bind(api), respond: api.respondPluginAgentHost.bind(api) };
+    let mounted = true;
+    let chooser: { runtimeId: string; cancel: () => void } | null = null;
+    const requests = new Map<string, { runtimeId: string; controller: AbortController }>();
+    const runtime = createTrustedPluginAgentRuntime({
+      isActive: () => mounted && document.visibilityState === 'visible' && getAppAppLockRuntime()?.locked === false,
+      chooseTargets: (signal, runtimeId) => new Promise((resolve, reject) => {
+        if (chooser) { reject(Error('A target selection is already pending')); return; }
+        const items = latest.current.filter((item) => item.status === 'connected').map((item) => ({
+          sessionId: item.id, hostId: item.hostId, hostname: (item.hostname || '').slice(0, 253),
+          label: (item.customName || item.hostLabel || item.id).slice(0, 160),
+          ...(item.protocol ? { protocol: item.protocol } : {}), ...(item.username ? { username: item.username.slice(0, 160) } : {}), connected: true,
+        }));
+        const finish = (ids: string[] | null) => {
+          if (chooser?.cancel !== cancel) return;
+          chooser = null; signal.removeEventListener('abort', cancel); setChoice(null);
+          if (ids === null || signal.aborted || ids.length > 32 || new Set(ids).size !== ids.length) { reject(Error('Target selection cancelled')); return; }
+          const selected = ids.map((id) => items.find((item) => item.sessionId === id));
+          if (selected.some((item) => !item || !latest.current.some((session) => session.id === item.sessionId && session.status === 'connected'))) {
+            reject(Error('Selected terminal is no longer connected')); return;
+          }
+          resolve(selected as PluginAgentHostTerminal[]);
+        };
+        const cancel = () => finish(null);
+        chooser = { runtimeId, cancel }; signal.addEventListener('abort', cancel, { once: true });
+        setChoice({ items, confirm: finish, cancel });
+        if (signal.aborted) cancel();
+      }),
+    });
+    const unsubscribe = bridge.subscribe((request) => {
+      if (request.kind === 'request.cancel') {
+        const pending = requests.get(request.payload.requestId);
+        if (pending?.runtimeId === request.runtimeId) pending.controller.abort();
+        runtime.cancelRequest(request.payload.requestId, request.runtimeId); return;
+      }
+      if (request.kind === 'runtime.release') {
+        for (const item of requests.values()) if (item.runtimeId === request.runtimeId) item.controller.abort();
+        if (chooser?.runtimeId === request.runtimeId) chooser.cancel();
+        runtime.releaseRuntime(request.runtimeId); return;
+      }
+      if (request.kind === 'agent.close') { runtime.releaseChat(request.payload.chatSessionId, request.runtimeId); return; }
+      if (requests.has(request.requestId) || requests.size >= 64) return;
+      const controller = new AbortController(); requests.set(request.requestId, { runtimeId: request.runtimeId, controller });
+      void runtime.handle(request, controller.signal).then(
+        (result) => bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, result }).catch(() =>
+          bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, error: true })),
+        () => bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, error: true }),
+      ).catch(() => {}).finally(() => requests.delete(request.requestId));
+    });
+    const pageHide = () => { runtime.shutdown(); for (const item of requests.values()) item.controller.abort(); };
+    const configurationKeys = new Set([STORAGE_KEY_AI_PROVIDERS, STORAGE_KEY_AI_ACTIVE_PROVIDER, STORAGE_KEY_AI_ACTIVE_MODEL,
+      STORAGE_KEY_AI_AGENT_MODEL_MAP, STORAGE_KEY_AI_AGENT_PROVIDER_MAP, STORAGE_KEY_AI_EXTERNAL_AGENTS]);
+    const configurationChanged = (event: Event) => {
+      const key = event.type === 'storage' ? (event as StorageEvent).key : (event as CustomEvent<{ key: string }>).detail?.key;
+      if (key === null || (key && configurationKeys.has(key))) {
+        runtime.invalidateConfiguration();
+        // Invalidate main-owned backend leases too, even with no event read in
+        // flight. Re-advertising availability does not renew existing handles.
+        void bridge.ready(false).then(() => { if (mounted) return bridge.ready(true); }).catch(() => {});
+      }
+    };
+    window.addEventListener('pagehide', pageHide);
+    window.addEventListener('storage', configurationChanged); window.addEventListener(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, configurationChanged);
+    void bridge.ready(true).catch(() => {});
+    return () => {
+      mounted = false; chooser?.cancel(); unsubscribe(); window.removeEventListener('pagehide', pageHide);
+      window.removeEventListener('storage', configurationChanged); window.removeEventListener(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, configurationChanged);
+      for (const item of requests.values()) item.controller.abort(); requests.clear(); runtime.shutdown();
+      void bridge.ready(false).catch(() => {});
+    };
+  }, []);
+  return { choice };
+}

application/state/usePluginAuthorIdentity.ts

@@ -0,0 +1,59 @@
+import { useEffect, useMemo, useState, useSyncExternalStore } from 'react';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+// All visible rows share one IPC subscription. No catalog fetch or polling here.
+const generations = new Map<string, number>();
+const listeners = new Set<() => void>();
+let unsubscribe: (() => void) | undefined;
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  if (listeners.size === 1) unsubscribe = netcattyBridge.get()?.onPluginCatalogChanged?.(({ sourceId }) => {
+    generations.set(sourceId, (generations.get(sourceId) ?? 0) + 1);
+    for (const notify of listeners) notify();
+  });
+  return () => {
+    listeners.delete(listener);
+    if (!listeners.size) { unsubscribe?.(); unsubscribe = undefined; generations.clear(); }
+  };
+}
+
+export function usePluginAuthorIdentity({ entry, plugin, sourceId = 'official' }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const [element, setElement] = useState<HTMLElement | null>(null);
+  const [loaded, setLoaded] = useState<{ key: string; value: NetcattyPluginAuthorPresentation } | null>(null);
+  const pluginId = plugin?.id;
+  const entryId = entry?.id;
+  const selectionToken = entry?.selectionToken;
+  const request = useMemo<NetcattyPluginAuthorRequest | null>(() => pluginId
+    ? { kind: 'installed', pluginId }
+    : entryId && selectionToken ? { kind: 'catalog', pluginId: entryId, selectionToken, sourceId } : null,
+  [pluginId, entryId, selectionToken, sourceId]);
+  const identitySource = plugin?.source?.id ?? sourceId;
+  const generation = useSyncExternalStore(subscribe, () => generations.get(identitySource) ?? 0, () => 0);
+  const key = JSON.stringify([request, plugin?.activeVersion, plugin?.archiveSha256, plugin?.source?.id, plugin?.runtime?.quarantinedAt, generation]);
+  const installed = Boolean(plugin);
+  const version = plugin?.activeVersion;
+  const archiveSha256 = plugin?.archiveSha256 ?? null;
+  const installedSourceId = plugin?.source?.id ?? 'local';
+  useEffect(() => {
+    if (!element || !request) return;
+    let active = true;
+    let started = false;
+    const load = () => {
+      if (started) return;
+      started = true;
+      void netcattyBridge.get()?.getPluginAuthorPresentation?.(request).then((value) => {
+        if (!active || !value) return;
+        if (installed && (value.version !== version || value.archiveSha256 !== archiveSha256 || value.sourceId !== installedSourceId)) return;
+        setLoaded({ key, value });
+      }).catch(() => { /* The visible author placeholder remains usable offline. */ });
+    };
+    const observer = typeof IntersectionObserver === 'undefined' ? null : new IntersectionObserver((entries) => {
+      if (entries.some((entry) => entry.isIntersecting)) { load(); observer?.disconnect(); }
+    }, { rootMargin: '64px' });
+    if (observer) observer.observe(element); else load();
+    return () => { active = false; observer?.disconnect(); };
+  }, [element, request, key, installed, version, archiveSha256, installedSourceId]);
+  return { ref: setElement, identity: loaded?.key === key ? loaded.value : null };
+}

application/state/usePluginHostActions.ts

@@ -112,7 +112,7 @@ export function usePluginHostActions() {
           const entry = current.current;
           if (!entry || entry.prompt.requestId !== prompt.requestId || entry.prompt.request.kind !== prompt.request.kind) throw new Error('Host review is unavailable');
           entry.prompt = prompt;
-          setReview({ ...entry });
+          if (!(prompt.request.kind === 'vault.requestConnect' && prompt.permissionMode === 'allow')) setReview({ ...entry });
           void execute(entry);
           return;
         }
@@ -126,7 +126,12 @@ export function usePluginHostActions() {
           scriptsRun: host ? pluginHostRunsSavedScripts(host, vault.groupConfigs, vault.snippets) : false,
           claimed: false,
         };
-        current.current = entry; setReview(entry); setSelectedIds([]); setBusy(false); setError(false); responding.current = false;
+        current.current = entry; setSelectedIds([]); setBusy(false); setError(false); responding.current = false;
+        if (prompt.request.kind === 'vault.requestConnect' && prompt.permissionMode === 'allow') {
+          setReview(null);
+          void bridge.respondPluginInteraction?.({ requestId: prompt.requestId, actionToken: prompt.actionToken,
+            action: 'submit', scriptsRun: entry.scriptsRun }).catch(() => void fail(entry));
+        } else setReview(entry);
       } catch {
         void bridge.respondPluginInteraction?.({ requestId: prompt.requestId, actionToken: prompt.actionToken, action: 'fail' }).catch(() => {});
       }
@@ -137,7 +142,7 @@ export function usePluginHostActions() {
       unsubscribe();
       if (entry && !entry.claimed) void bridge.respondPluginInteraction?.({ requestId: entry.prompt.requestId, actionToken: entry.prompt.actionToken, action: 'cancel' }).catch(() => {});
     };
-  }, [execute, getVault]);
+  }, [execute, fail, getVault]);
 
   const respond = useCallback(async (action: 'cancel' | 'submit', draft?: PluginHostDraftFields) => {
     const entry = current.current;

application/state/usePluginHostInteractions.ts

@@ -20,7 +20,16 @@ export function usePluginHostInteractions() {
         current.current = null; setPrompt(null);
       } else {
         if (event.request.kind.startsWith('vault.')) return;
-        current.current = event as UiPrompt; setPrompt(event as UiPrompt);
+        current.current = event as UiPrompt;
+        if (event.request.kind === 'terminal.selection.read' && event.phase === 'request') {
+          setPrompt(null);
+          try {
+            const selection = readPluginTerminalSelection(event.terminalSessionId ?? '', event.terminalRendererId ?? '');
+            void bridge.respondPluginInteraction?.({ requestId: event.requestId, actionToken: event.actionToken, action: 'preview', value: selection }).catch(() => {
+              void bridge.respondPluginInteraction?.({ requestId: event.requestId, actionToken: event.actionToken, action: 'cancel' }).catch(() => {});
+            });
+          } catch { void bridge.respondPluginInteraction?.({ requestId: event.requestId, actionToken: event.actionToken, action: 'cancel' }).catch(() => {}); }
+        } else setPrompt(event as UiPrompt);
         setValue(event.request.kind === 'input' ? event.request.initialValue ?? '' : event.request.kind === 'terminal.input.propose' ? event.request.text : '');
       }
       pending.current = false; setBusy(false); setError(false);

application/state/usePluginPermissionPrompt.ts

@@ -0,0 +1,31 @@
+import { useEffect, useRef, useState } from 'react';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+export function usePluginPermissionPrompt() {
+  const [prompts, setPrompts] = useState<NetcattyPluginPermissionPrompt[]>([]);
+  const [busy, setBusy] = useState(false);
+  const active = useRef<NetcattyPluginPermissionPrompt | null>(null);
+  const prompt = prompts[0];
+  active.current = prompt ?? null;
+  useEffect(() => {
+    const bridge = netcattyBridge.get();
+    if (!bridge?.onPluginPermission || !bridge.setPluginPermissionReady) return;
+    const unsubscribe = bridge.onPluginPermission((event) => {
+      setPrompts((previous) => 'closed' in event ? previous.filter((item) => item.requestId !== event.requestId)
+        : [...previous.filter((item) => item.requestId !== event.requestId), event]);
+      setBusy(false);
+    });
+    void bridge.setPluginPermissionReady(true).catch(() => {});
+    return () => { unsubscribe(); void bridge.setPluginPermissionReady?.(false).catch(() => {}); };
+  }, []);
+  const respond = async (decision: 'allow' | 'deny' | 'cancel') => {
+    if (!prompt || busy || active.current !== prompt) return;
+    setBusy(true);
+    try {
+      const accepted = await netcattyBridge.require().respondPluginPermission?.({ requestId: prompt.requestId, actionToken: prompt.actionToken, decision });
+      if (!accepted) setPrompts((previous) => previous.filter((item) => item.requestId !== prompt.requestId));
+    } catch { setPrompts((previous) => previous.filter((item) => item.requestId !== prompt.requestId)); }
+    finally { setBusy(false); }
+  };
+  return { prompt, busy, respond };
+}

application/state/useSessionState.ts

@@ -24,6 +24,7 @@ reorderWorkspaceFocusSessionOrder,
 SplitDirection,
 SplitHint,
 updateWorkspaceSplitSizes,
+  invertSplitPosition,
 } from '../../domain/workspace';
 import { clearSessionFontSizeOverride as clearSessionFontSizeOverrideFields } from '../../domain/terminalAppearance';
 import {
@@ -795,12 +796,68 @@ export const useSessionState = ({
     return workspace.id;
   }, [setActiveTabId]);
 
+  const addSessionToWorkspace = useCallback((
+    workspaceId: string,
+    sessionId: string,
+    hint: SplitHint
+  ) => {
+    if (!hint) return;
+    
+	    setSessions(prevSessions => {
+      const session = prevSessions.find(s => s.id === sessionId);
+      if (!session || session.workspaceId) return prevSessions;
+      
+      setWorkspaces(prevWorkspaces => {
+        const targetWorkspace = prevWorkspaces.find(w => w.id === workspaceId);
+        if (!targetWorkspace) return prevWorkspaces;
+        
+        return insertWorkspacePaneIfMissing(prevWorkspaces, workspaceId, sessionId, hint);
+      });
+      
+      setActiveTabId(workspaceId);
+      return prevSessions.map(s => s.id === sessionId ? { ...s, workspaceId } : s);
+	    });
+	  }, [setActiveTabId]);
+
+  // Merge two tabs into one workspace. When one of them already belongs to a
+  // workspace, that workspace (and its id) is reused instead of dissolving
+  // and recreating: the id is what workspace-scoped AI chats bind to, so
+  // regenerating it used to strand every conversation anchored to it
+  // (issue #4015 R3). Only two genuinely standalone tabs create a new id.
   const createWorkspaceFromSessions = useCallback((
     baseSessionId: string,
     joiningSessionId: string,
     hint: SplitHint
   ) => {
     if (!hint || baseSessionId === joiningSessionId) return;
+    const baseSession = sessionsRef.current.find((s) => s.id === baseSessionId);
+    const joiningSession = sessionsRef.current.find((s) => s.id === joiningSessionId);
+    const anchorWorkspaceId = baseSession?.workspaceId ?? joiningSession?.workspaceId;
+    if (anchorWorkspaceId) {
+      const anchorSessionId = baseSession?.workspaceId ? baseSessionId : joiningSessionId;
+      const orphanSessionId = anchorSessionId === baseSessionId ? joiningSessionId : baseSessionId;
+      const orphanSession = sessionsRef.current.find((s) => s.id === orphanSessionId);
+      if (!orphanSession || orphanSession.workspaceId) return;
+      // Split next to the anchor's existing pane: the raw drop hint targets
+      // the orphan's pane, which is not part of this workspace tree yet.
+      // When the dragged (joining) pane already owns the workspace, the orphan
+      // is what gets inserted — invert the drop position so the previewed
+      // side still matches (hint describes where the dragged pane should sit).
+      const joinOwnsWorkspace = Boolean(joiningSession?.workspaceId) && !baseSession?.workspaceId;
+      const insertHint = {
+        ...hint,
+        targetSessionId: anchorSessionId,
+        position: joinOwnsWorkspace ? invertSplitPosition(hint.position) : hint.position,
+      };
+      addSessionToWorkspace(
+        anchorWorkspaceId,
+        orphanSessionId,
+        insertHint,
+      );
+      // The orphan's standalone tab slot is replaced by the workspace tab.
+      setTabOrder((prevTabOrder) => prevTabOrder.filter((id) => id !== orphanSessionId));
+      return;
+    }
     // Name the merged workspace after both tabs' connection labels (e.g.
     // "01/02") so the window title and the rename dialog show the merged
     // identity instead of the generic "Workspace". Falls back to the default
@@ -855,30 +912,7 @@ export const useSessionState = ({
         return s;
       });
     });
-  }, [setActiveTabId]);
-
-  const addSessionToWorkspace = useCallback((
-    workspaceId: string,
-    sessionId: string,
-    hint: SplitHint
-  ) => {
-    if (!hint) return;
-    
-	    setSessions(prevSessions => {
-      const session = prevSessions.find(s => s.id === sessionId);
-      if (!session || session.workspaceId) return prevSessions;
-      
-      setWorkspaces(prevWorkspaces => {
-        const targetWorkspace = prevWorkspaces.find(w => w.id === workspaceId);
-        if (!targetWorkspace) return prevWorkspaces;
-        
-        return insertWorkspacePaneIfMissing(prevWorkspaces, workspaceId, sessionId, hint);
-      });
-      
-      setActiveTabId(workspaceId);
-      return prevSessions.map(s => s.id === sessionId ? { ...s, workspaceId } : s);
-	    });
-	  }, [setActiveTabId]);
+  }, [addSessionToWorkspace, setActiveTabId]);
 
   // Add a host into an existing workspace by creating a new session for
   // that host and appending it as the last pane at the workspace root.

application/state/useSessionStateWorkspaceIdReuse.test.ts

@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import React from "react";
+import { act, create, type ReactTestRenderer } from "react-test-renderer";
+
+import { collectSessionIds } from "../../domain/workspace.ts";
+import { useSessionState } from "./useSessionState.ts";
+
+type SessionState = ReturnType<typeof useSessionState>;
+
+test("merging a workspace tab with a standalone tab reuses the workspace id (issue #4015 R3)", async (t) => {
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  const eventTarget = new EventTarget() as EventTarget & Record<string, unknown>;
+  Object.assign(eventTarget, {
+    setTimeout,
+    clearTimeout,
+  });
+  Object.defineProperty(globalThis, "window", {
+    configurable: true,
+    value: eventTarget,
+  });
+  t.after(() => {
+    if (previousWindow) Object.defineProperty(globalThis, "window", previousWindow);
+    else Reflect.deleteProperty(globalThis, "window");
+  });
+
+  const actEnvironment = globalThis as typeof globalThis & {
+    IS_REACT_ACT_ENVIRONMENT?: boolean;
+  };
+  const previousActEnvironment = actEnvironment.IS_REACT_ACT_ENVIRONMENT;
+  actEnvironment.IS_REACT_ACT_ENVIRONMENT = true;
+  t.after(() => {
+    actEnvironment.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
+  });
+
+  let state: SessionState | null = null;
+  let renderer: ReactTestRenderer | null = null;
+  const current = (): SessionState => {
+    assert.ok(state);
+    return state;
+  };
+  function Probe() {
+    state = useSessionState({ persistSessionRestore: false });
+    return null;
+  }
+
+  await act(async () => {
+    renderer = create(React.createElement(Probe));
+  });
+
+  let baseId = "";
+  let memberId = "";
+  let standaloneId = "";
+  await act(async () => {
+    baseId = current().createLocalTerminal({ shellName: "01" });
+    memberId = current().createLocalTerminal({ shellName: "02" });
+    standaloneId = current().createLocalTerminal({ shellName: "03" });
+  });
+
+  await act(async () => {
+    current().createWorkspaceFromSessions(baseId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: baseId,
+    });
+  });
+  const workspaceId = current().workspaces[0]?.id;
+  assert.ok(workspaceId);
+  assert.equal(current().sessions.find((s) => s.id === standaloneId)?.workspaceId ?? "", "");
+
+  // Dropping the standalone tab onto a member of the workspace must join the
+  // existing workspace — regenerating the id would strand AI chats bound to it.
+  await act(async () => {
+    current().createWorkspaceFromSessions(standaloneId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: standaloneId,
+    });
+  });
+
+  assert.equal(current().workspaces.length, 1);
+  assert.equal(current().workspaces[0]?.id, workspaceId);
+  assert.equal(
+    current().sessions.find((s) => s.id === standaloneId)?.workspaceId,
+    workspaceId,
+  );
+  const memberIds = collectSessionIds(current().workspaces[0]!.root);
+  assert.ok(memberIds.includes(standaloneId));
+  assert.ok(memberIds.includes(memberId));
+  // The standalone tab slot is replaced by the workspace tab.
+  assert.ok(!current().orderedTabs.includes(standaloneId));
+
+
+  // Dropping a workspace member onto a standalone tab must insert the
+  // standalone on the opposite side of the drop hint (hint describes where
+  // the dragged member should appear relative to the standalone).
+  let orientationStandaloneId = "";
+  let orientationMemberId = "";
+  await act(async () => {
+    orientationStandaloneId = current().createLocalTerminal({ shellName: "orient-standalone" });
+  });
+  // memberId is already in workspaceId; drop member onto the new standalone with position "right"
+  // (preview: member to the right of standalone ⇒ standalone should end up LEFT of member).
+  await act(async () => {
+    current().createWorkspaceFromSessions(orientationStandaloneId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: orientationStandaloneId,
+    });
+  });
+  {
+    const root = current().workspaces.find((ws) => ws.id === workspaceId)?.root;
+    assert.ok(root);
+    const ordered = collectSessionIds(root!);
+    const standaloneIdx = ordered.indexOf(orientationStandaloneId);
+    const memberIdx = ordered.indexOf(memberId);
+    assert.ok(standaloneIdx >= 0 && memberIdx >= 0);
+    assert.ok(
+      standaloneIdx < memberIdx,
+      `expected standalone left of member after inverted right-drop, got order ${ordered.join(",")}`,
+    );
+  }
+
+  // Two genuinely standalone tabs still create a fresh workspace.
+  let firstStandaloneId = "";
+  let secondStandaloneId = "";
+  await act(async () => {
+    firstStandaloneId = current().createLocalTerminal({ shellName: "04" });
+    secondStandaloneId = current().createLocalTerminal({ shellName: "05" });
+  });
+  await act(async () => {
+    current().createWorkspaceFromSessions(firstStandaloneId, secondStandaloneId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: firstStandaloneId,
+    });
+  });
+
+  assert.equal(current().workspaces.length, 2);
+  const freshWorkspace = current().workspaces.find((candidate) => candidate.id !== workspaceId);
+  assert.ok(freshWorkspace);
+  assert.notEqual(freshWorkspace.id, workspaceId);
+
+  await act(async () => {
+    renderer?.unmount();
+  });
+});

application/state/useSettingsState.ts

@@ -74,6 +74,7 @@ import {
   STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
   STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_AUTO_UPDATE_ENABLED,
   STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
@@ -645,6 +646,9 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     windowOpacityMutationSourceRef.current = 'local';
     setWindowOpacityRecord(toggleWindowOpacityRecord);
   }, []);
+  const [windowBackgroundBlur, setWindowBackgroundBlur] = useState<boolean>(() => {
+    return readStoredString(STORAGE_KEY_WINDOW_BACKGROUND_BLUR) === 'true';
+  });
   const [appIconVariant, setAppIconVariantState] = useState<AppIconVariant>(() => {
     const stored = readStoredString(STORAGE_KEY_APP_ICON_VARIANT);
     return resolveAppIconVariant(stored ?? DEFAULT_APP_ICON_VARIANT);
@@ -1276,6 +1280,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setIsHotkeyRecordingState,
     setGlobalHotkeyEnabled,
     setWindowOpacity: applyIncomingWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setAutoUpdateEnabled,
     setAutoLaunchEnabled,
@@ -1298,12 +1303,18 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setSshTransportIdleTtlMsState,
   });
 
-  // Detached sessions share opacity and the shortcut configuration needed to
-  // operate it. Keep general settings listeners and OS effects disabled there.
+  // Detached sessions share window chrome (opacity, background blur) and the
+  // shortcut configuration needed to operate it. Keep general settings
+  // listeners and OS effects disabled there.
   useEffect(() => {
     if (enableSettingsSync) return;
     const applySharedWindowSetting = (key: string, value: unknown) => {
       if (key === STORAGE_KEY_WINDOW_OPACITY) applyIncomingWindowOpacity(value);
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) {
+        // Storage events deliver the raw string; IPC delivers a boolean.
+        const incoming = typeof value === 'boolean' ? value : value === 'true';
+        setWindowBackgroundBlur(incoming);
+      }
       if (key === STORAGE_KEY_HOTKEY_SCHEME && (value === 'disabled' || value === 'mac' || value === 'pc')) {
         setHotkeyScheme(value);
       }
@@ -1377,7 +1388,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
     setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode,
     applyIncomingCustomAccent,
     setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
@@ -1387,7 +1398,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
     setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
     setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState: applyIncomingSshDeepLinkEnabled, setJmsDeepLinkEnabledState: applyIncomingJmsDeepLinkEnabled, setExplorerContextMenuEnabledState: applyIncomingExplorerContextMenuEnabled,
-    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
     setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
     applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
   });
@@ -1896,6 +1907,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     autoLaunchEnabled,
     windowOpacityRecord,
     windowOpacityMutationSourceRef,
+    windowBackgroundBlur,
     appIconVariant,
     autoUpdateEnabled,
     httpNetworkProxy,
@@ -2276,6 +2288,8 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     windowOpacity,
     setWindowOpacity,
     toggleWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
     appIconVariant,
     setAppIconVariant,
     rehydrateAllFromStorage,

application/state/useToolAccessGuidanceState.test.tsx

@@ -0,0 +1,81 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { useToolAccessGuidanceState, type ToolAccessGuidanceState } from './useToolAccessGuidanceState';
+import { AI_STATE_CHANGED_EVENT } from './aiStateEvents';
+import { STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } from '../../infrastructure/config/storageKeys';
+import type { AIToolIntegrationMode } from '../../infrastructure/ai/types';
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => { resolve = done; });
+  return { promise, resolve };
+}
+async function harness() {
+  const requests: ReturnType<typeof deferred<unknown>>[] = [];
+  const events = new EventTarget();
+  const values = new Map([[STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED, 'true']]);
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const globals = {
+    IS_REACT_ACT_ENVIRONMENT: true,
+    localStorage: { getItem: (key: string) => values.get(key) ?? null, setItem: (key: string, value: string) => values.set(key, value) },
+    window: {
+      netcatty: {
+        externalMcpGetStatus: () => { const request = deferred<unknown>(); requests.push(request); return request.promise; },
+        aiSkillsCliGetInvocation: async () => ({ ok: true, skillPath: '/fixture/skills/SKILL.md', commandPrefix: 'fixture-cli' }),
+      },
+      addEventListener: events.addEventListener.bind(events), removeEventListener: events.removeEventListener.bind(events),
+      dispatchEvent: events.dispatchEvent.bind(events), setTimeout, clearTimeout,
+    },
+  };
+  for (const [key, value] of Object.entries(globals)) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { value, configurable: true, writable: true });
+  }
+  let result!: ToolAccessGuidanceState;
+  function Harness({ mode }: { mode: AIToolIntegrationMode }) { result = useToolAccessGuidanceState(mode); return null; }
+  let renderer!: ReactTestRenderer;
+  await act(async () => { renderer = create(<Harness mode="mcp" />); });
+  return {
+    requests, events, values, result: () => result,
+    skills: async () => { await act(async () => renderer.update(<Harness mode="skills" />)); },
+    close: async () => {
+      await act(async () => renderer.unmount());
+      for (const [key, value] of previous) { if (value) Object.defineProperty(globalThis, key, value); else Reflect.deleteProperty(globalThis, key); }
+    },
+  };
+}
+const status = (path: string) => ({ ok: true, enabled: true, state: 'running', launcherPath: path, discoveryPath: `${path}.json` });
+
+test('older MCP guidance response cannot overwrite a newer enable-state refresh', async () => {
+  const h = await harness();
+  try {
+    assert.equal(h.requests.length, 1);
+    await act(async () => { h.events.dispatchEvent(new CustomEvent(AI_STATE_CHANGED_EVENT, { detail: { key: STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } })); });
+    assert.equal(h.requests.length, 2);
+    await act(async () => h.requests[1].resolve(status('/fixture/new')));
+    assert.equal(h.result().mcpLauncherPath, '/fixture/new');
+    await act(async () => h.requests[0].resolve(status('/fixture/old')));
+    assert.equal(h.result().mcpLauncherPath, '/fixture/new');
+  } finally { await h.close(); }
+});
+
+test('switching to Skills ignores pending MCP results and preserves resolved Skills guidance', async () => {
+  const h = await harness();
+  try {
+    await h.skills();
+    await act(async () => h.requests[0].resolve(status('/fixture/stale')));
+    assert.equal(h.result().mcpLauncherPath, null);
+    assert.equal(h.result().skillPath, '/fixture/skills/SKILL.md');
+    assert.equal(h.result().commandPrefix, 'fixture-cli');
+  } finally { await h.close(); }
+});
+
+test('MCP guidance completion after unmount has no visible state or retry work', async () => {
+  const h = await harness();
+  const initial = h.result();
+  await h.close();
+  await act(async () => h.requests[0].resolve(status('/fixture/stale')));
+  assert.equal(h.result(), initial);
+});

application/state/useToolAccessGuidanceState.ts

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 import type { AIToolIntegrationMode } from '../../infrastructure/ai/types';
 import { STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } from '../../infrastructure/config/storageKeys';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
@@ -38,14 +38,15 @@ export type ToolAccessGuidanceState = {
  * runtime is still starting or after an idle shutdown).
  */
 export function useToolAccessGuidanceState(mode: AIToolIntegrationMode): ToolAccessGuidanceState {
+  const requestGeneration = useRef(0);
   const [skillPath, setSkillPath] = useState<string | null>(null);
   const [commandPrefix, setCommandPrefix] = useState('');
   const [mcpLauncherPath, setMcpLauncherPath] = useState<string | null>(null);
   const [mcpDiscoveryPath, setMcpDiscoveryPath] = useState<string | null>(null);
 
-  const refreshMcpStatus = useCallback(async (): Promise<string | null | undefined> => {
+  const refreshMcpStatus = useCallback(async (isCurrent: () => boolean): Promise<string | null | undefined> => {
     const status = await netcattyBridge.get()?.externalMcpGetStatus?.();
-    if (!status?.ok) return undefined;
+    if (!isCurrent() || !status?.ok) return undefined;
     // Do not trust `enabled` alone: the main process flips `enabled` before
     // host credentials are resolved and the discovery file is written, and it
     // keeps reporting the configured discovery/launcher paths while starting.
@@ -93,9 +94,11 @@ export function useToolAccessGuidanceState(mode: AIToolIntegrationMode): ToolAcc
 
     const refetch = async () => {
       if (cancelled) return;
+      const generation = ++requestGeneration.current;
+      const isCurrent = () => !cancelled && generation === requestGeneration.current;
       const storedEnabled = readExternalMcpStoredEnabled();
-      const readyLauncherPath = await refreshMcpStatus().catch(() => undefined);
-      if (cancelled) return;
+      const readyLauncherPath = await refreshMcpStatus(isCurrent).catch(() => undefined);
+      if (!isCurrent()) return;
       // The persisted switch is off but the status check failed: drop any
       // cached launcher/discovery paths. The stored credentials were revoked
       // by the disable, and falling through to the comparison below would see

application/state/useVaultState.shellHistory.test.ts

@@ -0,0 +1,63 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import React from "react";
+import { act, create, type ReactTestRenderer } from "react-test-renderer";
+import { JSDOM } from "jsdom";
+import { installBrowserLockFixture } from "../testSupport/browserLockFixture";
+import { STORAGE_KEY_SHELL_HISTORY } from "../../infrastructure/config/storageKeys";
+
+test("shell history append yields the input turn and persists merged entries", async () => {
+  const dom = new JSDOM("", { url: "http://localhost" });
+  const globals = ["window", "localStorage", "CustomEvent", "IS_REACT_ACT_ENVIRONMENT", "navigator"];
+  const previous = new Map(globals.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]));
+  Object.defineProperties(globalThis, {
+    window: { value: dom.window, configurable: true },
+    localStorage: { value: dom.window.localStorage, configurable: true },
+    CustomEvent: { value: dom.window.CustomEvent, configurable: true },
+    IS_REACT_ACT_ENVIRONMENT: { value: true, configurable: true },
+  });
+  installBrowserLockFixture();
+  const { useVaultState } = await import("./useVaultState");
+  let state: ReturnType<typeof useVaultState>;
+  let renderer: ReactTestRenderer | undefined;
+  const Probe = () => { state = useVaultState({ syncConnectionLogTerminalData: false }); return null; };
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    for (let attempt = 0; !state!.isInitialized && attempt < 50; attempt++) {
+      await act(async () => { await new Promise(resolve => setTimeout(resolve, 10)); });
+    }
+    assert.equal(state!.isInitialized, true);
+    const entry = { command: " echo hello ", hostId: "local", hostLabel: "Local", sessionId: "one" };
+    act(() => {
+      state!.addShellHistoryEntry(entry);
+      state!.addShellHistoryEntry({ ...entry, sessionId: "two" });
+      assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY), null);
+      assert.equal(state!.shellHistory.length, 0);
+    });
+    await act(async () => { await new Promise(resolve => setTimeout(resolve, 20)); });
+    const saved = JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY)!);
+    assert.equal(saved.length, 1);
+    assert.equal(saved[0].command, "echo hello");
+    assert.equal(saved[0].sessionId, "two");
+    assert.deepEqual(state!.shellHistory, saved);
+
+    for (const clear of [() => state!.clearShellHistory(), () => state!.clearAllCommandHistory()]) {
+      act(() => {
+        state!.addShellHistoryEntry(entry);
+        state!.addShellHistoryEntry({ ...entry, command: "another command" });
+        clear();
+      });
+      await act(async () => { await new Promise(resolve => setTimeout(resolve, 20)); });
+      assert.deepEqual(state!.shellHistory, []);
+      assert.deepEqual(JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY)!), []);
+    }
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    dom.window.close();
+    for (const key of globals) {
+      const descriptor = previous.get(key);
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

application/state/useVaultState.ts

@@ -317,6 +317,7 @@ export const useVaultState = (options?: UseVaultStateOptions) => {
   const [noteGroups, setNoteGroups] = useState<string[]>([]);
   const [knownHosts, setKnownHosts] = useState<KnownHost[]>([]);
   const [shellHistory, setShellHistory] = useState<ShellHistoryEntry[]>([]);
+  const shellHistoryGenerationRef = useRef(0);
   const [connectionLogs, setConnectionLogs] = useState<ConnectionLog[]>([]);
   const [managedSources, setManagedSources] = useState<ManagedSource[]>([]);
   const [groupConfigs, setGroupConfigs] = useState<GroupConfig[]>([]);
@@ -1445,19 +1446,25 @@ export const useVaultState = (options?: UseVaultStateOptions) => {
 
   const addShellHistoryEntry = useCallback(
     (entry: Omit<ShellHistoryEntry, "id" | "timestamp">) => {
-      setShellHistory((prev) => {
-        const updated = mergeGlobalHistoryOnAppend(prev, entry);
-        if (updated === prev) return prev;
-        // Persist immediately so crash between commit and layout effect cannot drop history.
-        // Store republish is also done in useLayoutEffect for load/storage-event paths.
-        localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, updated);
-        return updated;
-      });
+      const generation = shellHistoryGenerationRef.current;
+      // Yield the input turn before history rendering and synchronous storage work.
+      // Persist in the next task to keep the crash-loss window small.
+      setTimeout(() => {
+        if (generation !== shellHistoryGenerationRef.current) return;
+        setShellHistory((prev) => {
+          if (generation !== shellHistoryGenerationRef.current) return prev;
+          const updated = mergeGlobalHistoryOnAppend(prev, entry);
+          if (updated === prev) return prev;
+          localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, updated);
+          return updated;
+        });
+      }, 0);
     },
     [],
   );
 
   const clearShellHistory = useCallback(() => {
+    shellHistoryGenerationRef.current += 1;
     setShellHistory([]);
     localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, []);
     publishShellHistorySnapshot([]);

components/AIChatPanelContent.test.ts

@@ -40,3 +40,35 @@ test('terminal side panel tools share one primary toolbar height', () => {
     assert.match(source, /TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS/);
   }
 });
+
+test('/rename and /chats panel commands stay out of the agent message path', () => {
+  const sidePanel = preparingSource;
+  // Panel implements the commands with updateSessionTitle + a note state —
+  // never addMessageToSession, so the commands cannot leak into chat history.
+  assert.match(sidePanel, /handleRenameSession = useCallback/);
+  assert.match(sidePanel, /handleListChats = useCallback/);
+  assert.match(sidePanel, /updateSessionTitle\(sessionId, title\)/);
+  assert.match(sidePanel, /setPanelCommandNote\(formatAiChatsListingNote\(entries, t\)\)/);
+  const renameHandler = sidePanel.slice(
+    sidePanel.indexOf('handleRenameSession = useCallback'),
+    sidePanel.indexOf('const handleRenameSlashCommand'),
+  );
+  assert.doesNotMatch(renameHandler, /addMessageToSession/);
+  const chatsHandler = sidePanel.slice(
+    sidePanel.indexOf('handleListChats = useCallback'),
+    sidePanel.indexOf('const handleSend'),
+  );
+  assert.doesNotMatch(chatsHandler, /addMessageToSession/);
+  // Wiring reaches AIChatPanelContent.
+  assert.match(sidePanel, /onRenameActiveChat=\{handleRenameSlashCommand\}/);
+  assert.match(sidePanel, /onListChats=\{handleListChats\}/);
+});
+
+test('AIChatPanelContent renders the panel command note and wires rename/list props', () => {
+  assert.match(panelSource, /panelCommandNote \? \(/);
+  assert.match(panelSource, /role="status"/);
+  assert.match(panelSource, /onDismissPanelCommandNote/);
+  assert.match(panelSource, /onRenameSession=\{onRenameActiveChat\}/);
+  assert.match(panelSource, /onListChats=\{onListChats\}/);
+  assert.match(panelSource, /onRename=\{onRenameSession\}/);
+});

components/AIChatPanelContent.tsx

@@ -57,6 +57,20 @@ interface AIChatPanelContentProps {
   setInputValue: (value: string) => void;
   handleSend: () => void;
   handleCompact: () => void;
+  /** Rename a chat by id (history drawer edit affordance). Panel action, never agent content. */
+  onRenameSession?: (sessionId: string, title: string) => void;
+  /** `/rename <title>` for the current chat. Panel action, never agent content. */
+  onRenameActiveChat?: (title: string) => void;
+  /** `/chats`: list the chats visible to this panel. Panel action, never agent content. */
+  onListChats?: () => void;
+  /** `/rebind <n>`: rebind a dangling chat to this panel's scope. Panel action, never agent content. */
+  onRebindChat?: (arg: string) => void;
+  /** `/chats` listing output, rendered as a system-style note above the composer. */
+  panelCommandNote?: string | null;
+  onDismissPanelCommandNote?: () => void;
+  /** Manual durability escape hatch: export/import the whole session store. */
+  onExportSessions?: () => void;
+  onImportSessions?: () => void;
   /** Undo last turn is offered at a safe boundary (never mid-tool / mid-compaction). */
   canUndoLastTurn?: boolean;
   handleUndoLastTurn?: () => void;
@@ -142,6 +156,14 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
   setInputValue,
   handleSend,
   handleCompact,
+  onRenameSession,
+  onRenameActiveChat,
+  onListChats,
+  onRebindChat,
+  panelCommandNote,
+  onDismissPanelCommandNote,
+  onExportSessions,
+  onImportSessions,
   canUndoLastTurn = false,
   handleUndoLastTurn,
   canCompact = false,
@@ -309,6 +331,9 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
             activeSessionId={activeSessionId}
             onSelect={sending ? () => undefined : handleSelectSession}
             onDelete={handleDeleteSession}
+            onRename={onRenameSession}
+            onExportSessions={onExportSessions}
+            onImportSessions={onImportSessions}
             onClose={() => setShowHistory(false)}
           />
         </React.Profiler>
@@ -369,6 +394,21 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
           {!hideInput && (
             <React.Profiler {...getAIPanelProfilerProps('AIChatPanel.Input')}>
               <div>
+                {panelCommandNote ? (
+                  <div role="status" className="mx-3 mb-1.5 rounded-md border border-border/50 bg-muted/30 px-2.5 py-1.5 text-[11px] leading-4 text-muted-foreground">
+                    <span className="block max-h-48 overflow-y-auto whitespace-pre-wrap break-words">{panelCommandNote}</span>
+                    {onDismissPanelCommandNote && (
+                      <button
+                        type="button"
+                        aria-label={t('common.close')}
+                        onClick={onDismissPanelCommandNote}
+                        className="mt-1 text-[11px] text-muted-foreground/60 underline-offset-2 transition-colors hover:text-foreground hover:underline cursor-pointer"
+                      >
+                        {t('common.close')}
+                      </button>
+                    )}
+                  </div>
+                ) : null}
                 {steerWarning ? (
                   <div role="status" className="mx-3 mb-1.5 rounded-md border border-amber-500/25 bg-amber-500/10 px-2.5 py-1.5 text-[11px] leading-4 text-amber-600 dark:text-amber-400">
                     {steerWarning}
@@ -396,6 +436,9 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
                   onChange={setInputValue}
                   onSend={handleSend}
                   onCompact={handleCompact}
+                  onRenameSession={onRenameActiveChat}
+                  onListChats={onListChats}
+                  onRebindChat={onRebindChat}
                   canCompact={canCompact}
                   onSteer={handleSteer}
                   onStop={handleStop}

components/AIChatSessionHistoryDrawer.tsx

@@ -1,5 +1,5 @@
 import React, { useEffect, useId, useRef, useState } from 'react';
-import { Search, Trash2, X } from 'lucide-react';
+import { Download, Pencil, Search, Trash2, Upload, X } from 'lucide-react';
 import type { AISession } from '../infrastructure/ai/types';
 import { useI18n } from '../application/i18n/I18nProvider';
 import { cn } from '../lib/utils';
@@ -19,6 +19,12 @@ interface SessionHistoryDrawerProps {
   activeSessionId: string | null;
   onSelect: (sessionId: string) => void;
   onDelete: (e: React.MouseEvent, sessionId: string) => void;
+  /** Rename a chat inline (issue #4015 R5). Empty titles are ignored. */
+  onRename?: (sessionId: string, title: string) => void;
+  /** Manual durability escape hatch: export the whole store to a JSON file. */
+  onExportSessions?: () => void;
+  /** Import sessions from a JSON export; merges by id, newer wins. */
+  onImportSessions?: () => void;
   onClose: () => void;
 }
 
@@ -30,11 +36,17 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
   activeSessionId,
   onSelect,
   onDelete,
+  onRename,
+  onExportSessions,
+  onImportSessions,
   onClose,
 }) => {
   const { t } = useI18n();
   const [renderCount, setRenderCount] = useState(SESSION_RENDER_BATCH);
   const [searchQuery, setSearchQuery] = useState('');
+  const [renamingSessionId, setRenamingSessionId] = useState<string | null>(null);
+  const [renameDraft, setRenameDraft] = useState('');
+  const renameInputRef = useRef<HTMLInputElement>(null);
   const searchHintId = useId();
   const searchInputRef = useRef<HTMLInputElement>(null);
   const { filteredSessions, isSearching } = useSessionHistorySearch(
@@ -52,16 +64,69 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
   const displayedSessions = filteredSessions.slice(0, renderCount);
   const hiddenSessionCount = Math.max(0, filteredSessions.length - renderCount);
 
+  useEffect(() => {
+    if (renamingSessionId) renameInputRef.current?.focus();
+  }, [renamingSessionId]);
+
+  const beginRename = (sessionId: string, currentTitle: string) => {
+    setRenamingSessionId(sessionId);
+    setRenameDraft(currentTitle);
+  };
+
+  const commitRename = () => {
+    if (renamingSessionId && renameDraft.trim()) {
+      onRename?.(renamingSessionId, renameDraft.trim());
+    }
+    setRenamingSessionId(null);
+    setRenameDraft('');
+  };
+
   return (
     <div className="flex-1 flex flex-col min-h-0">
       <div className="px-4 py-2.5 flex items-center justify-between shrink-0 border-b border-border/30">
         <span className="text-[13px] font-medium text-foreground/80">{t('ai.chat.allSessions')}</span>
-        <button
-          onClick={onClose}
-          className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
-        >
-          <X size={14} />
-        </button>
+        <div className="flex items-center gap-2">
+          {onImportSessions && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onImportSessions();
+                  }}
+                  className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+                  aria-label={t('ai.chat.importSessions')}
+                >
+                  <Upload size={14} />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent>{t('ai.chat.importSessions')}</TooltipContent>
+            </Tooltip>
+          )}
+          {onExportSessions && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onExportSessions();
+                  }}
+                  className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+                  aria-label={t('ai.chat.exportSessions')}
+                >
+                  <Download size={14} />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent>{t('ai.chat.exportSessions')}</TooltipContent>
+            </Tooltip>
+          )}
+          <button
+            onClick={onClose}
+            className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+          >
+            <X size={14} />
+          </button>
+        </div>
       </div>
       <div className="px-3 py-2 shrink-0 border-b border-border/30">
         <div className="relative">
@@ -146,12 +211,52 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
                   )}
                 >
                   <span className={SESSION_HISTORY_ROW_CLASSNAMES.title}>
-                    {session.title || t('ai.chat.untitled')}
+                    {renamingSessionId === session.id ? (
+                      <Input
+                        ref={renameInputRef}
+                        type="text"
+                        value={renameDraft}
+                        aria-label={t('ai.chat.renameChat')}
+                        onClick={(e) => e.stopPropagation()}
+                        onKeyDown={(e) => {
+                          e.stopPropagation();
+                          if (e.key === 'Enter') {
+                            e.preventDefault();
+                            commitRename();
+                          } else if (e.key === 'Escape') {
+                            e.preventDefault();
+                            setRenamingSessionId(null);
+                            setRenameDraft('');
+                          }
+                        }}
+                        onChange={(e) => setRenameDraft(e.target.value)}
+                        onBlur={commitRename}
+                        className="h-6 text-[12px]"
+                      />
+                    ) : (
+                      session.title || t('ai.chat.untitled')
+                    )}
                   </span>
                   <div className={SESSION_HISTORY_ROW_CLASSNAMES.meta}>
                     <span className={SESSION_HISTORY_ROW_CLASSNAMES.time}>
                       {timeStr}
                     </span>
+                    {onRename && renamingSessionId !== session.id && (
+                      <Tooltip>
+                        <TooltipTrigger asChild>
+                          <button
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              beginRename(session.id, session.title || '');
+                            }}
+                            className={SESSION_HISTORY_ROW_CLASSNAMES.deleteButton}
+                          >
+                            <Pencil size={12} />
+                          </button>
+                        </TooltipTrigger>
+                        <TooltipContent>{t('ai.chat.renameChat')}</TooltipContent>
+                      </Tooltip>
+                    )}
                     <Tooltip>
                       <TooltipTrigger asChild>
                         <button

components/AIChatSidePanel.tsx

@@ -64,6 +64,7 @@ import {
   type DefaultTargetSessionHint,
 } from '../application/state/useAIChatStreaming';
 import { getScopedHistorySessions } from './ai/scopedHistorySessions';
+import { buildAiChatsListingEntries, canRebindChat, formatAiChatsListingNote, resolveRebindTargetFromArg, type AiChatsListingEntry } from './ai/aiChatsListing';
 import { resolveInheritedAIActiveSessionId } from '../domain/aiWorkspaceScopeInherit';
 import { resolveUndoLastTurnBoundary } from '../domain/aiUndoLastTurn';
 import { aiSessionIdSetEqual, exactScopeAISessionsEqual } from '../domain/aiSessionsForScope';
@@ -279,6 +280,9 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   undoLastTurnInSession,
   deleteSession,
   updateSessionTitle,
+  rebindSessionScope,
+  exportSessionsBackup,
+  importSessionsBackup,
   updateSessionExternalSessionId,
   addMessageToSession,
   updateLastMessage,
@@ -312,7 +316,9 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   scopeHostIds,
   scopeLabel,
   focusedSessionId,
+  workspaces = [],
   terminalSessions = [],
+  liveScopeTargetIds,
   resolveExecutorContext,
   isVisible = true,
   notes = [],
@@ -327,6 +333,11 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   const scopeKey = `${scopeType}:${scopeTargetId ?? ''}`;
 
   const [showHistory, setShowHistory] = useState(false);
+  // Inline system-style note above the composer (e.g. `/chats` listing).
+  // Panel-command output, never agent content.
+  const [panelCommandNote, setPanelCommandNote] = useState<string | null>(null);
+  // Entries of the last `/chats` listing; `/rebind <n>` resolves against them.
+  const lastChatsListingRef = useRef<AiChatsListingEntry[]>([]);
   const [isSending, setIsSending] = useState(false);
   // Undo-last-turn is still
   // running. Unlike the send flow this is not reflected in `isSending`, so it
@@ -484,6 +495,119 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   const activeSessionRef = useRef(activeSession);
   activeSessionRef.current = activeSession;
 
+  /** Rename a chat (slash command + history drawer affordance). Panel action: nothing is sent to the agent. */
+  const handleRenameSession = useCallback((sessionId: string, rawTitle: string) => {
+    const title = rawTitle.trim();
+    if (!title) {
+      toast.warning(t('ai.chat.renameUsage'));
+      return;
+    }
+    if (!sessionId) {
+      toast.warning(t('ai.chat.renameNoActive'));
+      return;
+    }
+    updateSessionTitle(sessionId, title);
+    toast.success(t('ai.chat.renameDone').replace('{title}', title));
+  }, [t, updateSessionTitle]);
+
+  const handleRenameSlashCommand = useCallback((title: string) => {
+    handleRenameSession(activeSessionRef.current?.id ?? null, title);
+  }, [handleRenameSession]);
+
+  const handleListChats = useCallback(() => {
+    // Prefer the app-wide live target set so chats bound to other still-open
+    // terminals are not mislabelled dangling / offered for /rebind.
+    const liveTerminalIds = liveScopeTargetIds
+      ?? (scopeType === 'workspace' && workspaceMemberTerminalIds
+        ? workspaceMemberTerminalIds
+        : new Set(scopeTargetId ? [scopeTargetId] : []));
+    // Dangling chats no longer match any live scope (rank 0), so they must be
+    // appended explicitly for the listing — that is where they become visible
+    // and rebindable again (issue #4015 R2).
+    const listedSessionIds = new Set(historySessions.map((session) => session.id));
+    const danglingSessions = sessions.filter((session) => session.scopeDangling && !listedSessionIds.has(session.id));
+    const entries = buildAiChatsListingEntries({
+      sessions: [...historySessions, ...danglingSessions],
+      activeSessionId,
+      externalAgents,
+      workspaces,
+      liveTerminalIds,
+      currentScopeLabel: scopeLabel,
+      scopeTargetId,
+      t,
+    });
+    lastChatsListingRef.current = entries;
+    setPanelCommandNote(formatAiChatsListingNote(entries, t));
+  }, [activeSessionId, externalAgents, historySessions, liveScopeTargetIds, scopeLabel, scopeTargetId, scopeType, sessions, t, workspaces, workspaceMemberTerminalIds]);
+
+  // `/rebind <n>`: rebind the nth dangling chat from the last /chats listing
+  // to this panel's current scope. Panel action — no agent round-trip.
+  const handleRebindChat = useCallback((arg: string) => {
+    if (!scopeTargetId) {
+      toast.warning(t('ai.chat.rebindUnavailable'));
+      return;
+    }
+    const target = resolveRebindTargetFromArg(arg, lastChatsListingRef.current);
+    if (!target) {
+      toast.warning(t('ai.chat.rebindUsage'));
+      return;
+    }
+    const session = sessions.find((item) => item.id === target.sessionId);
+    const liveTargets = new Set(liveScopeTargetIds ?? workspaceMemberTerminalIds ?? []);
+    for (const workspace of workspaces) liveTargets.add(workspace.id);
+    liveTargets.add(scopeTargetId);
+    if (canRebindChat(session, liveTargets)) {
+      rebindSessionScope?.(target.sessionId, { type: scopeType, targetId: scopeTargetId, hostIds: scopeHostIds });
+      toast.success(t('ai.chat.rebindDone').replace('{title}', target.title));
+    } else {
+      toast.warning(t('ai.chat.rebindUsage'));
+    }
+    // Do not rebuild /chats from this render's stale sessions (still dangling).
+    // Drop the resolved entry from the stored listing so a repeat /rebind <n>
+    // cannot target it; the next explicit /chats refreshes from live state.
+    const remaining = lastChatsListingRef.current.filter(
+      (entry) => entry.sessionId !== target.sessionId,
+    );
+    let danglingCounter = 0;
+    for (const entry of remaining) {
+      if (!entry.isDangling) {
+        entry.rebindNumber = undefined;
+        continue;
+      }
+      danglingCounter += 1;
+      entry.rebindNumber = danglingCounter;
+    }
+    lastChatsListingRef.current = remaining;
+    setPanelCommandNote(formatAiChatsListingNote(remaining, t));
+  }, [liveScopeTargetIds, rebindSessionScope, scopeHostIds, scopeTargetId, scopeType, sessions, t, workspaces, workspaceMemberTerminalIds]);
+
+  // Manual durability actions (history drawer header). Export writes the
+  // whole store to a user-chosen JSON file; import merges by id.
+  const handleExportSessions = useCallback(() => {
+    void exportSessionsBackup?.().then((filePath) => {
+      if (filePath == null) {
+        toast.warning(t('ai.chat.exportUnavailable'));
+        return;
+      }
+      toast.success(
+        filePath
+          ? t('ai.chat.exportDone').replace('{path}', filePath)
+          : t('ai.chat.exportDoneNoPath'),
+      );
+    });
+  }, [exportSessionsBackup, t]);
+
+  const handleImportSessions = useCallback(() => {
+    void importSessionsBackup?.().then((count) => {
+      if (count <= 0) {
+        toast.warning(t('ai.chat.importNone'));
+        return;
+      }
+      toast.success(t('ai.chat.importDone').replace('{n}', String(count)));
+    });
+  }, [importSessionsBackup, t]);
+
+
   const defaultTargetSession = useMemo<DefaultTargetSessionHint | undefined>(() => {
     const connectedSessions = terminalSessions.filter((session) => session.connected !== false);
 
@@ -2065,6 +2189,14 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
         setInputValue={setInputValue}
         handleSend={handleSend}
         handleCompact={handleCompact}
+        onRenameSession={handleRenameSession}
+        onRenameActiveChat={handleRenameSlashCommand}
+        onListChats={handleListChats}
+        onRebindChat={handleRebindChat}
+        panelCommandNote={panelCommandNote}
+        onDismissPanelCommandNote={() => setPanelCommandNote(null)}
+        onExportSessions={handleExportSessions}
+        onImportSessions={handleImportSessions}
         canUndoLastTurn={canUndoLastTurn}
         handleUndoLastTurn={undoLastTurnInSession ? handleUndoLastTurn : undefined}
         handleSteer={handleSteer}
@@ -2143,6 +2275,9 @@ const AI_CHAT_SIDE_PANEL_AI_STATE_KEYS = [
   'createSession',
   'deleteSession',
   'updateSessionTitle',
+  'rebindSessionScope',
+  'exportSessionsBackup',
+  'importSessionsBackup',
   'updateSessionExternalSessionId',
   'addMessageToSession',
   'updateLastMessage',
@@ -2193,6 +2328,8 @@ export function aiChatSidePanelPropsAreEqual(
   if ((prev.isVisible ?? true) !== (next.isVisible ?? true)) return false;
   if (prev.scopeHostIds !== next.scopeHostIds) return false;
   if (prev.terminalSessions !== next.terminalSessions) return false;
+  if (prev.liveScopeTargetIds !== next.liveScopeTargetIds) return false;
+  if (prev.workspaces !== next.workspaces) return false;
   if (prev.resolveExecutorContext !== next.resolveExecutorContext) return false;
   if (prev.notes !== next.notes) return false;
   if (prev.hosts !== next.hosts) return false;

components/AIChatSidePanel.types.ts

@@ -44,6 +44,12 @@ export interface AIChatSidePanelProps {
   ) => Promise<{ sessionId: string; restored: { text: string; attachments: import('../infrastructure/ai/types').UploadedFile[]; selectedUserSkillSlugs: string[] } } | null>;
   deleteSession: (sessionId: string, scopeKey?: string) => void;
   updateSessionTitle: (sessionId: string, title: string) => void;
+  /** Issue #4015 R2: rebind a dangling chat to this panel's scope (panel action, never agent content). */
+  rebindSessionScope?: (sessionId: string, scope: { type: 'terminal' | 'workspace'; targetId: string; hostIds?: string[] }) => void;
+  /** Manual durability escape hatch: export the store to a JSON file (returns the path, '' when fixed-path). */
+  exportSessionsBackup?: () => Promise<string | null>;
+  /** Import sessions from a JSON export; merges by id. Returns the imported count. */
+  importSessionsBackup?: () => Promise<number>;
   updateSessionExternalSessionId: (sessionId: string, externalSessionId: string | undefined) => void;
   addMessageToSession: (sessionId: string, message: ChatMessage) => void;
   updateLastMessage: (
@@ -103,6 +109,10 @@ export interface AIChatSidePanelProps {
   scopeLabel?: string;
   /** Workspace focused pane; preferred when inheriting AI chat after merge. */
   focusedSessionId?: string;
+  /** Live workspaces, used to resolve workspace titles for `/chats`. */
+  workspaces?: Array<{ id: string; title: string }>;
+  /** All currently live terminal (and workspace) scope target ids. */
+  liveScopeTargetIds?: Set<string>;
 
   // Terminal session context (from parent)
   terminalSessions?: Array<{

components/PluginAIContextHost.test.tsx

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 
-test('default host adapter, real preload, mounted host chooser and installed assistant reach only the local fixture', { timeout: 20_000 }, async () => {
+test('cold plugin host reaches the local fixture through the actual main provider allowlist without the AI sidebar', { timeout: 20_000 }, async (t) => {
   // JSDOM + the in-process runtime prove app wiring; they are not native sandbox
   // evidence. All state is synthetic, with no real provider, key, Note or host.
   const rootPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -42,15 +42,40 @@ test('default host adapter, real preload, mounted host chooser and installed ass
   const { inProcessBrowserRuntime } = require('../electron/plugins/fixtures/inProcessBrowserRuntime.cjs');
   const { createPreloadApi } = require('../electron/preload/api.cjs');
   const aiBridge = require('../electron/bridges/aiBridge.cjs');
+  const { registerProviderHandlers } = require('../electron/bridges/aiBridge/providerHandlers.cjs');
   const { server, counts } = createAssistantProviderFixture({ delayMs: 25 });
   const oldNotes = getNotesSnapshot(); const oldLock = getAppAppLockRuntime();
   let service: ReturnType<typeof createPluginHostService> | undefined;
   let panel: JSDOM | undefined;
   const root = createRoot(document.getElementById('root')!);
-  let locked = false; let contentAllowed = false; let reviewAllowed = false;
+  let locked = false; let contentAllowed = false;
   const lockListeners = new Set<(state: { locked: boolean }) => void>();
   const reviews: Array<Record<string, unknown>> = [];
   const trustedPayloads: unknown[] = [];
+  const streamResults: Array<{ ok: boolean; statusCode?: number; allowlistRejected: boolean }> = [];
+  const providerSyncs: Array<{ count: number; selectedPresent: boolean }> = [];
+  const sdkErrorNames: string[] = [];
+  let diagnosticPhase = 'setup';
+  const originalConsoleError = console.error;
+  // node:sqlite was imported above. Node 22 delivers its ExperimentalWarning
+  // asynchronously through console.error. Let module warnings reach normal
+  // stderr before observing SDK/renderer errors; do not suppress that warning.
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  // The expected pre-fix SDK error contains request details. Keep diagnostics
+  // categorical even on the failing-before path; never print payloads/headers.
+  console.error = (value: unknown) => {
+    let category = 'unknown';
+    if (typeof value === 'string' && /not wrapped in act/.test(value)) category = 'react-act-warning';
+    else if (typeof value === 'string' && /act.*environment|environment.*act/.test(value)) category = 'react-act-environment';
+    else if (typeof value === 'string' && /ExperimentalWarning: SQLite is an experimental feature/.test(value)) category = 'node-sqlite-experimental';
+    else if (typeof value === 'string') category = 'other-string';
+    else if (value && typeof value === 'object') {
+      const name = (value as { name?: unknown }).name;
+      if (typeof name === 'string' && ['AbortError', 'AI_APICallError', 'AI_LoadAPIKeyError', 'TypeError', 'Error'].includes(name)) category = name;
+    }
+    sdkErrorNames.push(`${diagnosticPhase}:${category}`);
+  };
+  t.after(() => { console.error = originalConsoleError; });
   try {
     server.listen(0, '127.0.0.1'); await once(server, 'listening');
     const address = server.address(); assert.ok(address && typeof address !== 'string');
@@ -62,25 +87,50 @@ test('default host adapter, real preload, mounted host chooser and installed ass
       ipcRenderer.emit(channel, {}, structuredClone(payload));
     } });
     const mainWindow = Object.assign(new EventEmitter(), { webContents: sender, isDestroyed: () => false, isVisible: () => true, isFocused: () => true });
+    const providerContext = {
+      ipcMain: { handle: (channel: string, handler: (...args: unknown[]) => unknown) => ipcHandlers.set(channel, handler) },
+      providerConfigs: [] as Array<{ id: string; baseURL?: string; apiKey?: string }>, webSearchApiHost: null,
+      validateSender: (event: { sender: unknown }) => event.sender === sender,
+      validateSenderOrSettings: (event: { sender: unknown }) => event.sender === sender,
+      // Only credential injection is synthetic. Admission, sync and the HTTP
+      // transport are the production implementations, not a direct-fetch seam.
+      injectApiKeyIntoRequest: (url: string, headers: Record<string, string>, providerId: string) => {
+        const config = providerContext.providerConfigs.find((item) => item.id === providerId);
+        return { url, headers: Object.fromEntries(Object.entries(headers).map(([key, value]) =>
+          [key, config?.apiKey ? value.replace('__IPC_SECURED__', config.apiKey) : value])) };
+      },
+      shouldSkipTLSVerify: () => false,
+      streamRequest: aiBridge._streamRequestForTests,
+    };
+    registerProviderHandlers(providerContext);
+    assert.equal(providerContext.providerConfigs.length, 0);
     ipcRenderer.invoke = async (channel, payload) => {
       if (channel === 'netcatty:ai:chat:stream') {
         const request = payload as { url: string; headers: Record<string, string>; body: string; requestId: string };
         assert.equal(new URL(request.url).origin, new URL(endpoint).origin);
         assert.doesNotMatch(JSON.stringify(request), /fixture-only/);
-        const status = await aiBridge._streamRequestForTests(request.url, { headers: request.headers, body: request.body }, { sender }, request.requestId, false);
-        return { ok: status.statusCode === 200, ...status };
       }
       if (channel === 'netcatty:ai:chat:cancel') return aiBridge.cancelPluginAIStreamsForSender(sender) > 0;
       const handler = ipcHandlers.get(channel);
       assert.ok(handler, `Unexpected trusted IPC: ${channel}`);
-      return handler({ sender }, structuredClone(payload));
+      const result = await handler({ sender }, structuredClone(payload));
+      if (channel === 'netcatty:ai:sync-providers') providerSyncs.push({ count: providerContext.providerConfigs.length,
+        selectedPresent: providerContext.providerConfigs.some((item) => item.id === 'qa-provider') });
+      if (channel === 'netcatty:ai:chat:stream') {
+        const status = result as { ok: boolean; statusCode?: number; error?: string };
+        streamResults.push({ ok: status.ok, statusCode: status.statusCode, allowlistRejected: status.error === 'URL host is not in the allowed list' });
+      }
+      return result;
     };
     const api = createPreloadApi({ ipcRenderer, webUtils: {} });
     Object.defineProperty(dom.window, 'netcatty', { value: api });
     const syntheticNote = { id: 'synthetic-note', title: 'Synthetic retry plan', content: 'Synthetic retry plan: add a retry button.', createdAt: 1, updatedAt: 1 };
     publishNotesSnapshot({ notes: [syntheticNote], noteGroups: [] });
     registerAppAppLockRuntime({ locked: false } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
-    dom.window.localStorage.setItem(STORAGE_KEY_AI_PROVIDERS, JSON.stringify([{ id: 'qa-provider', name: 'QA fixture', providerId: 'custom', enabled: true, baseURL: endpoint, defaultModel: 'deterministic-fixture', apiKey: 'fixture-only' }]));
+    dom.window.localStorage.setItem(STORAGE_KEY_AI_PROVIDERS, JSON.stringify([
+      { id: 'qa-provider', name: 'QA fixture', providerId: 'custom', enabled: true, baseURL: endpoint, defaultModel: 'deterministic-fixture', apiKey: 'fixture-only' },
+      { id: 'qa-secondary', name: 'Synthetic secondary', providerId: 'custom', enabled: true, baseURL: 'https://secondary.invalid/v1', defaultModel: 'synthetic', apiKey: 'secondary-fixture-marker' },
+    ]));
     dom.window.localStorage.setItem(STORAGE_KEY_AI_ACTIVE_PROVIDER, 'qa-provider');
     dom.window.localStorage.setItem(STORAGE_KEY_AI_ACTIVE_MODEL, 'deterministic-fixture');
     service = createPluginHostService({
@@ -88,8 +138,8 @@ test('default host adapter, real preload, mounted host chooser and installed ass
       getInteractionWindow: () => mainWindow, isAppLocked: () => locked,
       subscribeAppLock: (listener: (state: { locked: boolean }) => void) => { lockListeners.add(listener); return () => lockListeners.delete(listener); },
       electron: { ipcMain: { handle: (name: string, handler: (...args: unknown[]) => unknown) => ipcHandlers.set(name, handler), removeHandler: (name: string) => ipcHandlers.delete(name) },
-        dialog: { showMessageBox: async (_window: unknown, options: Record<string, unknown>) => { reviews.push(options); return { response: reviewAllowed ? 0 : 1 }; } } },
-      requestPermissionDecision: async (request: { requestId: string; permission: string }) => request.permission === 'context.selected.read' && !contentAllowed
+        dialog: { showMessageBox: async (_window: unknown, options: Record<string, unknown>) => { reviews.push(options); return { response: 1 }; } } },
+      requestPermissionDecision: async (request: { requestId: string; permission: string; relatedPermissions?: Array<{ permission: string }> }) => (request.permission === 'context.selected.read' || request.relatedPermissions?.some((item) => item.permission === 'context.selected.read')) && !contentAllowed
         ? { requestId: request.requestId, decision: 'deny' }
         : { requestId: request.requestId, decision: 'allow', scope: request.permission === 'context.selected.read' ? 'once' : 'application' },
     });
@@ -101,6 +151,7 @@ test('default host adapter, real preload, mounted host chooser and installed ass
     fs.copyFileSync(path.join(sample, 'src/index.js'), path.join(staging, 'dist/index.js'));
     const { buildPluginPackage } = await import('@netcatty/plugin-cli');
     const archive = path.join(fixtureRoot, 'assistant.ncpkg'); await buildPluginPackage(staging, archive);
+    service.database.setPermissionMode('com.netcatty.assistant', 'context.selected.read', 'ask');
     await service.manager.install(archive, { enable: true });
     await act(async () => root.render(<I18nProvider locale="en"><PluginAIContextHost sessions={[]} workspaces={[]} /></I18nProvider>));
     const waitFor = async (condition: () => boolean) => {
@@ -115,6 +166,7 @@ test('default host adapter, real preload, mounted host chooser and installed ass
       executeCommand: async (command: string, args: unknown) => structuredClone(await service!.contributionService.executeCommand(command, structuredClone(args))),
       onDidReceiveMessage: () => ({ dispose() {} }),
     } });
+    diagnosticPhase = 'initial-selection';
     await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
     await waitFor(() => document.getElementById('plugin-ai-note') !== null);
     const noteChoice = document.getElementById('plugin-ai-note') as HTMLSelectElement;
@@ -128,27 +180,36 @@ test('default host adapter, real preload, mounted host chooser and installed ass
     assert.equal(reference.value, ''); assert.equal(reference.options.length, 2);
     assert.notEqual(reference.options[1].value, syntheticNote.id); reference.value = reference.options[1].value;
     const send = () => element('compose').dispatchEvent(new panel!.window.Event('submit', { cancelable: true }));
+    diagnosticPhase = 'deny-content';
     send(); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
     assert.equal(counts.requests, 0); assert.equal(reviews.length, 0);
     contentAllowed = true;
-    send(); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
-    assert.equal(counts.requests, 0); assert.equal(reviews.length, 1);
-    assert.equal(reviews[0].defaultId, reviews[0].cancelId); assert.match(String(reviews[0].detail), /Synthetic retry plan: add a retry button/);
-    reviewAllowed = true;
-    send(); await waitFor(() => element('status').textContent === 'Complete');
+    diagnosticPhase = 'complete-stream';
+    send(); await waitFor(() => counts.completed === 1 || streamResults.some((result) => !result.ok));
+    assert.deepEqual(streamResults.at(-1), { ok: true, statusCode: 200, allowlistRejected: false },
+      'Cold plugin startup must synchronize host providers before the main allowlist admits transport');
+    assert.ok(providerSyncs.some((sync) => sync.selectedPresent && sync.count === 2), 'Preserve other host-configured providers in the shared registry');
+    await waitFor(() => element('status').textContent === 'Complete');
+    assert.equal(reviews.length, 0, 'content policy must not open a second native sharing review');
     assert.equal(counts.completed, 1); assert.match(element('response').textContent!, /Synthetic plan/); assert.match(element('usage').textContent!, /12 input tokens/);
+    diagnosticPhase = 'stop-stream';
     send(); await waitFor(() => element('response').textContent!.startsWith('Synthetic plan: '));
     element('stop').dispatchEvent(new panel.window.Event('click'));
     await waitFor(() => element('status').textContent === 'Stopped' && counts.aborted === 1);
     const stoppedText = element('response').textContent; await new Promise((resolve) => setTimeout(resolve, 50)); assert.equal(element('response').textContent, stoppedText);
+    diagnosticPhase = 'lock-stream';
     send(); await waitFor(() => element('response').textContent!.startsWith('Synthetic plan: '));
     locked = true; registerAppAppLockRuntime({ locked: true } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
     for (const listener of lockListeners) listener({ locked: true });
     await waitFor(() => counts.aborted === 2 && service!.aiContextService.broker.turns.size === 0);
     assert.equal(aiBridge._getActiveStreamCountForTests(), 0);
-    assert.doesNotMatch(JSON.stringify(trustedPayloads), /fixture-only|apiKey|privateOwner|permissionMode|mcp/);
+    assert.doesNotMatch(JSON.stringify(trustedPayloads), /fixture-only|secondary-fixture-marker|apiKey|privateOwner|permissionMode|mcp/);
+    assert.deepEqual(sdkErrorNames, []);
   } finally {
-    panel?.window.close();
+    console.error = originalConsoleError;
+    // JSDOM.close does not deliver the browser pagehide lifecycle. Invalidate
+    // the sample's pending callbacks before teardown closes its document.
+    if (panel) { panel.window.dispatchEvent(new panel.window.Event('pagehide')); panel.window.close(); }
     await act(async () => root.unmount());
     await service?.manager.shutdown(); aiBridge.cleanup();
     publishNotesSnapshot(oldNotes); registerAppAppLockRuntime(oldLock);

components/PluginGlobalAgentHost.test.tsx

@@ -0,0 +1,193 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JSDOM } from 'jsdom';
+import { createRequire } from 'node:module';
+import { EventEmitter, once } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+test('installed global Chat UI reuses actual Catty runtime, configured HTTP transport and selected worker dispatch', { timeout: 30_000 }, async () => {
+  // This Node/JSDOM harness proves installed app wiring, not a native sandbox or
+  // real model/Claude acceptance. No real shell, remote host or credentials.
+  const rootPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'netcatty-global-agent-ui-'));
+  const oldTmp = process.env.TMPDIR; process.env.TMPDIR = directory;
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => { previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value }); };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'HTMLSelectElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'DocumentFragment']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('localStorage', dom.window.localStorage); install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window)); install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window)); install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react'); const { createRoot } = await import('react-dom/client');
+  const { PluginAgentHost } = await import('./plugins/PluginAgentHost');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { registerAppAppLockRuntime, getAppAppLockRuntime } = await import('../application/state/appRuntimeBridge');
+  const keys = await import('../infrastructure/config/storageKeys');
+  const { createGlobalAgentProviderFixture } = await import('../scripts/plugin-global-agent-provider-fixture.mjs');
+  const { createPluginHostService } = require('../electron/plugins/hostService.cjs');
+  const { inProcessBrowserRuntime } = require('../electron/plugins/fixtures/inProcessBrowserRuntime.cjs');
+  const { createPreloadApi } = require('../electron/preload/api.cjs');
+  const { registerProviderHandlers } = require('../electron/bridges/aiBridge/providerHandlers.cjs');
+  const { registerCattyExecHandlers } = require('../electron/bridges/aiBridge/cattyExecHandlers.cjs');
+  const { registerAgentProcessHandlers } = require('../electron/bridges/aiBridge/agentProcessHandlers.cjs');
+  const { registerPrivacyHandlers } = require('../electron/bridges/aiBridge/privacyHandlers.cjs');
+  const aiBridge = require('../electron/bridges/aiBridge.cjs'); const mcp = require('../electron/bridges/mcpServerBridge.cjs');
+  const privacy = require('../electron/shared/aiPrivacyService.cjs');
+  const { server, counts } = createGlobalAgentProviderFixture({ delayMs: 30 });
+  const oldLock = getAppAppLockRuntime(); const root = createRoot(document.getElementById('root')!);
+  let service: ReturnType<typeof createPluginHostService> | undefined; let panel: JSDOM | undefined;
+  const errors: string[] = []; const originalError = console.error;
+  let phase = 'setup';
+  // Flush the known Node sqlite import warning before observing safe categories.
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  console.error = (value: unknown) => { errors.push(`${phase}:${typeof value === 'string' && value === '[Plugin Agent] Turn unavailable' ? 'DELEGATED_TURN_UNAVAILABLE' : typeof value === 'string' && /not wrapped in act/.test(value) ? 'REACT_ACT_WARNING' : 'SDK_OR_RENDERER_ERROR'}`); };
+  try {
+    privacy.configure({ enabled: false }); server.listen(0, '127.0.0.1'); await once(server, 'listening');
+    const address = server.address(); assert.ok(address && typeof address !== 'string'); const endpoint = `http://127.0.0.1:${address.port}/v1`;
+    const handlers = new Map<string, (...args: unknown[]) => unknown>();
+    const ipcMain = { handle: (name: string, handler: (...args: unknown[]) => unknown) => handlers.set(name, handler), removeHandler: (name: string) => handlers.delete(name) };
+    const ipcRenderer = new EventEmitter() as EventEmitter & { invoke: (channel: string, payload: unknown) => Promise<unknown> };
+    const trustedReplies: unknown[] = []; const pluginReplies: unknown[] = []; const workerCalls: string[] = [];
+    const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false, send: (channel: string, payload: unknown) => ipcRenderer.emit(channel, {}, structuredClone(payload)) });
+    const mainWindow = Object.assign(new EventEmitter(), { webContents: sender, isDestroyed: () => false, isVisible: () => true, isFocused: () => true });
+    const owner = (id: string) => id === 'synthetic-a' ? 7 : id === 'synthetic-b' ? 8 : null;
+    const worker = { getSessionOwnerWebContentsId: owner, getPluginSessionBinding: (id: string, actual: number) => actual === owner(id) ? { epoch: 'fixture-worker', generation: id === 'synthetic-a' ? 1 : 2 } : null,
+      send: () => {}, request: async (method: string, payload: { sessionId: string }, options?: { beforeExecute?: () => void }) => {
+        options?.beforeExecute?.(); if (method === 'netcatty:ai:exec') { workerCalls.push(payload.sessionId); return { ok: true, stdout: 'Synthetic worker output', stderr: '', exitCode: 0 }; } return [];
+      } };
+    mcp.init({ sessions: new Map(), terminalWorkerManager: worker, cliDiscoveryFilePath: path.join(directory, 'discovery.json') }); mcp.setPermissionMode('observer');
+    const common = { ipcMain, validateSender: (event: { sender: unknown }) => event.sender === sender,
+      validateSenderOrSettings: (event: { sender: unknown }) => event.sender === sender, mcpServerBridge: mcp, aiPrivacyService: privacy };
+    const providerContext = { ...common, require: createRequire(path.join(rootPath, 'electron/bridges/aiBridge.cjs')),
+      providerConfigs: [] as Array<{ id: string; baseURL?: string; apiKey?: string }>, webSearchApiHost: null,
+      injectApiKeyIntoRequest: (url: string, headers: Record<string, string>, providerId: string) => {
+        const provider = providerContext.providerConfigs.find((entry) => entry.id === providerId);
+        return { url, headers: Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, value.replace('__IPC_SECURED__', provider?.apiKey ?? '')])) };
+      }, shouldSkipTLSVerify: () => false, streamRequest: aiBridge._streamRequestForTests,
+      // The production stream function owns this map. Turn release below uses
+      // its actual main lease; direct SDK abort still calls the ordinary route.
+      activeStreams: new Map() };
+    registerProviderHandlers(providerContext); registerCattyExecHandlers(common); registerAgentProcessHandlers(common); registerPrivacyHandlers(common);
+    ipcRenderer.invoke = async (channel, payload) => {
+      if (channel === 'netcatty:ai:chat:stream') {
+        const request = payload as { requestId: string; url: string }; assert.equal(new URL(request.url).origin, new URL(endpoint).origin);
+        assert.match(request.requestId, /^agent-model_/);
+      }
+      const handler = handlers.get(channel); assert.ok(handler, `Unexpected trusted IPC: ${channel}`);
+      const result = await handler({ sender }, structuredClone(payload));
+      if (channel === 'netcatty:plugins:agent-host-response') trustedReplies.push(payload);
+      return result;
+    };
+    const api = createPreloadApi({ ipcRenderer, webUtils: {} }); Object.defineProperty(dom.window, 'netcatty', { value: api });
+    registerAppAppLockRuntime({ locked: false } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_PROVIDERS, JSON.stringify([{ id: 'fixture-provider', name: 'Synthetic fixture', providerId: 'custom', enabled: true,
+      baseURL: endpoint, defaultModel: 'global-agent-fixture', apiKey: 'FIXTURE_ONLY_API_MARKER' }]));
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_ACTIVE_PROVIDER, 'fixture-provider');
+    service = createPluginHostService({ app: { getAppPath: () => rootPath, getPath: () => directory, getVersion: () => '0.0.0' }, env: {},
+      electron: { ipcMain }, getInteractionWindow: () => mainWindow, isAppLocked: () => false, getTerminalWorkerManager: () => worker });
+    service.runtimeSupervisor.runtimeFactories.browser = inProcessBrowserRuntime; await service.manager.initialize();
+    const sample = path.join(rootPath, 'examples/plugins/global-agent'); const staging = path.join(directory, 'package'); fs.mkdirSync(path.join(staging, 'dist'), { recursive: true });
+    for (const file of ['netcatty.plugin.json', 'panel.html', 'panel.css', 'panel.js', 'README.md']) fs.copyFileSync(path.join(sample, file), path.join(staging, file));
+    fs.copyFileSync(path.join(sample, 'src/index.js'), path.join(staging, 'dist/index.js'));
+    const { buildPluginPackage } = await import('@netcatty/plugin-cli'); const archive = path.join(directory, 'global-agent.ncpkg'); await buildPluginPackage(staging, archive);
+    await service.manager.install(archive, { enable: true });
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAgentHost sessions={[
+      { id: 'synthetic-a', hostId: 'host-a', hostLabel: 'Workspace A fixture', hostname: 'a.invalid', username: 'fixture', status: 'connected' },
+      { id: 'synthetic-b', hostId: 'host-b', hostLabel: 'Workspace B fixture', hostname: 'b.invalid', username: 'fixture', status: 'connected' },
+    ]} /></I18nProvider>));
+    const waitFor = async (condition: () => boolean) => { const until = Date.now() + 8_000; while (!condition()) {
+      if (Date.now() >= until) throw Error(`Global Agent UI fixture timed out; accepted=${counts.requests}, rejected=${counts.rejected}, effects=${workerCalls.length}, status=${panel?.window.document.getElementById('status')?.textContent}`);
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 5)); });
+    } };
+    let viewOpen = true;
+    const mountPanel = async () => {
+      panel = new JSDOM(fs.readFileSync(path.join(sample, 'panel.html'), 'utf8'), { runScripts: 'outside-only' });
+      Object.defineProperty(panel.window, 'netcattyView', { value: { executeCommand: async (name: string, params: unknown) => {
+        // PluginViewHost.close removes sender authority before WebContents
+        // closes. A pagehide RPC cannot be relied on to reach this relay.
+        if (!viewOpen) throw Error('Untrusted plugin view sender');
+        const result = structuredClone(await service!.contributionService.executeCommand(name, structuredClone(params))); pluginReplies.push(result); return result;
+      }, onDidReceiveMessage: () => ({ dispose() {} }), onDidChangeEnvironment: () => ({ dispose() {} }) } });
+      await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
+    };
+    await mountPanel();
+    const element = (id: string) => panel!.window.document.getElementById(id)!;
+    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { for (const checkbox of document.querySelectorAll<HTMLInputElement>('input[type="checkbox"]')) checkbox.click(); });
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click()); await waitFor(() => element('status').textContent!.startsWith('Ready'));
+    let prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic selected-target task';
+    const send = () => element('compose').dispatchEvent(new panel!.window.Event('submit', { cancelable: true }));
+    phase = 'complete'; await act(async () => { send(); }); await waitFor(() => element('status').textContent === 'Complete');
+    assert.deepEqual(workerCalls, ['synthetic-b']); assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
+    assert.equal(mcp.getPermissionMode(), 'observer'); assert.equal(counts.requests, 2); assert.equal(counts.rejected, 0);
+    assert.match(element('usage').textContent!, /input tokens/);
+    phase = 'stop'; prompt.value = 'fixture:wait'; await act(async () => { send(); });
+    await waitFor(() => element('transcript').textContent!.includes('Synthetic waiting output'));
+    await act(async () => element('stop').click()); await waitFor(() => element('status').textContent === 'Stopped' && counts.aborted === 1);
+    const stopped = element('transcript').textContent; await new Promise((resolve) => setTimeout(resolve, 75)); assert.equal(element('transcript').textContent, stopped);
+    phase = 'modal-reopen-history';
+    const reference = pluginReplies.find((value) => value && typeof value === 'object' && 'conversationRef' in value && 'chatHandle' in value) as { conversationRef: string };
+    const beforeReopen = counts.requests;
+    viewOpen = false;
+    panel!.window.dispatchEvent(new panel!.window.Event('pagehide')); panel!.window.close();
+    viewOpen = true; await mountPanel();
+    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    (element('conversation') as HTMLSelectElement).value = reference.conversationRef;
+    await act(async () => element('conversation').dispatchEvent(new panel!.window.Event('change')));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click());
+    await waitFor(() => /^(Ready|Conversation unavailable)/.test(element('status').textContent!));
+    assert.match(element('status').textContent!, /^Ready/, 'ordinary modal reopen must release the prior exact chat even if pagehide cleanup never reaches the plugin');
+    assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
+    assert.equal(service.agentService.chats.size, 1); assert.equal(counts.requests, beforeReopen, 'history reopen does not invoke a model');
+    prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic continuation';
+    phase = 'deny'; const before = counts.requests; const plugin = service.database.getActivePlugin('com.netcatty.globalagent');
+    service.permissionEngine.setMode(plugin, 'ai.agent.actions', 'deny', service.permissionEngine.getPolicyRevision(plugin));
+    await act(async () => { send(); }); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
+    assert.equal(counts.requests, before); assert.deepEqual(workerCalls, ['synthetic-b']);
+    phase = 'restart-history';
+    await service.manager.setEnabled('com.netcatty.globalagent', false);
+    await service.manager.setEnabled('com.netcatty.globalagent', true);
+    await act(async () => element('refresh').click()); await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    const conversation = element('conversation') as HTMLSelectElement; conversation.value = reference.conversationRef;
+    await act(async () => conversation.dispatchEvent(new panel!.window.Event('change')));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click()); await waitFor(() => element('status').textContent!.startsWith('Ready'));
+    assert.match(element('transcript').textContent!, /Synthetic global Agent result/, 'owned core history survives runtime restart');
+    prompt.value = 'Synthetic model-only continuation'; await act(async () => { send(); });
+    await waitFor(() => element('status').textContent === 'Complete');
+    assert.equal(counts.requests, before + 1, 'Actions Deny allows a tool-free configured model turn after reopening');
+    assert.deepEqual(workerCalls, ['synthetic-b']);
+    phase = 'backend-revision';
+    const latestChat = [...pluginReplies].reverse().find((value) => value && typeof value === 'object' && 'chatHandle' in value) as { chatHandle: string };
+    const generation = service.agentService.host.generation; const requestsBeforeChange = counts.requests;
+    const { LOCAL_STORAGE_ADAPTER_CHANGED_EVENT } = await import('../infrastructure/persistence/localStorageAdapter');
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_ACTIVE_MODEL, 'changed-synthetic-model');
+    await act(async () => window.dispatchEvent(new CustomEvent(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, { detail: { key: keys.STORAGE_KEY_AI_ACTIVE_MODEL } })));
+    await waitFor(() => service!.agentService.host.generation > generation && service!.agentService.chats.size === 0);
+    await assert.rejects(service.contributionService.executeCommand('com.netcatty.globalagent.history', { chatHandle: latestChat.chatHandle }));
+    assert.equal(counts.requests, requestsBeforeChange, 'configuration invalidation never retries model inference');
+    assert.doesNotMatch(JSON.stringify(pluginReplies), /FIXTURE_ONLY_API_MARKER|apiKey|externalSessionId|plugin-agent:|opaque-owner|mcpServers|permissionMode/);
+    assert.doesNotMatch(JSON.stringify(trustedReplies), /FIXTURE_ONLY_API_MARKER|apiKey/);
+    assert.deepEqual(errors, []);
+  } finally {
+    console.error = originalError;
+    if (panel) { panel.window.dispatchEvent(new panel.window.Event('pagehide')); panel.window.close(); }
+    await act(async () => root.unmount()); await service?.manager.shutdown();
+    mcp.setPermissionMode('confirm'); mcp.cleanup(); aiBridge.cleanup(); privacy.configure({ enabled: false }); registerAppAppLockRuntime(oldLock);
+    server.closeAllConnections(); await new Promise<void>((resolve) => server.close(() => resolve())); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+    if (oldTmp === undefined) delete process.env.TMPDIR; else process.env.TMPDIR = oldTmp;
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});

components/PluginHostActions.entrypoint.test.tsx

@@ -109,6 +109,7 @@ test('installed sample entrypoint uses real SDK, source authority, signed host d
     const archive = path.join(directory, 'fixture.ncpkg');
     await buildPluginPackage(packageRoot, archive);
     await service.manager.install(archive, { enable: true });
+    service.database.setPermissionMode('com.netcatty.host-actions', 'ui.interact', 'ask');
     service.interactionService.setReady(sender, true);
     await act(async () => root.render(<I18nProvider locale="en"><PluginHostActionHost /></I18nProvider>));
 
@@ -192,8 +193,8 @@ test('installed sample entrypoint uses real SDK, source authority, signed host d
       const run = await begin('edit'); await chooseGroup();
       await waitFor(() => button('Save Host') !== undefined); await click(button('Save Host'));
       await waitFor(() => preparing);
-      await act(async () => { service.permissionEngine.revokeApplication('com.netcatty.host-actions', 'vault.write'); release(); await settle(); });
-      await assert.rejects(run.promise, /revoked|cancelled/); assert.equal(saves, 1); beforeCommit = undefined;
+      await act(async () => { service.permissionEngine.setMode(service.database.getActivePlugin('com.netcatty.host-actions'), 'vault.write', 'deny'); release(); await settle(); });
+      await assert.rejects(run.promise, /revoked|cancelled/); assert.equal(saves, 1); beforeCommit = undefined; service.permissionEngine.setMode(service.database.getActivePlugin('com.netcatty.host-actions'), 'vault.write', 'allow');
     });
 
     await t.test('source replacement during review cannot use the old action authority', async () => {
@@ -272,13 +273,44 @@ test('installed sample entrypoint uses real SDK, source authority, signed host d
       }
     });
 
+    await t.test('Allow connects through the selected target without a confirmation dialog; Deny blocks every Host action', async () => {
+      const id = 'com.netcatty.host-actions';
+      const plugin = service.database.getActivePlugin(id);
+      const set = (permission: string, mode: string) => service.permissionEngine.setMode(plugin, permission, mode);
+      set('ui.interact', 'allow');
+      const allowed = await begin('connect'); await chooseGroup();
+      await act(async () => { await allowed.promise; await settle(); });
+      assert.equal(document.querySelector('[role="dialog"]'), null);
+      assert.equal(connections.length, 2);
+      for (const [permission, command] of [['vault.metadata', 'select'], ['vault.write', 'create']] as const) {
+        set(permission, 'deny'); requestClock += 60_001;
+        await assert.rejects(service.contributionService.executeCommand(`${id}.${command}`), /disabled/);
+        assert.equal(document.querySelector('[role="dialog"]'), null);
+        set(permission, 'allow');
+      }
+      set('ui.interact', 'deny');
+      const denied = await begin('connect'); await chooseGroup();
+      await assert.rejects(denied.promise, /disabled/);
+      assert.equal(connections.length, 2); assert.equal(saves, 1);
+      set('ui.interact', 'ask'); set('vault.write', 'ask');
+      const draft = await begin('create');
+      assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
+      assert.ok(button('Save Host')); await click(button('Cancel'));
+      assert.deepEqual(await draft.promise, { cancelled: true });
+      set('vault.write', 'allow'); set('vault.metadata', 'ask');
+      const selection = await begin('select'); await chooseGroup();
+      assert.ok('hosts' in await selection.promise);
+      assert.equal(document.querySelector('[role="dialog"]'), null);
+      set('vault.metadata', 'allow');
+    });
+
     await t.test('runtime removal rejects old signed replies', async () => {
       const run = await begin('create');
       const old = prompts.at(-1)!;
       await act(async () => { await service.manager.setEnabled('com.netcatty.host-actions', false); await settle(); });
       await assert.rejects(run.promise);
       assert.equal(await service.interactionService.respond(sender, { requestId: old.requestId, actionToken: old.actionToken, action: 'submit', draft: { hostname: 'late.invalid' } }), false);
-      assert.equal(saves, 1); assert.equal(connections.length, 1);
+      assert.equal(saves, 1); assert.equal(connections.length, 2);
     });
   } finally {
     await act(async () => { root.unmount(); await settle(); });

components/PluginHostInteractionHost.test.tsx

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { EventEmitter } from 'node:events';
 import { JSDOM } from 'jsdom';
 
-test('host dialog drives choice/input/copy and the two-phase clipboard share using real service action tokens', async () => {
+test('host dialog drives choice/input/copy and a single scoped clipboard share using real service action tokens', async () => {
   const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
   const previous = new Map<string, PropertyDescriptor | undefined>();
   const install = (key: string, value: unknown) => {
@@ -80,9 +80,6 @@ test('host dialog drives choice/input/copy and the two-phase clipboard share usi
     assert.deepEqual(await copy.promise, { cancelled: false, value: true });
     assert.deepEqual(writes, ['synthetic output']);
     const share = await begin({ kind: 'clipboard.read', title: 'Share clipboard' });
-    assert.equal(reads, 0);
-    assert.equal(document.querySelector('textarea'), null);
-    await click(button('Preview clipboard'));
     assert.equal(reads, 1);
     assert.equal(document.querySelector('textarea')?.value, 'synthetic private text');
     await click(button('Share with plugin'));
@@ -105,17 +102,15 @@ test('host dialog drives choice/input/copy and the two-phase clipboard share usi
       assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /Synthetic selected terminal/);
       await click(button('Cancel'));
       assert.deepEqual(await noShare.promise, { cancelled: true });
-      assert.equal(selectionReads, 0);
-      const selected = await begin({ kind: 'terminal.selection.read', title: 'Synthetic terminal share' });
-      assert.equal(selectionReads, 0);
-      await click(button('Preview terminal selection'));
       assert.equal(selectionReads, 1);
+      const selected = await begin({ kind: 'terminal.selection.read', title: 'Synthetic terminal share' });
+      assert.equal(selectionReads, 2);
       assert.equal(document.querySelector('textarea')?.value, selectionText);
       selectionText = 'changed after preview';
       await click(button('Share with plugin'));
       const result = await selected.promise as { cancelled: false; value: { text: string; handle: string } };
       assert.equal(result.value.text, 'synthetic terminal selection\nsecond line');
-      assert.equal(selectionReads, 1);
+      assert.equal(selectionReads, 2);
       const draft = await begin({ kind: 'terminal.input.propose', handle: result.value.handle, title: 'Synthetic editable review', text: 'first\nsecond\r\u0003\u001b[31m\u0000' });
       assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /sends no terminal input or Enter/);
       const textarea = document.querySelector('textarea')!;
@@ -135,11 +130,9 @@ test('host dialog drives choice/input/copy and the two-phase clipboard share usi
       assert.deepEqual(writes, ['synthetic output']);
       selectionState.visible = false;
       const hidden = await begin({ kind: 'terminal.selection.read', title: 'Hidden terminal' });
-      await click(button('Preview terminal selection'));
-      assert.ok(document.querySelector('[role="alert"]'));
-      assert.equal(selectionReads, 1);
-      await click(button('Cancel'));
       assert.deepEqual(await hidden.promise, { cancelled: true });
+      assert.equal(selectionReads, 2);
+      assert.equal(document.querySelector('[role="dialog"]'), null);
     } finally { cleanupSelection(); terminalElement.remove(); }
     const cancelled = await begin({ kind: 'clipboard.write', title: 'Cancelled copy', text: 'must not copy' });
     await click(button('Cancel'));

components/PluginPermissionHost.test.tsx

@@ -0,0 +1,122 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { JSDOM } from 'jsdom';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+
+test('registered Ask uses one in-app dialog; policy controls apply Allow and Deny with no hidden prompt', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'DocumentFragment']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  dom.window.HTMLElement.prototype.scrollIntoView = () => {};
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { PluginPermissionHost } = await import('./plugins/PluginPermissionHost');
+  const { PluginPermissionPanel } = await import('./settings/tabs/PluginPermissionPanel');
+  const { observePluginHostSecurityVisibility } = await import('../application/state/pluginHostSecurityVisibility');
+  const { PluginPermissionDecisionHost } = require('../electron/plugins/permissionDecisionHost.cjs');
+  const { PluginPermissionEngine } = require('../electron/plugins/permissionEngine.cjs');
+  const { PluginHostRpcRegistry } = require('../electron/plugins/hostRpcRegistry.cjs');
+  const listeners = new Set<(event: unknown) => void>();
+  const sender = Object.assign(new EventEmitter(), { isDestroyed: () => false, send: (_channel: string, event: unknown) => { for (const listener of listeners) listener(event); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isDestroyed: () => false, isFocused: () => true, isVisible: () => true });
+  const host = new PluginPermissionDecisionHost({ getWindow: () => owner, isLocked: () => false });
+  let mode = 'allow', effects = 0;
+  const plugin = { id: 'com.example.permission-ui', activeVersion: '1.0.0', manifest: { id: 'com.example.permission-ui', publisher: 'example', permissions: { optional: [{ permission: 'network', resources: ['https://example.com'] }] } } };
+  const engine = new PluginPermissionEngine({ database: { getPermissionMode: () => mode, privateOwner: () => 'synthetic-source-owner',
+    setPermissionMode: (_id: string, _permission: string, value: string) => { mode = value; }, recordSecurityAudit() {}, deleteAllPermissionGrants() {}, listPermissionGrants: () => [] },
+    requestDecision: (...args: unknown[]) => host.request(...args) });
+  const registry = new PluginHostRpcRegistry(); registry.use(engine.createMiddleware());
+  registry.registerRequest('network.fixture', async () => { effects++; return 'synthetic result'; }, { authorization: { permission: 'network', resources: ['https://example.com'] } });
+  const route = registry.createRoutes({ pluginId: plugin.id, pluginVersion: '1.0.0', runtimeId: 'runtime-ui', runtimeKind: 'browser', manifest: plugin.manifest }).requestHandlers['network.fixture'];
+  Object.assign(dom.window, { netcatty: {
+    onPluginPermission(callback: (event: unknown) => void) { listeners.add(callback); return () => listeners.delete(callback); },
+    setPluginPermissionReady: async (ready: boolean) => host.setReady(sender, ready),
+    respondPluginPermission: async (response: unknown) => host.respond(sender, response),
+    getPluginPermissions: async () => ({ grants: [], audit: [], policies: engine.describePolicies(plugin), policyRevision: engine.getPolicyRevision(plugin) }),
+    setPluginPermissionMode: async (_id: string, permission: string, value: string, revision: string) => {
+      assert.equal(revision, engine.getPolicyRevision(plugin)); engine.setMode(plugin, permission, value); return true;
+    },
+  } });
+  const root = createRoot(document.getElementById('root')!);
+  const nativeMount = document.createElement('div'); document.body.append(nativeMount);
+  const nativeVisibility: boolean[] = [];
+  const stopVisibility = observePluginHostSecurityVisibility(nativeMount, (visible) => nativeVisibility.push(visible));
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 20));
+  const button = (text: string) => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((element) => element.textContent === text)!;
+  const choose = async (text: string) => {
+    await act(async () => { document.querySelector('[role="combobox"]')!.dispatchEvent(new dom.window.KeyboardEvent('keydown', { key: 'ArrowDown', bubbles: true })); await settle(); });
+    const option = Array.from(document.querySelectorAll<HTMLElement>('[role="option"]')).find((element) => element.textContent === text)!;
+    assert.ok(option);
+    await act(async () => { option.click(); await settle(); });
+  };
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel pluginId={plugin.id} onChanged={async () => {}} /><PluginPermissionHost /></I18nProvider>));
+    await route({}, {}); assert.equal(effects, 1); assert.equal(document.querySelector('[role="dialog"]'), null);
+    await choose('Ask'); assert.equal(mode, 'ask');
+    let operation!: Promise<string>;
+    await act(async () => { operation = route({}, {}); await settle(); });
+    assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(nativeVisibility.at(-1), false, 'the existing native-view lifecycle must yield to the trusted Ask');
+    assert.match(document.querySelector('[role="dialog"]')!.textContent!, /https:\/\/example.com/);
+    assert.equal(effects, 1);
+    await act(async () => { button('Allow this operation').click(); await operation; await settle(); });
+    assert.equal(effects, 2); assert.equal(document.querySelector('[role="dialog"]'), null);
+    await new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+    assert.equal(nativeVisibility.at(-1), false, 'visible permission settings remain a security surface after Ask closes');
+    await choose('Deny'); assert.equal(mode, 'deny');
+    await assert.rejects(route({}, {}), /disabled/); assert.equal(effects, 2); assert.equal(document.querySelector('[role="dialog"]'), null);
+    await choose('Allow'); assert.equal(mode, 'allow');
+    await route({}, {}); assert.equal(effects, 3); assert.equal(document.querySelector('[role="dialog"]'), null);
+    // Model the settings editor closing before interacting with a native view.
+    document.querySelector('section[data-host-security-surface]')!.setAttribute('hidden', '');
+    await new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+    assert.equal(nativeVisibility.at(-1), true);
+    let displayed!: Promise<unknown>;
+    const opaque = 'selected:0cfc16d6-3448-4333-82ef-dd4ffbddfdab:v1';
+    await act(async () => {
+      displayed = host.request({ requestId: 'host-display-fixture', pluginId: plugin.id, permission: 'ai.invoke', resources: ['*'], reason: 'Host model invocation',
+        relatedPermissions: [{ permission: 'context.selected.read', resources: [opaque] }],
+        displayContext: { modelLabel: 'QA fixture · deterministic-fixture', selections: [{ title: 'Synthetic retry plan', scope: 'note', version: 'bf304994-039a-4884-a707-3a1a40a5d3a9' }] },
+      }); await settle();
+    });
+    const text = document.querySelector('[role="dialog"]')!.textContent!;
+    assert.equal(nativeVisibility.at(-1), false, 'Ask alone must hide the attached plugin view');
+    assert.match(text, /QA fixture · deterministic-fixture/); assert.match(text, /Synthetic retry plan/);
+    assert.doesNotMatch(text, /selected:|0cfc16d6|bf304994/);
+    await act(async () => { button('Deny').click(); await displayed; await settle(); });
+    await new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+    assert.equal(nativeVisibility.at(-1), true, 'dismissing Ask restores the existing view without closing it');
+    for (const selections of [[], [{ title: 'Synthetic terminal B', scope: 'session', version: 'opaque-worker-revision' }]]) {
+      await act(async () => {
+        displayed = host.request({ requestId: 'agent-empty-args', pluginId: plugin.id, permission: 'ai.agent.actions', resources: ['*'],
+          displayContext: { modelLabel: 'Synthetic configured Catty', action: { capabilityId: 'session.environment', text: '{}', label: 'PLUGIN_SUPPLIED_OPERATION_NAME' }, selections },
+        }); await settle();
+      });
+      const dialog = document.querySelector('[role="dialog"]')!;
+      assert.match(dialog.textContent!, /Operation:.*get_environment/);
+      assert.match(dialog.textContent!, /session\.environment/);
+      assert.equal(dialog.querySelector('pre')!.textContent, '{}');
+      if (selections.length) assert.match(dialog.textContent!, /Targets:.*Synthetic terminal B/);
+      else assert.match(dialog.textContent!, /Targets:.*No targets selected/);
+      assert.doesNotMatch(dialog.textContent!, /opaque-worker-revision|PLUGIN_SUPPLIED_OPERATION_NAME/);
+      await act(async () => { button('Deny').click(); await displayed; await settle(); });
+    }
+  } finally {
+    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); engine.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/PluginSelectedContextPermission.entrypoint.test.tsx

@@ -0,0 +1,115 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { JSDOM } from 'jsdom';
+const require = createRequire(import.meta.url);
+
+test('registered selected-summary Ask is one host chooser; Allow still selects and Deny releases nothing', { timeout: 45_000 }, async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'HTMLSelectElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { PluginAIContextHost } = await import('./plugins/PluginAIContextHost');
+  const { PluginPermissionHost } = await import('./plugins/PluginPermissionHost');
+  const { publishNotesSnapshot, getNotesSnapshot } = await import('../application/state/notesStore');
+  const { registerAppAppLockRuntime, getAppAppLockRuntime } = await import('../application/state/appRuntimeBridge');
+  const { createPluginHostService } = require('../electron/plugins/hostService.cjs');
+  const { inProcessBrowserRuntime } = require('../electron/plugins/fixtures/inProcessBrowserRuntime.cjs');
+  const { registerPluginBridge } = require('../electron/plugins/pluginBridge.cjs');
+  const { createPreloadApi } = require('../electron/preload/api.cjs');
+  const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'netcatty-selected-policy-'));
+  const oldNotes = getNotesSnapshot(); const oldLock = getAppAppLockRuntime();
+  const handlers = new Map<string, (...args: unknown[]) => unknown>();
+  const ipcMain = Object.assign(new EventEmitter(), { handle: (channel: string, handler: (...args: unknown[]) => unknown) => handlers.set(channel, handler), removeHandler: (channel: string) => handlers.delete(channel) });
+  const ipcRenderer = Object.assign(new EventEmitter(), { invoke: async (channel: string, payload: unknown) => {
+    const handler = handlers.get(channel); assert.ok(handler, channel); return handler({ sender }, structuredClone(payload));
+  } });
+  const prompts: Array<{ channel: string; kind?: string; closed?: boolean }> = [];
+  const sender = Object.assign(new EventEmitter(), { id: 42, isDestroyed: () => false, send: (channel: string, payload: { kind?: string; closed?: boolean }) => {
+    prompts.push({ channel, kind: payload.kind, closed: payload.closed }); ipcRenderer.emit(channel, {}, structuredClone(payload));
+  } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const service = createPluginHostService({ app: { getAppPath: () => process.cwd(), getPath: () => fixtureRoot, getVersion: () => '0.0.0' },
+    electron: { ipcMain }, env: {}, getInteractionWindow: () => owner, isAppLocked: () => false });
+  service.runtimeSupervisor.runtimeFactories.browser = inProcessBrowserRuntime;
+  registerPluginBridge(ipcMain, { ...service, isTrustedSender: (event: { sender: unknown }) => event.sender === sender });
+  Object.assign(dom.window, { netcatty: createPreloadApi({ ipcRenderer, webUtils: {} }) });
+  const note = { id: 'synthetic-selected-note', title: 'Synthetic selection', content: 'BODY MUST NOT BE SHARED', createdAt: 1, updatedAt: 1 };
+  publishNotesSnapshot({ notes: [note], noteGroups: [] }); registerAppAppLockRuntime({ locked: false } as never);
+  const root = createRoot(document.getElementById('root')!);
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 20));
+  const waitForDialog = async () => {
+    const deadline = Date.now() + 5_000;
+    while (!document.querySelector('[role="dialog"]')) {
+      assert.ok(Date.now() < deadline, 'registered route did not present a host interaction');
+      await act(async () => { await settle(); });
+    }
+  };
+  const button = (label: string) => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((element) => element.textContent === label)!;
+  const begin = () => {
+    const result = service.contributionService.executeCommand('com.netcatty.assistant.contexts') as Promise<Array<{ handle: string; version: string; title: string }>>;
+    void result.catch(() => {});
+    return result;
+  };
+  try {
+    await service.manager.initialize();
+    const stage = path.join(fixtureRoot, 'package'); fs.mkdirSync(path.join(stage, 'dist'), { recursive: true });
+    const sample = path.resolve('examples/plugins/assistant');
+    for (const file of ['netcatty.plugin.json', 'panel.html', 'panel.css', 'panel.js', 'README.md']) fs.copyFileSync(path.join(sample, file), path.join(stage, file));
+    fs.copyFileSync(path.join(sample, 'src/index.js'), path.join(stage, 'dist/index.js'));
+    const { buildPluginPackage } = await import('@netcatty/plugin-cli');
+    const archive = path.join(fixtureRoot, 'assistant.ncpkg'); await buildPluginPackage(stage, archive); await service.manager.install(archive, { enable: true });
+    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionHost /><PluginAIContextHost sessions={[]} workspaces={[]} /></I18nProvider>));
+    const plugin = service.database.getActivePlugin('com.netcatty.assistant');
+    for (const mode of ['ask', 'allow']) {
+      service.permissionEngine.setMode(plugin, 'context.selected.list', mode);
+      let result!: ReturnType<typeof begin>;
+      await act(async () => { result = begin(); await settle(); });
+      await waitForDialog();
+      assert.ok(document.getElementById('plugin-ai-note'), 'the first interaction must be the real host chooser');
+      assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
+      assert.equal(prompts.filter((prompt) => prompt.channel === 'netcatty:plugins:permission-prompt' && !prompt.closed).length, 0, 'no capability dialog before the chooser');
+      await act(async () => {
+        const select = document.getElementById('plugin-ai-note') as HTMLSelectElement; select.value = note.id; select.dispatchEvent(new dom.window.Event('change', { bubbles: true })); await settle();
+      });
+      await act(async () => { button('Share selected summaries').click(); await settle(); });
+      const summaries = await result;
+      assert.ok(summaries.some((item) => item.title === note.title));
+      assert.doesNotMatch(JSON.stringify(summaries), /BODY MUST NOT BE SHARED/);
+      assert.equal(document.querySelector('[role="dialog"]'), null);
+    }
+    service.permissionEngine.setMode(plugin, 'context.selected.list', 'deny');
+    const count = prompts.filter((prompt) => prompt.kind === 'context.select').length;
+    await assert.rejects(service.contributionService.executeCommand('com.netcatty.assistant.contexts'), /disabled/);
+    assert.equal(prompts.filter((prompt) => prompt.kind === 'context.select').length, count); assert.equal(document.querySelector('[role="dialog"]'), null);
+    service.permissionEngine.setMode(plugin, 'context.selected.list', 'ask');
+    let cancelled!: ReturnType<typeof begin>;
+    await act(async () => { cancelled = begin(); await settle(); });
+    await waitForDialog();
+    await act(async () => { button('Cancel').click(); await settle(); });
+    await assert.rejects(cancelled); assert.equal(service.aiContextService.selected.handles.size, 0);
+    let revoked!: ReturnType<typeof begin>;
+    await act(async () => { revoked = begin(); await settle(); });
+    await waitForDialog();
+    await act(async () => { service.permissionEngine.setMode(plugin, 'context.selected.list', 'deny'); await settle(); });
+    await assert.rejects(revoked); assert.equal(document.querySelector('[role="dialog"]'), null); assert.equal(service.aiContextService.selected.handles.size, 0);
+  } finally {
+    await act(async () => root.unmount()); await service.manager.shutdown();
+    publishNotesSnapshot(oldNotes); registerAppAppLockRuntime(oldLock); dom.window.close(); fs.rmSync(fixtureRoot, { recursive: true, force: true });
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/SettingsPage.tsx

@@ -27,6 +27,7 @@ import { useExternalMcpGrantPersister } from "./ai/useExternalMcpGrantPersister"
 import { setupMcpApprovalBridge } from "../infrastructure/ai/shared/approvalGate";
 import { usePluginContributions } from "../application/state/usePluginContributions";
 import { PluginContributionHost } from "./plugins/PluginContributionHost";
+import { PluginPermissionHost } from "./plugins/PluginPermissionHost";
 import { matchesKeyBinding } from "../domain/models";
 import { isPrimaryModifierWBinding } from "../application/state/windowCommandClose";
 
@@ -575,6 +576,8 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
                                 setShowHostTreeSidebar={settings.setShowHostTreeSidebar}
                                 windowOpacity={settings.windowOpacity}
                                 setWindowOpacity={settings.setWindowOpacity}
+                                windowBackgroundBlur={settings.windowBackgroundBlur}
+                                setWindowBackgroundBlur={settings.setWindowBackgroundBlur}
                                 appIconVariant={settings.appIconVariant}
                                 setAppIconVariant={settings.setAppIconVariant}
                             />
@@ -720,6 +723,7 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
             </Tabs>
         </div>
         <ExternalMcpApprovalsHost />
+        <PluginPermissionHost />
         <PluginContributionHost locale={settings.uiLanguage} theme={settings.resolvedTheme} themeTokens={pluginThemeTokens} />
         </>
     );

components/TextEditorModal.tsx

@@ -64,6 +64,8 @@ interface TextEditorModalProps {
   onClose: () => void;
   fileName: string;
   initialContent: string;
+  /** Full path for language detection; the title still uses fileName. */
+  filePath?: string;
   onSave: (content: string) => Promise<void>;
   editorWordWrap: boolean;
   onToggleWordWrap: () => void;
@@ -79,6 +81,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
   open,
   onClose,
   fileName,
+  filePath,
   initialContent,
   onSave,
   editorWordWrap,
@@ -94,7 +97,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
   const [baselineContent, setBaselineContent] = useState(initialContent);
   const [saving, setSaving] = useState(false);
   const [saveError, setSaveError] = useState<string | null>(null);
-  const [languageId, setLanguageId] = useState(() => getLanguageId(fileName));
+  const [languageId, setLanguageId] = useState(() => getLanguageId(filePath ?? fileName));
   const contentRef = useRef(initialContent);
   const baselineContentRef = useRef(initialContent);
   const savingRef = useRef(false);
@@ -149,13 +152,13 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
     setBaselineContent(initialContent);
     setSaveError(null);
     setSaving(false);
-    setLanguageId(getLanguageId(fileName));
+    setLanguageId(getLanguageId(filePath ?? fileName));
     contentRef.current = initialContent;
     baselineContentRef.current = initialContent;
     savingRef.current = false;
     closePromptRef.current = null;
     viewStateRef.current = null;
-  }, [initialContent, fileName]);
+  }, [initialContent, fileName, filePath]);
 
   const saveContent = useCallback(async (contentToSave = contentRef.current): Promise<boolean> => {
     return saveCoordinatorRef.current?.save(contentToSave) ?? false;

components/ai/ChatInput.test.tsx

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import React from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
 
-import ChatInput from './ChatInput';
+import ChatInput, { replaceSlashQueryWithCommand, replaceSlashQueryWithRename } from './ChatInput';
 import {
   CHAT_INPUT_MAX_HEIGHT,
   CHAT_INPUT_MIN_HEIGHT,
@@ -217,9 +217,46 @@ test('renders the Catty context usage ring after the model chip', () => {
   assert.match(html, /aria-valuenow="50"/);
 });
 
+test('selecting rename completes a partial slash query without sending', () => {
+  assert.equal(replaceSlashQueryWithRename('/ren', { start: 0, end: 4 }), '/rename ');
+  assert.equal(replaceSlashQueryWithRename('/', { start: 0, end: 1 }), '/rename ');
+  assert.equal(replaceSlashQueryWithRename('before /ren after', { start: 7, end: 11 }), 'before /rename  after');
+  assert.equal(replaceSlashQueryWithRename('old text', null), '/rename ');
+
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  const branch = source.slice(source.indexOf("if (command === 'rename')"), source.indexOf("commitComposerText('');", source.indexOf("if (command === 'rename')")));
+  assert.match(branch, /commitComposerText\(replaceSlashQueryWithRename\(readComposerText\(\), slashRange\)\)/);
+  assert.match(branch, /closeAllMenus\(\);[\s\S]*?return;/);
+  assert.doesNotMatch(branch, /onSend/);
+});
+
+test('selecting rebind completes a partial slash query without sending', () => {
+  assert.equal(replaceSlashQueryWithCommand('/re', { start: 0, end: 3 }, 'rebind'), '/rebind ');
+  assert.equal(replaceSlashQueryWithCommand('/', { start: 0, end: 1 }, 'rebind'), '/rebind ');
+  assert.equal(replaceSlashQueryWithCommand('before /re after', { start: 7, end: 10 }, 'rebind'), 'before /rebind  after');
+  assert.equal(replaceSlashQueryWithCommand('old text', null, 'rebind'), '/rebind ');
+
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  const branch = source.slice(source.indexOf("if (command === 'rebind')"), source.indexOf("if (command === 'rename')"));
+  assert.match(branch, /commitComposerText\(replaceSlashQueryWithCommand\(readComposerText\(\), slashRange, 'rebind'\)\)/);
+  assert.match(branch, /closeAllMenus\(\);[\s\S]*?return;/);
+  assert.doesNotMatch(branch, /onSend/);
+});
+
 test('slash picker system commands clear the local composer', () => {
   const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
-  assert.match(source, /if \(command === 'stop'\) onStop\?\.\(\);\s*commitComposerText\(''\);/s);
+  // /stop falls through to the shared clear; /rename, /chats and /rebind have
+  // their own branches above it (rename/rebind keep the composer so the user
+  // can type an argument).
+  assert.match(source, /if \(command === 'stop'\) onStop\?\.\(\);[\s\S]*?commitComposerText\(''\);/);
+  assert.match(source, /if \(command === 'chats'\) onListChats\?\.\(\);/);
+  assert.match(source, /if \(command === 'rename'\) \{[\s\S]*?closeAllMenus\(\);[\s\S]*?return;/);
+  assert.match(source, /if \(command === 'rebind'\) \{[\s\S]*?closeAllMenus\(\);[\s\S]*?return;/);
+});
+
+test('/rebind routes its argument to onRebindChat as a panel action', () => {
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  assert.match(source, /if \(systemCommand === 'rebind'\) \{[\s\S]*?onRebindChat\?\.\(getRebindSlashCommandArg\(submittedText\)\);/);
 });
 
 test('keeps thinking on a separate chip instead of mixing it into the model list', () => {
@@ -333,6 +370,25 @@ test('ChatInput wires /compact through getSystemSlashCommand and canCompact', ()
   assert.match(source, /command\.slug !== 'compact' \|\| canCompact/);
 });
 
+test('ChatInput intercepts /rename and /chats as panel actions before onSend', () => {
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  // The interception happens in handleSubmit's system-command branch, which
+  // returns before onSend() — the commands never reach the agent.
+  assert.match(source, /systemCommand === 'rename'/);
+  assert.match(source, /systemCommand === 'chats'/);
+  assert.match(source, /onRenameSession\?\.\(getRenameSlashCommandTitle\(submittedText\)\)/);
+  assert.match(source, /onListChats\?\.\(\)/);
+  // Both commands clear the composer instead of falling through to onSend.
+  const renameBranchStart = source.indexOf("systemCommand === 'rename'");
+  const renameBranchEnd = source.indexOf('if (isStreaming && canSteer)', renameBranchStart);
+  const renameBranch = source.slice(renameBranchStart, renameBranchEnd);
+  assert.match(renameBranch, /commitComposerText\(''\)/);
+  assert.doesNotMatch(renameBranch, /onSend\(\)/);
+  // The slash picker registers the built-ins and keeps /rename text editable.
+  assert.match(source, /command === 'rename'/);
+  assert.match(source, /command === 'chats'/);
+});
+
 test('renders a Mention Note picker entry with a searchable note list', () => {
   const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
 

components/ai/ChatInput.tsx

@@ -33,6 +33,8 @@ import {
   filterQuickMessages,
   filterSystemSlashCommands,
   filterUserSkillsForSlash,
+  getRebindSlashCommandArg,
+  getRenameSlashCommandTitle,
   getSlashCommandItemKey,
   getSystemSlashCommand,
   SYSTEM_BUILTIN_SLASH_COMMANDS,
@@ -80,6 +82,19 @@ const MENU_VIEWPORT_GUTTER = 8;
 const CONTEXT_USAGE_RING_RADIUS = 10;
 const CONTEXT_USAGE_RING_CIRCUMFERENCE = 2 * Math.PI * CONTEXT_USAGE_RING_RADIUS;
 
+export function replaceSlashQueryWithCommand(
+  text: string,
+  range: { start: number; end: number } | null,
+  command: string,
+): string {
+  const replacement = `/${command} `;
+  return range ? `${text.slice(0, range.start)}${replacement}${text.slice(range.end)}` : replacement;
+}
+
+export function replaceSlashQueryWithRename(text: string, range: { start: number; end: number } | null): string {
+  return replaceSlashQueryWithCommand(text, range, 'rename');
+}
+
 function formatContextTokens(tokens: number): string {
   if (tokens >= 1_000_000) return `${(tokens / 1_000_000).toFixed(1)}M`;
   if (tokens >= 1_000) return `${(tokens / 1_000).toFixed(tokens >= 100_000 ? 0 : 1)}K`;
@@ -266,6 +281,12 @@ interface ChatInputProps {
   onThinkingLevelChange?: (level: string) => void;
   /** Hidden retained panels must not leave body-portaled menus open. */
   parked?: boolean;
+  /** `/rename <title>`: rename the current chat (panel action, never sent to the agent). */
+  onRenameSession?: (title: string) => void;
+  /** `/chats`: list the chats visible to this panel (panel action, never sent to the agent). */
+  onListChats?: () => void;
+  /** `/rebind <n>`: rebind a dangling chat to this panel's scope (panel action, never sent to the agent). */
+  onRebindChat?: (arg: string) => void;
 }
 
 const ChatInput: React.FC<ChatInputProps> = ({
@@ -313,6 +334,9 @@ const ChatInput: React.FC<ChatInputProps> = ({
   thinkingLevel,
   onThinkingLevelChange,
   parked = false,
+  onRenameSession,
+  onListChats,
+  onRebindChat,
 }) => {
   const { t } = useI18n();
   const hasTerminalSelectionAttachment = files.some((file) => file.terminalSelection || file.vaultNoteId);
@@ -750,6 +774,20 @@ const ChatInput: React.FC<ChatInputProps> = ({
         onCompact?.();
       }
       if (command === 'stop') onStop?.();
+      if (command === 'chats') onListChats?.();
+      if (command === 'rebind') {
+        // Replace a partial slash query (e.g. `/re`) with `/rebind ` so the
+        // user can finish the dangling-chat number; never leave `/re 1` to
+        // be sent to the agent.
+        commitComposerText(replaceSlashQueryWithCommand(readComposerText(), slashRange, 'rebind'));
+        closeAllMenus();
+        return;
+      }
+      if (command === 'rename') {
+        commitComposerText(replaceSlashQueryWithRename(readComposerText(), slashRange));
+        closeAllMenus();
+        return;
+      }
       commitComposerText('');
       closeAllMenus();
       return;
@@ -759,7 +797,7 @@ const ChatInput: React.FC<ChatInputProps> = ({
       return;
     }
     insertUserSkillToken(item.skill);
-  }, [canCompact, closeAllMenus, commitComposerText, insertQuickMessage, insertUserSkillToken, onCompact, onStop]);
+  }, [canCompact, closeAllMenus, commitComposerText, insertQuickMessage, insertUserSkillToken, onCompact, onListChats, onStop, readComposerText, slashRange]);
 
   // Reset active highlight when a menu opens or when the *identity* of the
   // visible items changes. Watching only `.length` misses cases where the
@@ -962,6 +1000,21 @@ const ChatInput: React.FC<ChatInputProps> = ({
           commitComposerText('');
           return;
         }
+        if (systemCommand === 'rename') {
+          onRenameSession?.(getRenameSlashCommandTitle(submittedText));
+          commitComposerText('');
+          return;
+        }
+        if (systemCommand === 'chats') {
+          onListChats?.();
+          commitComposerText('');
+          return;
+        }
+        if (systemCommand === 'rebind') {
+          onRebindChat?.(getRebindSlashCommandArg(submittedText));
+          commitComposerText('');
+          return;
+        }
         return;
       }
       if (isStreaming && canSteer) {
@@ -972,7 +1025,7 @@ const ChatInput: React.FC<ChatInputProps> = ({
       // abort; the parent clears value only after the user message is accepted.
       onSend();
     },
-    [canCompact, canSteer, commitComposerText, isStreaming, onCompact, onSend, onSteer, onStop, readComposerText],
+    [canCompact, canSteer, commitComposerText, isStreaming, onCompact, onListChats, onRebindChat, onRenameSession, onSend, onSteer, onStop, readComposerText],
   );
 
   const status: PromptInputStatus = isStreaming ? 'streaming' : 'idle';

components/ai/aiChatsListing.test.ts

@@ -0,0 +1,186 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import type { AISession, ExternalAgentConfig } from '../../infrastructure/ai/types.ts';
+import {
+  buildAiChatsListingEntries,
+  canRebindChat,
+  formatAiChatsListingNote,
+  resolveChatAgentLabel,
+  resolveRebindTargetFromArg,
+  truncateChatTitle,
+} from './aiChatsListing.ts';
+
+test('rebind revalidates cached entries against current sessions and live targets', () => {
+  const liveTargets = new Set(['ws-live', 'term-live']);
+  assert.equal(canRebindChat(undefined, liveTargets), false);
+  assert.equal(canRebindChat(createSession('restored', { scope: { type: 'workspace', targetId: 'ws-live' } }), liveTargets), false);
+  assert.equal(canRebindChat(createSession('restored-terminal', { scope: { type: 'terminal', targetId: 'term-live' } }), liveTargets), false);
+  assert.equal(canRebindChat(createSession('dangling', { scopeDangling: true, scope: { type: 'workspace', targetId: 'ws-old' } }), liveTargets), true);
+  assert.equal(canRebindChat(createSession('unbound', { scope: { type: 'terminal', targetId: 'term-old' } }), liveTargets), true);
+});
+
+function createSession(
+  id: string,
+  overrides: Partial<AISession> = {},
+): AISession {
+  return {
+    id,
+    title: id,
+    agentId: 'catty',
+    scope: { type: 'workspace', targetId: 'ws-1' },
+    messages: [],
+    createdAt: 1_000,
+    updatedAt: 1_000,
+    ...overrides,
+  };
+}
+
+const t = (key: string) => key;
+const externalAgents: ExternalAgentConfig[] = [
+  { id: 'claude', name: 'Claude Code' } as ExternalAgentConfig,
+];
+
+function buildEntries(sessions: AISession[], activeSessionId: string | null = 's-live') {
+  return buildAiChatsListingEntries({
+    sessions,
+    activeSessionId,
+    externalAgents,
+    workspaces: [{ id: 'ws-1', title: 'Web farm' }],
+    liveTerminalIds: new Set(['term-1']),
+    scopeTargetId: 'ws-1',
+    t,
+  });
+}
+
+test('/chats listing marks the live workspace chat, terminal chat and dangling chat', () => {
+  const now = Date.now();
+  const sessions = [
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' }, updatedAt: now }),
+    createSession('s-term', { scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude', updatedAt: now }),
+    createSession('s-dangling', { scope: { type: 'workspace', targetId: 'ws-gone' }, updatedAt: now }),
+  ];
+
+  const entries = buildEntries(sessions);
+  assert.equal(entries.length, 3);
+
+  assert.equal(entries[0].isCurrent, true);
+  assert.equal(entries[0].agentLabel, 'Catty Agent');
+  assert.equal(entries[0].scopeLabel, 'ai.chat.chatsScopeWorkspace: Web farm');
+  assert.equal(entries[0].isDangling, false);
+
+  assert.equal(entries[1].isCurrent, false);
+  assert.equal(entries[1].agentLabel, 'Claude Code');
+  assert.equal(entries[1].scopeLabel, 'ai.chat.chatsScopeTerminal');
+  assert.equal(entries[1].isDangling, false);
+
+  assert.equal(entries[2].isDangling, true);
+  assert.equal(entries[2].scopeLabel, 'ai.chat.chatsScopeDangling');
+});
+
+test('/chats listing numbers dangling entries for /rebind and leaves live ones unnumbered', () => {
+  const sessions = [
+    createSession('s-dangling-a', { scope: { type: 'workspace', targetId: 'ws-gone-a' } }),
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' } }),
+    createSession('s-dangling-b', { scope: { type: 'terminal', targetId: 'term-gone' } }),
+    createSession('s-dangling-c', { scope: { type: 'workspace', targetId: 'ws-gone-b' } }),
+  ];
+
+  const entries = buildEntries(sessions, null);
+  assert.deepEqual(
+    entries.map((entry) => entry.rebindNumber ?? 0),
+    [1, 0, 2, 3],
+  );
+});
+
+test('/chats listing falls back to the panel scope label for the current workspace', () => {
+  const sessions = [
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' } }),
+  ];
+  const entries = buildAiChatsListingEntries({
+    sessions,
+    activeSessionId: 's-live',
+    externalAgents,
+    workspaces: [],
+    liveTerminalIds: new Set<string>(),
+    currentScopeLabel: 'Web farm',
+    scopeTargetId: 'ws-1',
+    t,
+  });
+  assert.equal(entries[0].isDangling, false);
+  assert.equal(entries[0].scopeLabel, 'ai.chat.chatsScopeWorkspace: Web farm');
+});
+
+test('/chats note renders header, current marker and one line per chat', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-term', { title: 'Logs', scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude' }),
+    createSession('s-dangling', { title: 'Old', scope: { type: 'workspace', targetId: 'ws-gone' } }),
+  ];
+  const entries = buildEntries(sessions);
+  const note = formatAiChatsListingNote(entries, t);
+  const lines = note.split('\n');
+  assert.equal(lines[0], 'ai.chat.chatsHeader');
+  // Three chat lines plus the dangling rebind hint.
+  assert.equal(lines.length, 5);
+  assert.match(lines[1], /^• Fix deploy — Catty Agent · /);
+  assert.match(lines[2], /^ {2}Logs — Claude Code · /);
+  assert.match(lines[3], /ai\.chat\.chatsScopeDangling/);
+  assert.ok(!lines[3].startsWith('•'));
+  // The dangling line carries an inline rebind affordance, and the note
+  // explains it.
+  assert.match(lines[3], /\/rebind 1/);
+  assert.equal(lines[4], 'ai.chat.chatsRebindHint');
+});
+
+test('/chats note omits the rebind hint when nothing is dangling', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-term', { title: 'Logs', scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude' }),
+  ];
+  const entries = buildEntries(sessions);
+  const note = formatAiChatsListingNote(entries, t);
+  assert.ok(!note.includes('rebind'));
+});
+
+test('resolveRebindTargetFromArg picks only dangling entries by their number', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-dangling', { title: 'Old', scope: { type: 'workspace', targetId: 'ws-gone' } }),
+    createSession('s-dangling-2', { title: 'Older', scope: { type: 'terminal', targetId: 'term-gone' } }),
+  ];
+  const entries = buildEntries(sessions);
+  const dangling = entries.find((entry) => entry.isDangling);
+  assert.ok(dangling);
+
+  assert.equal(resolveRebindTargetFromArg('1', entries)?.sessionId, 's-dangling');
+  assert.equal(resolveRebindTargetFromArg(' 2 ', entries)?.sessionId, entries.filter((entry) => entry.isDangling)[1].sessionId);
+  assert.equal(resolveRebindTargetFromArg('3', entries), null);
+  assert.equal(resolveRebindTargetFromArg('1foo', entries), null);
+  assert.equal(resolveRebindTargetFromArg('1.5', entries), null);
+  assert.equal(resolveRebindTargetFromArg('0', entries), null);
+  assert.equal(resolveRebindTargetFromArg('-1', entries), null);
+  assert.equal(resolveRebindTargetFromArg('', entries), null);
+  assert.equal(resolveRebindTargetFromArg('abc', entries), null);
+  // A live entry is not rebindable even if its position would match.
+  assert.equal(resolveRebindTargetFromArg('1', [entries[0]]), null);
+});
+
+test('/chats note reports an empty panel', () => {
+  assert.equal(formatAiChatsListingNote([], t), 'ai.chat.chatsEmpty');
+});
+
+test('truncateChatTitle clamps long titles and keeps short ones intact', () => {
+  assert.equal(truncateChatTitle('short'), 'short');
+  assert.equal(truncateChatTitle('  '), '');
+  const long = 'x'.repeat(80);
+  const truncated = truncateChatTitle(long);
+  assert.equal(truncated.length, 42);
+  assert.ok(truncated.endsWith('…'));
+});
+
+test('resolveChatAgentLabel resolves external agents and falls back to the raw id', () => {
+  assert.equal(resolveChatAgentLabel('catty', externalAgents), 'Catty Agent');
+  assert.equal(resolveChatAgentLabel('claude', externalAgents), 'Claude Code');
+  assert.equal(resolveChatAgentLabel('mystery', externalAgents), 'mystery');
+});

components/ai/aiChatsListing.ts

@@ -0,0 +1,161 @@
+import type { AISession, ExternalAgentConfig } from '../../infrastructure/ai/types';
+import { formatRelativeTime } from '../AIChatSessionHistoryDrawer';
+
+/**
+ * Pure builder for the `/chats` panel note. Kept separate from the component
+ * so a future rebind action (issue #4015 R2) can attach per-entry actions
+ * without reworking the text rendering.
+ */
+
+export interface AiChatsListingInput {
+  /** Rank-sorted sessions visible to the current panel scope. */
+  sessions: AISession[];
+  activeSessionId: string | null;
+  externalAgents: ExternalAgentConfig[];
+  /** Live workspaces, used to resolve workspace scope titles. */
+  workspaces: Array<{ id: string; title: string }>;
+  /** Live terminal session ids visible to this panel. */
+  liveTerminalIds: Iterable<string>;
+  /** Fallback scope label for the panel's own scope (e.g. current workspace title). */
+  currentScopeLabel?: string;
+  scopeTargetId?: string;
+  t: (key: string) => string;
+}
+
+export interface AiChatsListingEntry {
+  sessionId: string;
+  title: string;
+  agentLabel: string;
+  scopeLabel: string;
+  /** Scope target no longer resolves to a live workspace/terminal. */
+  isDangling: boolean;
+  /** 1-based number among dangling entries, used by `/rebind <n>`. */
+  rebindNumber?: number;
+  isCurrent: boolean;
+  relativeTime: string;
+}
+
+const TITLE_TRUNCATE = 42;
+
+export function truncateChatTitle(title: string): string {
+  const trimmed = title.trim() || '';
+  if (trimmed.length <= TITLE_TRUNCATE) return trimmed;
+  return `${trimmed.slice(0, TITLE_TRUNCATE - 1)}…`;
+}
+
+export function resolveChatAgentLabel(
+  agentId: string,
+  externalAgents: ExternalAgentConfig[],
+): string {
+  if (agentId === 'catty') return 'Catty Agent';
+  return externalAgents.find((agent) => agent.id === agentId)?.name ?? agentId;
+}
+
+export function buildAiChatsListingEntries(input: AiChatsListingInput): AiChatsListingEntry[] {
+  const {
+    sessions,
+    activeSessionId,
+    externalAgents,
+    workspaces,
+    liveTerminalIds,
+    scopeTargetId,
+    t,
+  } = input;
+  const workspaceTitles = new Map(workspaces.map((workspace) => [workspace.id, workspace.title]));
+  const liveTerminals = new Set(liveTerminalIds);
+
+  const entries: AiChatsListingEntry[] = sessions.map((session) => {
+    const isCurrent = session.id === activeSessionId;
+    let scopeLabel = '';
+    let isDangling = false;
+    if (session.scope.type === 'workspace') {
+      const title = workspaceTitles.get(session.scope.targetId ?? '');
+      if (title != null) {
+        scopeLabel = `${t('ai.chat.chatsScopeWorkspace')}: ${title}`;
+      } else {
+        // The panel's own scope may be labelled by the parent even when the
+        // workspace store has not been threaded through; treat the active
+        // scope target as live.
+        if (isCurrent && session.scope.targetId === scopeTargetId && input.currentScopeLabel) {
+          scopeLabel = `${t('ai.chat.chatsScopeWorkspace')}: ${input.currentScopeLabel}`;
+        } else {
+          isDangling = true;
+          scopeLabel = t('ai.chat.chatsScopeDangling');
+        }
+      }
+    } else if (session.scope.type === 'terminal') {
+      if (liveTerminals.has(session.scope.targetId ?? '')) {
+        scopeLabel = t('ai.chat.chatsScopeTerminal');
+      } else {
+        isDangling = true;
+        scopeLabel = t('ai.chat.chatsScopeDangling');
+      }
+    } else {
+      scopeLabel = t('ai.chat.chatsScopeGlobal');
+    }
+
+    return {
+      sessionId: session.id,
+      title: truncateChatTitle(session.title || t('ai.chat.untitled')),
+      agentLabel: resolveChatAgentLabel(session.agentId, externalAgents),
+      scopeLabel,
+      isDangling,
+      isCurrent,
+      relativeTime: formatRelativeTime(new Date(session.updatedAt), t),
+    };
+  });
+
+  // Number the dangling entries so the note can advertise `/rebind <n>`.
+  let danglingCounter = 0;
+  for (const entry of entries) {
+    if (!entry.isDangling) continue;
+    danglingCounter += 1;
+    entry.rebindNumber = danglingCounter;
+  }
+
+  return entries;
+}
+
+/**
+ * Resolve a `/rebind <n>` argument against a `/chats` listing. Only dangling
+ * entries are rebindable; a non-dangling target (or a bad index) yields null.
+ */
+export function resolveRebindTargetFromArg(
+  arg: string,
+  entries: AiChatsListingEntry[],
+): AiChatsListingEntry | null {
+  const trimmed = arg.trim();
+  if (!/^\d+$/.test(trimmed)) return null;
+  const index = Number.parseInt(trimmed, 10);
+  if (!Number.isInteger(index) || index < 1) return null;
+  const dangling = entries.filter((entry) => entry.isDangling);
+  return dangling[index - 1] ?? null;
+}
+
+/** Revalidate a cached listing entry against the current session and live scopes. */
+export function canRebindChat(session: AISession | undefined, liveScopeTargetIds: ReadonlySet<string>): boolean {
+  if (!session) return false;
+  return !!session.scopeDangling || !session.scope.targetId || !liveScopeTargetIds.has(session.scope.targetId);
+}
+
+export function formatAiChatsListingNote(
+  entries: AiChatsListingEntry[],
+  t: (key: string) => string,
+): string {
+  if (entries.length === 0) {
+    return t('ai.chat.chatsEmpty');
+  }
+  let hasDangling = false;
+  const lines = entries.map((entry) => {
+    const marker = entry.isCurrent ? '•' : ' ';
+    const rebindHint = entry.isDangling && entry.rebindNumber != null
+      ? ` · /rebind ${entry.rebindNumber}`
+      : '';
+    if (entry.isDangling) hasDangling = true;
+    return `${marker} ${entry.title} — ${entry.agentLabel} · ${entry.scopeLabel} · ${entry.relativeTime}${rebindHint}`;
+  });
+  if (hasDangling) {
+    lines.push(t('ai.chat.chatsRebindHint'));
+  }
+  return [t('ai.chat.chatsHeader'), ...lines].join('\n');
+}

components/editor/TextEditorPane.test.tsx

@@ -8,6 +8,7 @@ import {
   getTextEditorContentStats,
   isTextEditorCommandWEnabled,
   isTextEditorReadOnly,
+  languageIdToMonaco,
   TextEditorPromoteButton,
 } from "./TextEditorPane.tsx";
 import { TooltipProvider } from "../ui/tooltip.tsx";
@@ -16,6 +17,11 @@ import { DEFAULT_KEY_BINDINGS } from "../../domain/models/keyBindings.ts";
 const wrap = (child: React.ReactElement) =>
   React.createElement(TooltipProvider, null, child);
 
+test("maps manual Nginx selection to the registered language", () => {
+  assert.equal(languageIdToMonaco('nginx'), 'nginx');
+  assert.equal(languageIdToMonaco('ini'), 'ini');
+});
+
 test("disables promoting a modal editor to a tab while a save is running", () => {
   assert.equal(canPromoteTextEditor({ saving: true }), false);
   assert.equal(canPromoteTextEditor({ saving: false }), true);

components/editor/TextEditorPane.tsx

@@ -30,6 +30,7 @@ import { useClipboardBackend } from '../../application/state/useClipboardBackend
 import { isPrimaryModifierWBinding } from '../../application/state/windowCommandClose';
 import { HotkeyScheme, KeyBinding, matchesKeyBinding } from '../../domain/models';
 import { pasteForMonacoEditorCommand } from '../../infrastructure/monaco/monacoClipboardPaste';
+import { registerNginxLanguage } from '../../infrastructure/monaco/nginxLanguage';
 import { useNetcattyMonacoTheme } from '../../infrastructure/monaco/useNetcattyMonacoTheme';
 import { getLanguageName, getSupportedLanguages } from '../../lib/sftpFileUtils';
 import { Button } from '../ui/button';
@@ -37,7 +38,7 @@ import { Combobox } from '../ui/combobox';
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip';
 
 // Map our language IDs to Monaco language IDs
-const languageIdToMonaco = (langId: string): string => {
+export const languageIdToMonaco = (langId: string): string => {
   const mapping: Record<string, string> = {
     'javascript': 'javascript',
     'typescript': 'typescript',
@@ -73,6 +74,7 @@ const languageIdToMonaco = (langId: string): string => {
     'yaml': 'yaml',
     'toml': 'ini',
     'ini': 'ini',
+    'nginx': 'nginx',
     'sql': 'sql',
     'graphql': 'graphql',
     'markdown': 'markdown',
@@ -512,6 +514,7 @@ const TextEditorPaneInner: React.FC<TextEditorPaneProps> = ({
           language={monacoLanguage}
           value={content}
           onChange={handleEditorChange}
+          beforeMount={registerNginxLanguage}
           onMount={handleEditorMount}
           theme={customThemeName}
           loading={

components/plugins/PluginAIContextHost.tsx

@@ -9,7 +9,7 @@ export function PluginAIContextHost({ sessions, workspaces }: { sessions: Termin
   return <Dialog open={choice !== null} onOpenChange={(open) => { if (!open) choice?.cancel(); }}>
     <DialogContent data-host-security-surface="">
       <DialogHeader><DialogTitle>Choose a reference for the plugin</DialogTitle>
-        <DialogDescription>Share a Note summary and the current selected workspace, tab, session, and host summaries. Reading content requires a separate permission and text review.</DialogDescription></DialogHeader>
+        <DialogDescription>Share a Note summary and the current selected workspace, tab, session, and host summaries. Content access follows this plugin's Allow / Ask / Deny settings; this chooser shares summaries only.</DialogDescription></DialogHeader>
       <label className="text-sm" htmlFor="plugin-ai-note">Note</label>
       <select id="plugin-ai-note" value={noteId} onChange={(event) => setNoteId(event.target.value)} className="rounded border border-border bg-background p-2 text-foreground">
         <option value="">No Note</option>

components/plugins/PluginAgentHost.tsx

@@ -0,0 +1,26 @@
+import React, { useState } from 'react';
+import type { TerminalSession } from '../../domain/models';
+import { usePluginAgentHost } from '../../application/state/usePluginAgentHost';
+import { Button } from '../ui/button';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
+
+export function PluginAgentHost({ sessions }: { sessions: TerminalSession[] }) {
+  const { choice } = usePluginAgentHost(sessions);
+  const [selected, setSelected] = useState<string[]>([]);
+  return <Dialog open={choice !== null} onOpenChange={(open) => { if (!open) choice?.cancel(); }}>
+    <DialogContent data-host-security-surface="" onOpenAutoFocus={() => setSelected([])}>
+      <DialogHeader><DialogTitle>Choose terminals for this Agent conversation</DialogTitle>
+        <DialogDescription>The conversation is independent of the active tab or workspace. Only the terminals selected here are eligible targets. Tool actions follow this plugin's Allow / Ask / Deny setting.</DialogDescription></DialogHeader>
+      <div className="max-h-72 space-y-2 overflow-y-auto">
+        {choice?.items.map((item) => <label key={item.sessionId} className="flex gap-2 text-sm">
+          <input type="checkbox" checked={selected.includes(item.sessionId)} disabled={selected.length >= 32 && !selected.includes(item.sessionId)}
+            onChange={(event) => setSelected((ids) => event.target.checked ? [...ids, item.sessionId] : ids.filter((id) => id !== item.sessionId))} />
+          <span>{item.label} <span className="text-muted-foreground">{item.hostname}</span></span>
+        </label>)}
+        {choice?.items.length === 0 && <p className="text-sm text-muted-foreground">No connected terminals. You can continue without targets.</p>}
+      </div>
+      <DialogFooter><Button variant="outline" onClick={() => choice?.cancel()}>Cancel</Button>
+        <Button onClick={() => choice?.confirm(selected)}>Use selected terminals</Button></DialogFooter>
+    </DialogContent>
+  </Dialog>;
+}

components/plugins/PluginAuthorRow.tsx

@@ -0,0 +1,26 @@
+import React, { useState } from 'react';
+import { UserRound } from 'lucide-react';
+import { usePluginAuthorIdentity } from '../../application/state/usePluginAuthorIdentity';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { Badge } from '../ui/badge';
+
+export function PluginAuthorRow({ entry, plugin, sourceId }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const { t } = useI18n();
+  const { ref, identity } = usePluginAuthorIdentity({ entry, plugin, sourceId });
+  const [failed, setFailed] = useState<string | null>(null);
+  const author = identity?.author ?? entry?.author ?? plugin?.manifest?.publisher ?? '';
+  const imageKey = JSON.stringify([entry?.id, entry?.selectionToken, plugin?.id, plugin?.activeVersion, plugin?.archiveSha256, sourceId, identity?.avatar]);
+  const avatar = identity?.avatar;
+  const showImage = avatar && avatar.length <= 700_000 && /^data:image\/png;base64,[A-Za-z0-9+/]+={0,2}$/.test(avatar) && failed !== imageKey;
+  return <div ref={ref} className="flex min-w-0 items-center gap-2 text-xs text-muted-foreground" data-plugin-author-row>
+    <span className="inline-flex h-5 w-5 shrink-0 items-center justify-center overflow-hidden rounded-full bg-muted/60" aria-hidden="true">
+      {showImage ? <img src={avatar} alt="" width={20} height={20} className="h-full w-full object-cover" onError={() => setFailed(imageKey)} />
+        : <UserRound size={13} data-plugin-author-placeholder />}
+    </span>
+    <span className="min-w-0 truncate" title={author}>{author}</span>
+    {identity?.officialMaintained === true && <Badge className="shrink-0 whitespace-nowrap border-0 bg-amber-500/15 px-2 py-0.5 text-[10px] font-medium text-amber-800 hover:bg-amber-500/15 dark:bg-amber-400/15 dark:text-amber-300 dark:hover:bg-amber-400/15"
+      title={t('settings.plugins.author.officialMeaning')} data-plugin-official-maintainer>{t('settings.plugins.author.official')}</Badge>}
+  </div>;
+}

components/plugins/PluginPermissionHost.tsx

@@ -0,0 +1,50 @@
+import { usePluginPermissionPrompt } from '../../application/state/usePluginPermissionPrompt';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { describePluginPermission } from '@/domain/pluginPermissionDescriptions.cjs';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
+import { Button } from '../ui/button';
+import globalAgentToolSpecs from '../../infrastructure/ai/harness/generated/globalAgentToolSpecs.json';
+
+/** Rendered only by the trusted app, never inside a plugin view. */
+export function PluginPermissionHost() {
+  const { resolvedLocale } = useI18n();
+  const zh = resolvedLocale.startsWith('zh');
+  const { prompt, busy, respond } = usePluginPermissionPrompt();
+  if (!prompt) return null;
+  const description = describePluginPermission(prompt.permission, resolvedLocale);
+  const resources = prompt.resources.filter((resource) => resource !== '*' && !resource.startsWith('selected:'));
+  const action = prompt.displayContext?.action;
+  const operation = action && (globalAgentToolSpecs.find((tool) => tool.capabilityId === action.capabilityId)?.toolName ?? action.capabilityId);
+  const selections = prompt.displayContext?.selections ?? [];
+  return <Dialog open onOpenChange={(open) => { if (!open) void respond('cancel'); }}>
+    <DialogContent data-host-security-surface="" className="max-h-[85vh] overflow-y-auto sm:max-w-[480px]">
+      <DialogHeader>
+        <DialogTitle>{description.label}</DialogTitle>
+        <DialogDescription className="break-words">{prompt.pluginName ?? prompt.pluginId} · {prompt.pluginVersion}</DialogDescription>
+      </DialogHeader>
+      <p className="text-sm">{description.description}</p>
+      {prompt.displayContext?.modelLabel && <p className="text-sm break-words">{zh ? '模型' : 'Model'}: {prompt.displayContext.modelLabel}</p>}
+      {action && <div className="space-y-1">
+        <p className="text-sm break-words">{zh ? '操作' : 'Operation'}: <code>{operation}</code>{operation !== action.capabilityId && <> ({action.capabilityId})</>}</p>
+        <p className="text-sm">{zh ? '请求内容（控制字符以转义形式显示）' : 'Requested action (control characters shown as escapes)'}</p>
+        <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words rounded border border-border p-2 text-xs">{action.text}</pre>
+      </div>}
+      {(selections.length > 0 || prompt.permission === 'ai.agent.actions') && <div className="space-y-1">
+        <p className="text-sm">{zh ? '目标' : 'Targets'}:{selections.length === 0 && (zh ? ' 未选择目标' : ' No targets selected')}</p>
+        {selections.map((item, index) => <p key={index} className="text-sm break-words">
+          {item.title} <span className="text-xs text-muted-foreground">· {item.scope}</span>
+        </p>)}
+      </div>}
+      {(prompt.relatedPermissions ?? []).filter((item, index, items) => items.findIndex((other) => other.permission === item.permission) === index).map((item, index) => <div key={index} className="space-y-1 text-sm">
+        <p>{describePluginPermission(item.permission, resolvedLocale).description}</p>
+        <p className="text-xs text-muted-foreground break-all">{item.resources.filter((resource) => !resource.startsWith('selected:')).join(', ')}</p>
+      </div>)}
+      <p className="text-xs text-muted-foreground break-all">{prompt.pluginId}</p>
+      {resources.length > 0 && <ul className="max-h-44 overflow-auto space-y-1 text-xs text-muted-foreground">{resources.map((resource) => <li key={resource} className="break-all">{resource}</li>)}</ul>}
+      <DialogFooter>
+        <Button variant="outline" disabled={busy} onClick={() => void respond('deny')}>{zh ? '拒绝' : 'Deny'}</Button>
+        <Button disabled={busy} onClick={() => void respond('allow')}>{prompt.sessionId && prompt.allowedScopes && !prompt.allowedScopes.includes('once') ? zh ? '允许此会话' : 'Allow for this session' : zh ? '允许此次操作' : 'Allow this operation'}</Button>
+      </DialogFooter>
+    </DialogContent>
+  </Dialog>;
+}

components/settings/settings-ui.tsx

@@ -203,6 +203,7 @@ export const SettingCard: React.FC<SettingCardProps> = ({
 interface SettingRowProps {
   leading?: React.ReactNode;
   label?: React.ReactNode;
+  className?: string;
   description?: React.ReactNode;
   children: React.ReactNode;
   align?: "center" | "start";
@@ -213,6 +214,7 @@ interface SettingRowProps {
 export const SettingRow: React.FC<SettingRowProps> = ({
   leading,
   label,
+  className,
   description,
   children,
   align = "center",
@@ -225,6 +227,7 @@ export const SettingRow: React.FC<SettingRowProps> = ({
       // Keep square corners: rounded rows bend divide-y separators at both ends.
       "flex justify-between py-3 gap-4",
       align === "start" ? "items-start" : "items-center",
+      className,
     )}
   >
     {leading && <div className="shrink-0">{leading}</div>}

components/settings/tabs/PluginAuthorIdentityRefresh.test.tsx

@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { JSDOM } from 'jsdom';
+import { EventEmitter } from 'node:events';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+import { usePluginAuthorIdentity } from '../../../application/state/usePluginAuthorIdentity';
+import { checkPluginUpdates } from '../../../infrastructure/services/pluginUpdateCheck';
+
+const require = createRequire(import.meta.url);
+const { PluginDatabase } = require('../../../electron/plugins/database.cjs');
+const { MarketSourcesService } = require('../../../electron/plugins/marketSourcesService.cjs');
+const { OFFICIAL_SOURCE } = require('../../../electron/plugins/sourceIdentity.cjs');
+const { registerPluginBridge, CHANNELS } = require('../../../electron/plugins/pluginBridge.cjs');
+const { createPreloadApi } = require('../../../electron/preload/api.cjs');
+const { catalog, delivery, makeFiles, read, digest } = require('../../../electron/plugins/fixtures/staticDistributionFixture.cjs');
+
+test('mounted installed authors follow actual catalog/update/source entrypoints without changing package identity', async () => {
+  const rootPath = mkdtempSync(join(tmpdir(), 'netcatty-author-refresh-'));
+  const database = new PluginDatabase(join(rootPath, 'plugins.sqlite'));
+  const dom = new JSDOM('<!doctype html><div id="root"></div>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const [key, value] of Object.entries({ window: dom.window, document: dom.window.document,
+    navigator: dom.window.navigator, HTMLElement: dom.window.HTMLElement, Element: dom.window.Element,
+    Node: dom.window.Node, IntersectionObserver: undefined, IS_REACT_ACT_ENVIRONMENT: true })) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  }
+  const entry = structuredClone(catalog[0]);
+  entry.artifact = { sha256: 'a'.repeat(64), url: `${OFFICIAL_SOURCE.origin}/assets/${'a'.repeat(64)}.ncpkg` };
+  const bytes = read(delivery.plugins[0].iconLight.path.slice(1));
+  const avatar = { path: `/assets/${digest(bytes)}.png`, sha256: digest(bytes), size: bytes.length };
+  const filesFor = (entries = [entry], image = true) => {
+    const files = makeFiles(entries, (index: { plugins: Array<{ id: string; versions: Array<{ distribution: string }> }> }, sidecar: { schemaVersion: number; plugins: Array<{ id: string; avatar: typeof avatar | null; artifact: { path: string; sha256: string; size: number } }> }) => {
+      sidecar.schemaVersion = 2;
+      for (const item of sidecar.plugins) {
+        item.avatar = image ? avatar : null;
+        item.artifact = { path: `/assets/${entry.artifact.sha256}.ncpkg`, sha256: entry.artifact.sha256, size: 1 };
+        index.plugins.find((plugin) => plugin.id === item.id).versions[0].distribution = 'release';
+      }
+    });
+    files.set(avatar.path, bytes); return files;
+  };
+  let files = filesFor();
+  database.installVersion({ pluginId: entry.id, version: entry.version, runtimeKind: "browser", apiVersion: "0.1.0-internal.1", manifest: entry.manifest, archiveSha256: entry.artifact.sha256,
+    packageRelativePath: 'packages/synthetic', source: OFFICIAL_SOURCE }, { enable: true });
+  const manager = { initialize: async () => {}, list: async () => database.listPlugins(),
+    changeMarketSource: async (change: () => unknown) => change() };
+  let avatarReads = 0;
+  const service = new MarketSourcesService({ database, manager,
+    fetch: async (url: string) => { assert.equal(new URL(url).origin, OFFICIAL_SOURCE.origin); assert.ok(!new URL(url).pathname.endsWith('.ncpkg'), 'rejected selection never downloads a package'); return new Response(files.get(new URL(url).pathname)); },
+    createSourceFetch: (origin: string) => async (url: string) => { assert.equal(new URL(url).origin, origin); return new Response(files.get(new URL(url).pathname)); },
+    resolveAvatar: async () => { avatarReads++; return 'data:image/png;base64,eA=='; } });
+  const ipcMain = { handlers: new Map(), handle(channel: string, handler: unknown) { this.handlers.set(channel, handler); }, on() {} };
+  const events = new EventEmitter();
+  registerPluginBridge(ipcMain, { manager, catalogService: service, isTrustedSender: () => true,
+    broadcast: (channel: string, payload: unknown) => events.emit(channel, {}, payload) });
+  const api = createPreloadApi({ ipcRenderer: { on: events.on.bind(events), removeListener: events.removeListener.bind(events),
+    invoke: (channel: string, payload: unknown) => ipcMain.handlers.get(channel)({}, payload) } });
+  let authorCalls = 0;
+  const original = api.getPluginAuthorPresentation;
+  api.getPluginAuthorPresentation = (request: NetcattyPluginAuthorRequest) => { authorCalls++; return original(request); };
+  Object.assign(window, { netcatty: api });
+  let plugin = database.getActivePlugin(entry.id) as NetcattyInstalledPlugin;
+  function Row() {
+    const { ref, identity } = usePluginAuthorIdentity({ plugin });
+    return <div ref={ref} data-author={identity?.author} data-avatar={identity?.avatar} data-official={identity?.officialMaintained ?? false} />;
+  }
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const row = () => document.querySelector<HTMLElement>('[data-official]')!;
+  try {
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(avatarReads, 0, 'opening installed rows never fetches a catalog/avatar');
+    await act(async () => { await checkPluginUpdates(api); });
+    assert.equal(row().dataset.author, entry.author); assert.equal(row().dataset.official, 'true');
+    assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 1, 'rows share one preload subscription');
+    const count = authorCalls;
+    await act(async () => { await api.listPluginCatalog('official'); root.render(<><Row /><Row /></>); });
+    assert.equal(authorCalls, count, 'equivalent catalog and installation retain request dedupe');
+    files = filesFor([{ ...entry, author: 'Updated project name' }], false);
+    await act(async () => { await api.listPluginCatalog('official'); });
+    assert.equal(row().dataset.author, 'Updated project name'); assert.equal(row().dataset.avatar, undefined);
+    const beforeWithdrawal = (await api.listPluginCatalog('official')).entries[0];
+    files = filesFor([]);
+    await act(async () => {
+      await assert.rejects(api.installCatalogPlugin(entry.id, beforeWithdrawal.selectionToken, 'official'), /not in the curated catalog|changed/);
+    });
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(row().dataset.avatar, undefined, 'rejected install refresh removes withdrawn enrichment without another list or remount');
+
+    const source = await api.addPluginSource({ name: 'Community', address: 'https://community.example.com' });
+    const community = structuredClone(entry);
+    community.id = community.manifest.id = 'com.community.identity';
+    community.artifact.url = `${source.origin}/assets/${community.artifact.sha256}.ncpkg`;
+    files = filesFor([community]);
+    database.installVersion({ pluginId: community.id, version: community.version, manifest: community.manifest,
+      archiveSha256: community.artifact.sha256, packageRelativePath: 'packages/community', source }, { enable: true });
+    await act(async () => { await api.listPluginCatalog(source.id); });
+    assert.equal(authorCalls, count + 4, 'unrelated source changes do not reload official rows');
+    plugin = database.getActivePlugin(community.id);
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, community.author); assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(row().dataset.official, 'false', 'copied catalog never gains official maintenance authority');
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: false }); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: true }); });
+    assert.equal(row().dataset.author, community.author);
+    await act(async () => { await api.removePluginSource(source.id, false); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => root.unmount());
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 0, 'last row releases the shared IPC listener');
+  } finally {
+    database.close(); dom.window.close(); rmSync(rootPath, { recursive: true, force: true });
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginAuthorRow.test.tsx

@@ -0,0 +1,116 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { JSDOM } from 'jsdom';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
+import { I18nProvider } from '../../../application/i18n/I18nProvider';
+
+const entry = { id: 'com.netcatty.starter', name: 'Starter', author: 'Netcatty', version: '0.1.2',
+  repository: 'binaricat/Netcatty', commit: 'a'.repeat(40), selectionToken: 'b'.repeat(64),
+  manifest: { publisher: 'netcatty' } } as NetcattyPluginCatalogEntry;
+const identity = { author: 'Netcatty', avatar: 'data:image/png;base64,eA==', officialMaintained: true,
+  sourceId: 'official', version: entry.version, archiveSha256: null };
+
+test('untrusted entry strings and absent imagery produce a compact placeholder without an official badge', () => {
+  const claimed = { ...entry, author: '<img src="https://avatars.githubusercontent.com/u/1">',
+    officialMaintained: true, avatar: 'https://avatars.githubusercontent.com/u/1' };
+  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginAuthorRow entry={claimed} /></I18nProvider>);
+  assert.match(html, /data-plugin-author-placeholder/);
+  assert.doesNotMatch(html, /<img|data-plugin-official-maintainer/);
+  assert.match(html, /&lt;img/);
+  assert.match(html, /items-center/);
+});
+
+test('mounted author rows load only when visible, retain fallbacks, cancel stale results and show a borderless themed maintainer pill', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  const observers: Array<{ target: Element | null; callback: IntersectionObserverCallback }> = [];
+  class VisibilityObserver {
+    record: typeof observers[number];
+    constructor(callback: IntersectionObserverCallback) { this.record = { callback, target: null }; observers.push(this.record); }
+    observe(target: Element) { this.record.target = target; }
+    disconnect() { this.record.target = null; }
+  }
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('IntersectionObserver', VisibilityObserver);
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const calls: NetcattyPluginAuthorRequest[] = [];
+  const pending: Array<(value: NetcattyPluginAuthorPresentation | null) => void> = [];
+  Object.assign(window, { netcatty: { getPluginAuthorPresentation: (request: NetcattyPluginAuthorRequest) => {
+    calls.push(request); return new Promise((resolve) => pending.push(resolve));
+  } } });
+  const render = async (value = entry, sourceId = 'official') => {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow entry={value} sourceId={sourceId} /></I18nProvider>));
+  };
+  const visible = async () => {
+    await act(async () => {
+      for (const observer of [...observers]) if (observer.target) observer.callback([{ target: observer.target, isIntersecting: true } as IntersectionObserverEntry], {} as IntersectionObserver);
+    });
+  };
+  try {
+    await render(); assert.equal(calls.length, 0); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    await visible(); assert.deepEqual(calls[0], { kind: 'catalog', pluginId: entry.id, selectionToken: entry.selectionToken, sourceId: 'official' });
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'), 'loading uses the default placeholder');
+    await act(async () => pending.shift()!(identity));
+    const image = document.querySelector('img')!;
+    assert.equal(image.getAttribute('src'), identity.avatar); assert.equal(image.width, 20); assert.equal(image.height, 20);
+    const badge = document.querySelector<HTMLElement>('[data-plugin-official-maintainer]')!;
+    assert.equal(badge.textContent, 'Official maintainer'); assert.match(badge.title, /not a safety certification/);
+    assert.ok(badge.classList.contains('border-0'));
+    assert.ok(badge.classList.contains('bg-amber-500/15')); assert.ok(badge.classList.contains('dark:bg-amber-400/15'));
+    assert.ok(badge.classList.contains('text-amber-800')); assert.ok(badge.classList.contains('dark:text-amber-300'));
+    document.documentElement.classList.add('dark');
+    assert.ok(document.querySelector('[data-plugin-author-row]')?.classList.contains('items-center'));
+    await act(async () => image.dispatchEvent(new Event('error')));
+    assert.equal(document.querySelector('img'), null); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    assert.ok(document.querySelector('[data-plugin-official-maintainer]'), 'image failure does not alter maintenance identity');
+
+    const next = { ...entry, selectionToken: 'c'.repeat(64) };
+    await render(next); assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    await visible(); const stale = pending.shift()!;
+    const copied = { ...entry, author: 'Community author', selectionToken: 'd'.repeat(64) };
+    await render(copied, 'third-party:copy'); await visible();
+    await act(async () => stale(identity));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    assert.match(document.querySelector('[data-plugin-author-row]')!.textContent!, /Community author/);
+    await act(async () => pending.shift()!({ ...identity, author: copied.author, sourceId: 'third-party:copy', officialMaintained: false, avatar: 'https://avatars.githubusercontent.com/u/1' }));
+    assert.equal(document.querySelector('img'), null, 'renderer never uses a remote avatar URL');
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+
+    await render({ ...entry, selectionToken: 'f'.repeat(64) }); await visible();
+    await act(async () => pending.shift()!({ ...identity, avatar: null, officialMaintained: false }));
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    const installed = { id: entry.id, activeVersion: entry.version, archiveSha256: 'a'.repeat(64),
+      source: { id: 'official', kind: 'official', origin: 'https://plugins.netcatty.app', name: 'Official' },
+      manifest: entry.manifest, runtime: {} } as NetcattyInstalledPlugin;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={installed} /></I18nProvider>));
+    await visible(); assert.deepEqual(calls.at(-1), { kind: 'installed', pluginId: installed.id });
+    await act(async () => pending.shift()!({ ...identity, version: '9.0.0', archiveSha256: installed.archiveSha256! }));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null, 'a stale installed version cannot gain a badge');
+    const count = calls.length;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={{ ...installed }} /></I18nProvider>));
+    await visible(); assert.equal(calls.length, count, 'unchanged installed identity does not reload on a new object reference');
+
+    await render({ ...entry, selectionToken: 'e'.repeat(64) }); await visible();
+    const late = pending.shift()!;
+    await act(async () => root.unmount());
+    await act(async () => late(identity));
+    assert.equal(document.querySelector('[data-plugin-author-row]'), null);
+    assert.ok(observers.every((observer) => observer.target === null));
+  } finally {
+    dom.window.close();
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginInstalledGrid.test.tsx

@@ -32,7 +32,9 @@ test('installed grid filters, opens one detail and restores search, scroll and c
     assert.equal(cards().length, 2);
     const alphaCard = renderer.root.findAllByType('article')[0];
     assert.match(JSON.stringify(renderer.toJSON()), /Alpha safely formats synthetic greetings/);
-    assert.ok(alphaCard.findAllByType('p').some((node) => node.children.includes('Example')), 'author has its own line');
+    const authorRow = alphaCard.findByProps({ 'data-plugin-author-row': true });
+    assert.ok(authorRow.findAllByType('span').some((node) => node.children.includes('Example')), 'author has its own compact row');
+    assert.ok(authorRow.findByProps({ 'data-plugin-author-placeholder': true }), 'an unverified installed publisher has a default avatar');
     assert.ok(alphaCard.findAllByType('p').some((node) => node.props.className?.includes('line-clamp-3')), 'card description is bounded');
     assert.match(JSON.stringify(renderer.toJSON()), /MIT/);
     assert.match(JSON.stringify(renderer.toJSON()), /Incompatible version/);

components/settings/tabs/PluginLogSettings.tsx

@@ -19,7 +19,7 @@ export function PluginLogSettings() {
   const disclosure = zh
     ? '插件编写的日志文字可能包含敏感数据。截断和字段过滤不能保证任意文字安全。只为排查问题临时开启，导出前请检查。重启应用后自动关闭详细日志。'
     : 'Plugin-authored text may contain sensitive data. Truncation and field filtering cannot make arbitrary text safe. Enable temporarily for troubleshooting and review files before sharing. Verbose diagnostics turn off after app restart.';
-  return <div data-host-security-surface="">
+  return <div>
     <Dialog open={open} onOpenChange={setOpen}>
       <SettingRow label={title} description={zh ? '选择是否在此设备保存审计记录和诊断日志。' : 'Choose whether to keep audit records and diagnostics on this device.'}>
         <div className="flex items-center gap-3">
@@ -53,6 +53,6 @@ export function PluginLogSettings() {
         </DialogFooter>
       </DialogContent>
     </Dialog>
-    <ConfirmDialog open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
+    <ConfirmDialog hostSecuritySurface open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
   </div>;
 }

components/settings/tabs/PluginManagementDialog.interaction.test.tsx

@@ -68,6 +68,11 @@ test('plugin manager is single-instance, closes with Escape, restores focus and
     })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
     await click(trigger);
     await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
+    // Radix schedules close-focus cleanup after the React close commit. The
+    // settle inside click's act() can precede that commit; observe the actual
+    // handoff instead of assuming the cleanup timer already ran.
+    const handoffDeadline = Date.now() + 2_000;
+    while (!handedOff && Date.now() < handoffDeadline) await act(async () => { await settle(); });
     assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
     function ControlledEntry() {
       const [open, setOpen] = useState(false);

components/settings/tabs/PluginMarketplace.interaction.test.tsx

@@ -88,7 +88,11 @@ test('README failure leaves the permissions and source visible, before the failu
     selected={entries[0].id} onSelect={() => {}} installed={[]} /></I18nProvider>);
   assert.match(html, /Compatibility and permissions/);
   assert.match(html, /settings.read/);
-  assert.match(html, /not a grant/);
+  assert.match(html, /Declared supported capabilities default to Allow/);
+  assert.match(html, /Ask or Deny/);
+  assert.match(html, /Host validation and resource scope always apply/);
+  assert.match(html, /Host validation and the selected permission mode still apply/);
+  assert.doesNotMatch(html, /Check the actual scope in the permission prompt/);
   assert.match(html, /Source example/);
   assert.ok(html.indexOf('settings.read') < html.indexOf('Network unavailable'));
   assert.match(html, /Retry/);

components/settings/tabs/PluginMarketplace.tsx

@@ -4,6 +4,7 @@ import { Dialog, DialogContent, DialogDescription, DialogTitle } from '../../ui/
 import { PluginInfo } from './PluginInfo';
 import React, { useRef, useState } from 'react';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { useI18n } from '../../../application/i18n/I18nProvider';
 import { usePluginCatalog } from '../../../application/state/usePluginCatalog';
@@ -82,7 +83,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
           return <button key={item.id} type="button" data-plugin-id={item.id} aria-current={selected === item.id ? 'true' : undefined} onClick={() => choose(item.id)}
             className="plugin-card min-w-0 flex min-h-[200px] flex-col gap-3 rounded-lg bg-card p-4 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring">
             <div className="flex items-center gap-3"><span className="flex h-8 w-8 shrink-0 items-center justify-center"><PluginBrandIcon entry={item} size={32} className="text-muted-foreground" /></span><span className="min-w-0 break-words text-sm font-semibold leading-5">{item.name}</span></div>
-            <p className="break-words text-xs text-muted-foreground">{item.author}</p>
+            <PluginAuthorRow entry={item} sourceId={sourceId} />
             <p className="line-clamp-3 break-words text-sm leading-5 text-muted-foreground">{item.description}</p>
             <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1 text-xs text-muted-foreground"><span>{item.version} · {item.license}</span><span className="text-foreground">{t('settings.plugins.manager.details')}</span></div>
             <div className="flex flex-wrap gap-2 text-xs text-muted-foreground">{isInstalled && <span className="rounded bg-muted px-2 py-0.5 text-foreground">{t('settings.plugins.market.installed')}</span>}{!item.artifact && <span className="rounded bg-muted/40 px-2 py-0.5">{t('settings.plugins.market.sourceBadge')}</span>}</div>
@@ -91,7 +92,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
       </div>}
       {entry && <article key={entry.id} aria-label={entry.name} className="plugin-marketplace-detail mx-auto w-full max-w-[920px] min-w-0 space-y-6 focus:outline-none">
         <Button variant="ghost" size="sm" onClick={back}><ArrowLeft size={14} className="mr-2" />{t('settings.plugins.market.back')}</Button>
-        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><p className="text-xs text-muted-foreground">{entry.author} · {entry.version} · {entry.license}</p>
+        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><PluginAuthorRow entry={entry} sourceId={sourceId} /><p className="text-xs text-muted-foreground">{entry.version} · {entry.license}</p>
           {installedEntry && <p className="text-xs text-muted-foreground">{t('settings.plugins.market.installed')} · {installedEntry.activeVersion} · {t(installedEntry.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}</p>}
         </div>
         {installedEntry?.runtime?.lastError && <p role="status" className="break-words text-xs text-destructive">{t('settings.plugins.manager.lastError')}: {installedEntry.runtime.lastError}</p>}

components/settings/tabs/PluginPackageManager.test.tsx

@@ -19,9 +19,16 @@ test('package detail renders manifest resources as text and explains advanced au
   } as NetcattyInstalledPlugin;
   const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginPackageDetails plugin={plugin} /></I18nProvider>);
   assert.match(html, /full Node filesystem and network authority/);
+  assert.match(html, /Broker permissions cannot restrict this access/);
+  assert.match(html, /Development preview only/);
   assert.match(html, /https:\/\/example.com/);
   assert.match(html, /&lt;script&gt;/);
   assert.doesNotMatch(html, /<script>/);
-  assert.match(html, /not a grant/);
+  assert.match(html, /Declared supported capabilities default to Allow/);
+  assert.match(html, /Ask or Deny/);
+  assert.match(html, /Host validation and resource scope always apply/);
+  assert.match(html, /this capability may expose private data/);
+  assert.match(html, /mode can be changed in permission settings/);
+  assert.doesNotMatch(html, /before granting/);
   assert.match(html, /aaaaaaaaaaaaaaaa/);
 });

components/settings/tabs/PluginPackageManager.tsx

@@ -3,6 +3,7 @@ import { describePluginRuntime } from '@/domain/pluginRuntimePolicy.cjs';
 import React, { useRef, useState } from 'react';
 import { PluginPermissionPanel } from './PluginPermissionPanel';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { usePluginManager } from '../../../application/state/usePluginManager';
 import { useI18n } from '../../../application/i18n/I18nProvider';
@@ -103,7 +104,7 @@ export function PluginPackageManager({ manager, onSelectionChange, initialSelect
         </Button>
       </div>
       <p className="break-all text-xs text-muted-foreground">{t('settings.plugins.sources.source')}: {t(plugin.source?.kind === 'official' ? 'settings.plugins.sources.official' : plugin.source?.kind === 'third-party' ? 'settings.plugins.sources.thirdparty' : 'settings.plugins.sources.local')}{plugin.source?.origin ? ` · ${plugin.source.origin}` : ''}</p>
-      {plugin.manifest?.publisher && <p className="break-words text-xs text-muted-foreground">{plugin.manifest.publisher}</p>}
+      {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
       <p className={`break-words text-sm leading-5 text-muted-foreground ${selectedPlugin ? 'whitespace-pre-wrap' : 'line-clamp-3'}`}>{descriptionOf(plugin) || t('settings.plugins.manager.noDescription')}</p>
       {!selectedPlugin ? <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1">
         <p className="break-words text-xs text-muted-foreground">{plugin.activeVersion}{plugin.manifest?.license ? ` · ${plugin.manifest.license}` : ''}</p>

components/settings/tabs/PluginPermissionPanel.tsx

@@ -3,6 +3,8 @@ import { netcattyBridge } from '../../../infrastructure/services/netcattyBridge'
 import { useI18n } from '../../../application/i18n/I18nProvider';
 import { describePluginPermission } from '@/domain/pluginPermissionDescriptions.cjs';
 import { Button } from '../../ui/button';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../../ui/select';
+import { SettingRow } from '../settings-ui';
 
 /** Host UI only. Plugin views cannot query or mutate this security state. */
 export function PluginPermissionPanel({ pluginId, onChanged }: {
@@ -36,6 +38,17 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
     void refresh();
     return () => { requestGeneration.current++; };
   }, [refresh]);
+  const changeMode = async (permission: string, mode: PluginPermissionMode) => {
+    if (pending.current) return;
+    pending.current = true; setBusy(true); setError(null);
+    try {
+      const bridge = netcattyBridge.require();
+      if (!bridge.setPluginPermissionMode || !snapshot?.policyRevision) throw new Error(t('settings.plugins.permissions.unavailable'));
+      await bridge.setPluginPermissionMode(pluginId, permission, mode, snapshot.policyRevision);
+      await onChanged();
+    } catch (cause) { setError(cause instanceof Error ? cause.message : String(cause)); }
+    finally { await refresh(true); pending.current = false; setBusy(false); }
+  };
   const revoke = async () => {
     if (pending.current) return;
     pending.current = true;
@@ -61,9 +74,18 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
       <h4 className="font-medium">{t('settings.plugins.permissions.title')}</h4>
       <Button variant="ghost" size="sm" disabled={busy} onClick={() => void refresh()}>{t('settings.plugins.permissions.refresh')}</Button>
     </div>
+    <p className="text-xs text-muted-foreground">{t('settings.plugins.permissions.note')}</p>
     {error && <p role="alert" className="text-xs text-destructive">{error}</p>}
     {!snapshot && !error && <p role="status">{t('settings.plugins.permissions.loading')}</p>}
     {snapshot && <>
+      {(snapshot.policies ?? []).map((policy) => <SettingRow key={policy.permission}
+        label={describePluginPermission(policy.permission, resolvedLocale).label}
+        description={<span className="whitespace-pre-wrap break-all">{describePluginPermission(policy.permission, resolvedLocale).description}{' · '}{policy.resources.join(', ')}</span>}>
+        <Select value={policy.mode} disabled={busy} onValueChange={(mode) => void changeMode(policy.permission, mode as PluginPermissionMode)}>
+          <SelectTrigger className="w-28" aria-label={describePluginPermission(policy.permission, resolvedLocale).label}><SelectValue /></SelectTrigger>
+          <SelectContent>{(['allow', 'ask', 'deny'] as const).map((mode) => <SelectItem key={mode} value={mode}>{t(`settings.plugins.permissions.${mode}`)}</SelectItem>)}</SelectContent>
+        </Select>
+      </SettingRow>)}
       {snapshot.grants.length === 0 && <p className="text-xs text-muted-foreground">{t('settings.plugins.permissions.empty')}</p>}
       {snapshot.grants.map((grant, index) => <div key={index} className="rounded-md bg-muted/40 p-3 text-xs">
         <p className="font-medium">{describePluginPermission(grant.permission, resolvedLocale).label}</p>
@@ -76,7 +98,7 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
         <summary className="cursor-pointer">{t('settings.plugins.permissions.audit')}</summary>
         <ol className="mt-2 space-y-1">{snapshot.audit.map((entry, index) => <li key={index} className="break-words">
           <time dateTime={new Date(entry.createdAt).toISOString()}>{new Date(entry.createdAt).toLocaleString(resolvedLocale)}</time>{' · '}
-          {entry.event}{entry.permission ? ` · ${entry.permission}` : ''}{entry.scope ? ` · ${entry.scope}` : ''}
+          {entry.event}{entry.permission ? ` · ${entry.permission}` : ''}{entry.scope ? ` · ${entry.scope}` : ''}{entry.mode ? ` · ${t(`settings.plugins.permissions.${entry.mode}`)}` : ''}{entry.action ? ` · ${entry.action}` : ''}
         </li>)}</ol>
       </details>
       <p className="text-xs text-muted-foreground">{t('settings.plugins.permissions.revokeNote')}</p>

components/settings/tabs/PluginSettingsLanding.tsx

@@ -6,6 +6,7 @@ import type { usePluginManager } from '../../../application/state/usePluginManag
 import { Button } from '../../ui/button';
 import { Input } from '../../ui/input';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { SettingCard, SettingRow, SettingsSection, Toggle } from '../settings-ui';
 import { PluginLogSettings } from './PluginLogSettings';
 
@@ -72,7 +73,8 @@ export function PluginSettingsLanding({ manager, settingsAvailable, settingsErro
               <span className="truncate" title={name}>{name}</span>
               {plugin.activeVersion && <span className="shrink-0 text-xs font-normal text-muted-foreground">{plugin.activeVersion}</span>}
             </span>} description={<>
-              <span className="block break-words">{[plugin.manifest?.publisher, sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
+              {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
+              <span className="block break-words">{[sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
               {availableUpdate && <span className="block text-primary">{t('settings.plugins.landing.updateAvailable').replace('{version}', availableUpdate.availableVersion)}</span>}
               {description && <span className="line-clamp-2 break-words">{description}</span>}
             </>}>

components/settings/tabs/PluginSettingsVisibility.test.tsx

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { JSDOM } from 'jsdom';
+const require = createRequire(import.meta.url);
+
+test('real Settings landing leaves views visible while idle; log and Ask dialogs suspend and restore them', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div><div id="native-view-mount"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'Event', 'MouseEvent', 'KeyboardEvent', 'MutationObserver', 'DocumentFragment', 'CustomEvent']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginSettingsLanding } = await import('./PluginSettingsLanding');
+  const { PluginPermissionHost } = await import('../../plugins/PluginPermissionHost');
+  const { observePluginHostSecurityVisibility } = await import('../../../application/state/pluginHostSecurityVisibility');
+  const { PluginPermissionDecisionHost } = require('../../../electron/plugins/permissionDecisionHost.cjs');
+  type Prompt = NetcattyPluginPermissionPrompt | { requestId: string; closed: true };
+  const listeners = new Set<(event: Prompt) => void>();
+  const sender = Object.assign(new EventEmitter(), { isDestroyed: () => false, send: (_channel: string, event: Prompt) => { for (const listener of listeners) listener(event); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const host = new PluginPermissionDecisionHost({ getWindows: () => [owner], isLocked: () => false });
+  let logStatus = { saveToDisk: false, verbose: false, droppedRecords: 0, writeErrors: 0, pendingBytes: 0, maxBytes: 3145728, retentionDays: 7 };
+  Object.assign(dom.window, { netcatty: {
+    async getPluginLogStatus() { return logStatus; },
+    async configurePluginLogs(value: { saveToDisk: boolean; verbose: boolean }) { logStatus = { ...logStatus, ...value }; return logStatus; },
+    onPluginPermission(listener: (event: Prompt) => void) { listeners.add(listener); return () => listeners.delete(listener); },
+    setPluginPermissionReady: async (ready: boolean) => host.setReady(sender, ready),
+    respondPluginPermission: async (response: unknown) => host.respond(sender, response),
+  } });
+  const manager = { plugins: [], available: true, statusKnown: true, busy: false, error: null, credentialStorageAvailable: true,
+    async refresh() {}, async setEnabled() {}, async importPackage() {}, async uninstall() {} };
+  let visible = true;
+  const transitions: boolean[] = [];
+  const stopVisibility = observePluginHostSecurityVisibility(document.getElementById('native-view-mount')!, (next) => { visible = next; transitions.push(next); });
+  const root = createRoot(document.getElementById('root')!);
+  const button = (label: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((element) => element.textContent === label)!;
+  const flushVisibility = () => new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginSettingsLanding manager={manager} settingsAvailable={new Set()} onManage={() => {}} /><PluginPermissionHost /></I18nProvider>));
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.ok(button('Configure'), 'real idle logging row is present');
+    assert.equal(visible, true, 'idle Settings landing must not hide the native child');
+    assert.deepEqual(transitions, []);
+    await act(async () => button('Configure').click());
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'actual logging security dialog must hide the child');
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[0].click());
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[1].click());
+    await flushVisibility();
+    assert.equal(document.querySelectorAll('[role="dialog"]').length, 2);
+    assert.equal(visible, false, 'the verbose security confirmation must also keep the child hidden');
+    await act(async () => button('Cancel').click());
+    await flushVisibility();
+    assert.equal(visible, false, 'cancelling verbose returns to the protected logging dialog');
+    await act(async () => button('Close').click());
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(visible, true, 'closing logs must restore the child while its idle row remains');
+    let pending!: Promise<{ decision: string }>;
+    await act(async () => {
+      pending = host.request({ requestId: 'settings-visibility-ask', pluginId: 'com.example.settings-visibility', pluginName: 'Settings visibility fixture', pluginVersion: '1.0.0',
+        permission: 'settings.read', resources: ['*'], reason: 'Read own synthetic setting' });
+    });
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'Ask must still hide the child above the real landing');
+    await act(async () => { button('Deny').click(); await pending; });
+    await flushVisibility();
+    assert.equal((await pending).decision, 'deny');
+    assert.equal(visible, true, 'dismissing Ask must restore the same child');
+    assert.deepEqual(transitions, [false, true, false, true]);
+  } finally {
+    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/settings/tabs/SettingsAITab.tsx

@@ -1260,6 +1260,34 @@ const SettingsAITab: React.FC<SettingsAITabProps> = ({
         </TabsContent>
 
         <TabsContent value="tools" className="m-0 space-y-6">
+
+
+          <SettingsSection
+            anchorId="ai-tool-access-mode"
+            title={t('ai.toolAccess.title')}
+          >
+            <SettingCard>
+              <SettingRow className="flex-col items-start md:flex-row md:items-center" description={t('ai.toolAccess.description')}>
+                <div className="flex flex-wrap justify-end gap-2">
+                <Select
+                  value={toolIntegrationMode}
+                  options={[
+                    { value: 'mcp', label: t('ai.toolAccess.mode.mcp') },
+                    { value: 'skills', label: t('ai.toolAccess.mode.skills') },
+                  ]}
+                  onChange={(value) => setToolIntegrationMode(value as AIToolIntegrationMode)}
+                  className="w-48"
+                />
+                <ToolAccessGuidance mode={toolIntegrationMode} />
+                </div>
+              </SettingRow>
+            </SettingCard>
+          </SettingsSection>
+
+          <ExternalMcpCard />
+
+          <AIPrivacySection />
+
           <SettingsSection title={t('ai.chatShortcuts.title')}>
             <SettingCard divided>
               <SettingRow
@@ -1276,34 +1304,6 @@ const SettingsAITab: React.FC<SettingsAITabProps> = ({
             </SettingCard>
           </SettingsSection>
 
-          <SettingsSection
-            anchorId="ai-tool-access-mode"
-            title={t('ai.toolAccess.title')}
-          >
-            <SettingCard>
-              <SettingRow description={t('ai.toolAccess.description')}>
-                <Select
-                  value={toolIntegrationMode}
-                  options={[
-                    { value: 'mcp', label: t('ai.toolAccess.mode.mcp') },
-                    { value: 'skills', label: t('ai.toolAccess.mode.skills') },
-                  ]}
-                  onChange={(value) => setToolIntegrationMode(value as AIToolIntegrationMode)}
-                  className="w-48"
-                />
-              </SettingRow>
-              <div className="pb-4">
-                <ToolAccessGuidance mode={toolIntegrationMode} />
-              </div>
-            </SettingCard>
-          </SettingsSection>
-
-          <AIPrivacySection />
-
-          <SettingsSection anchorId="ai-external-mcp" title={t('ai.externalMcp.title')}>
-            <ExternalMcpCard />
-          </SettingsSection>
-
           <SettingsSection
             anchorId="ai-user-skills"
             title={t('ai.userSkills.title')}

components/settings/tabs/SettingsAppearanceTab.tsx

@@ -23,7 +23,7 @@ import {
 import { resolveAppIconVariant, type AppIconVariant } from "../../../domain/appIconVariant";
 import { resolveNoteFontSelectionFamily, resolveNoteFontSelectionId } from "../../../domain/noteFonts";
 import { DEFAULT_AUTO_IMPORT_SYSTEM_KNOWN_HOSTS } from "../../../domain/systemKnownHostsAutoImport";
-import { cn } from "../../../lib/utils";
+import { cn, isMacPlatform } from "../../../lib/utils";
 import { SectionHeader, SettingsAnchor, SettingsTabContent, SettingRow, Toggle, Select } from "../settings-ui";
 import { FontSelect } from "../FontSelect";
 import { TerminalFontSelect } from "../TerminalFontSelect";
@@ -69,6 +69,8 @@ function SettingsAppearanceTab(props: {
   setShowHostTreeSidebar: (enabled: boolean) => void;
   windowOpacity: number;
   setWindowOpacity: (opacity: number) => void;
+  windowBackgroundBlur: boolean;
+  setWindowBackgroundBlur: (enabled: boolean) => void;
   appIconVariant: AppIconVariant;
   setAppIconVariant: (variant: AppIconVariant) => void;
 }) {
@@ -140,10 +142,13 @@ function SettingsAppearanceTab(props: {
     setShowHostTreeSidebar,
     windowOpacity,
     setWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
     appIconVariant,
     setAppIconVariant,
   } = props;
   const resolvedAppIconVariant = resolveAppIconVariant(appIconVariant);
+  const isMac = isMacPlatform();
 
   const WINDOW_OPACITY_PRESETS = [
     { label: '100%', value: 1 },
@@ -315,6 +320,19 @@ function SettingsAppearanceTab(props: {
             </div>
           </div>
         </SettingRow>
+        {isMac && (
+          <SettingRow
+            anchorId="appearance-window-background-blur"
+            label={t("settings.appearance.windowBackgroundBlur")}
+            description={t("settings.appearance.windowBackgroundBlur.desc")}
+          >
+            <Toggle
+              checked={windowBackgroundBlur}
+              onChange={setWindowBackgroundBlur}
+              ariaLabel={t("settings.appearance.windowBackgroundBlur")}
+            />
+          </SettingRow>
+        )}
       </div>
 
       <SectionHeader title={t("settings.appearance.uiTheme")} />

components/settings/tabs/SettingsSystemTab.tsx

@@ -47,6 +47,8 @@ interface TempDirInfo {
   path: string;
   fileCount: number;
   totalSize: number;
+  isCustom: boolean;
+  defaultPath: string;
 }
 
 interface SshDebugLogInfo {
@@ -196,6 +198,9 @@ const SettingsSystemTab: React.FC<SettingsSystemTabProps> = ({
   const { t } = useI18n();
   const isMac = typeof navigator !== "undefined" && /Mac/i.test(navigator.platform);
 
+  const [tempDirInput, setTempDirInput] = useState("");
+  const [tempDirError, setTempDirError] = useState("");
+  const [tempDirBusy, setTempDirBusy] = useState(false);
   const [tempDirInfo, setTempDirInfo] = useState<TempDirInfo | null>(null);
   const [isLoading, setIsLoading] = useState(false);
   const [isClearing, setIsClearing] = useState(false);
@@ -235,6 +240,8 @@ const SettingsSystemTab: React.FC<SettingsSystemTabProps> = ({
     try {
       const info = await bridge.getTempDirInfo();
       setTempDirInfo(info);
+      if (info?.isCustom && info.path) setTempDirInput(info.path);
+      else if (info && !info.isCustom) setTempDirInput("");
     } catch (err) {
       console.error("[SettingsSystemTab] Failed to get temp dir info:", err);
     } finally {
@@ -363,6 +370,37 @@ const SettingsSystemTab: React.FC<SettingsSystemTabProps> = ({
     }
   }, [loadTempDirInfo]);
 
+  const applyTempDir = useCallback(async (dir: string) => {
+    const bridge = netcattyBridge.get();
+    if (!bridge?.setCustomTempDir) return;
+    setTempDirBusy(true);
+    setTempDirError("");
+    try {
+      const result = await bridge.setCustomTempDir(dir);
+      if (!result.ok) setTempDirError(result.error || t("settings.system.tempDirError"));
+      else { setTempDirInput(result.path || dir); await loadTempDirInfo(); }
+    } catch { setTempDirError(t("settings.system.tempDirError")); }
+    finally { setTempDirBusy(false); }
+  }, [loadTempDirInfo, t]);
+
+  const chooseTempDir = useCallback(async () => {
+    try {
+      const dir = await netcattyBridge.get()?.chooseTempDir?.();
+      if (dir) { setTempDirInput(dir); await applyTempDir(dir); }
+    } catch { setTempDirError(t("settings.system.tempDirError")); }
+  }, [applyTempDir, t]);
+
+  const resetTempDir = useCallback(async () => {
+    setTempDirBusy(true);
+    setTempDirError("");
+    try {
+      const result = await netcattyBridge.get()?.resetCustomTempDir?.();
+      if (!result?.ok) setTempDirError(result?.error || t("settings.system.tempDirError"));
+      else { setTempDirInput(""); await loadTempDirInfo(); }
+    } catch { setTempDirError(t("settings.system.tempDirError")); }
+    finally { setTempDirBusy(false); }
+  }, [loadTempDirInfo, t]);
+
   const handleOpenTempDir = useCallback(async () => {
     const bridge = netcattyBridge.get();
     if (!tempDirInfo?.path || !bridge?.openTempDir) return;
@@ -925,6 +963,18 @@ const SettingsSystemTab: React.FC<SettingsSystemTabProps> = ({
                 </Tooltip>
               </div>
 
+              <div className="space-y-2">
+                <div className="flex flex-wrap gap-2">
+                  <Button variant="outline" size="sm" onClick={chooseTempDir} disabled={tempDirBusy}>{t("settings.system.tempDirChoose")}</Button>
+                  {tempDirInfo?.isCustom && <Button variant="outline" size="sm" onClick={resetTempDir} disabled={tempDirBusy}>{t("settings.system.tempDirReset")}</Button>}
+                </div>
+                <div className="flex gap-2">
+                  <input className="min-w-0 flex-1 rounded-md border border-input bg-background px-3 py-1 text-sm" aria-label={t("settings.system.tempDirManual")} placeholder={t("settings.system.tempDirManual")} value={tempDirInput} onChange={e => setTempDirInput(e.target.value)} />
+                  <Button variant="outline" size="sm" onClick={() => applyTempDir(tempDirInput)} disabled={tempDirBusy}>{t("settings.system.tempDirApply")}</Button>
+                </div>
+                {tempDirError && <p role="alert" className="text-sm text-destructive">{t("settings.system.tempDirError")} {tempDirError}</p>}
+              </div>
+
               {/* Stats */}
               <div className="flex items-center gap-6 text-sm">
                 <div>

components/settings/tabs/ai/AIPrivacySection.test.tsx

@@ -1,183 +1,154 @@
 import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
 import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { I18nProvider } from '../../../../application/i18n/I18nProvider';
+import React, { act } from 'react';
+import { JSDOM } from 'jsdom';
 import { STORAGE_KEY_AI_PRIVACY } from '../../../../infrastructure/config/storageKeys';
-import { AIPrivacySection } from './AIPrivacySection';
 
-function installEnvironment(setConfig: (config: unknown) => Promise<unknown>) {
-  const values = new Map<string, string>();
-  const events = new EventTarget();
-  const globals = {
-    IS_REACT_ACT_ENVIRONMENT: true,
-    localStorage: {
-      getItem: (key: string) => values.get(key) ?? null,
-      setItem: (key: string, value: string) => values.set(key, value),
-    },
-    window: {
-      netcatty: { externalMcpSetConfig: setConfig },
-      addEventListener: events.addEventListener.bind(events),
-      removeEventListener: events.removeEventListener.bind(events),
-      dispatchEvent: events.dispatchEvent.bind(events),
-    },
-  };
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  for (const [name, value] of Object.entries(globals)) {
-    previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
-    Object.defineProperty(globalThis, name, { value, configurable: true, writable: true });
-  }
-  return {
-    values,
-    restore: () => {
-      for (const [name, descriptor] of previous) {
-        if (descriptor) Object.defineProperty(globalThis, name, descriptor);
-        else Reflect.deleteProperty(globalThis, name);
-      }
-    },
-  };
+const dom = new JSDOM('<div id="root"></div>', { url: 'http://localhost/#/settings' });
+for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'HTMLTextAreaElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'FocusEvent', 'getComputedStyle', 'localStorage'] as const) {
+  Object.defineProperty(globalThis, key, { value: dom.window[key], configurable: true });
+}
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true, requestAnimationFrame: (fn: () => void) => setTimeout(fn, 0), cancelAnimationFrame: clearTimeout });
+const { createRoot } = await import('react-dom/client');
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { AIPrivacySection } = await import('./AIPrivacySection');
+
+async function mount(setConfig: (config: unknown) => Promise<unknown> = async () => ({ ok: true }), saved?: string) {
+  dom.window.localStorage.clear();
+  if (saved) dom.window.localStorage.setItem(STORAGE_KEY_AI_PRIVACY, saved);
+  Object.assign(window, { netcatty: { externalMcpSetConfig: setConfig } });
+  const root = createRoot(document.getElementById('root')!);
+  await act(async () => root.render(<I18nProvider locale="en"><AIPrivacySection /></I18nProvider>));
+  return async () => { await act(async () => root.unmount()); };
+}
+const button = (text: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((el) => el.textContent === text)!;
+const click = async (text: string) => { await act(async () => button(text).click()); };
+async function input(index: number, value: string) {
+  const el = document.querySelectorAll('textarea')[index];
+  await act(async () => {
+    Object.getOwnPropertyDescriptor(dom.window.HTMLTextAreaElement.prototype, 'value')!.set!.call(el, value);
+    el.dispatchEvent(new dom.window.Event('input', { bubbles: true }));
+  });
 }
 
-function view() {
-  return <I18nProvider locale="en"><AIPrivacySection /></I18nProvider>;
-}
-
-test('privacy settings default off and explain their limits and connection scope', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('privacy overview is persisted state; configuration preserves the full scope and atomic draft', async () => {
+  const unmount = await mount();
   try {
-    await act(async () => { renderer = create(view()); });
-    const markup = JSON.stringify(renderer!.toJSON());
-    assert.equal(renderer!.root.findAllByType('button').filter((node) => node.props['aria-checked'] === false).length, 2);
-    assert.match(markup, /cannot detect every secret/);
-    assert.match(markup, /AI privacy/);
-    assert.match(markup, /Catty, integrated agents and external MCP clients/);
-    assert.match(markup, /Only Netcatty-managed data and tools are covered/);
-    assert.match(markup, /native tools, direct file access and other MCP servers/);
-    assert.match(markup, /Binary tool responses are blocked/);
-    assert.match(markup, /one managed conversation or external MCP connection/);
-    assert.match(markup, /reconnect external MCP clients/);
-    assert.match(markup, /start a new managed conversation/);
-    assert.match(markup, /Additional IP ranges/);
-    assert.match(markup, /Custom regular expressions/);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.equal(document.querySelector('textarea'), null);
+    assert.match(document.body.textContent!, /Text redaction disabled/);
+    await click('Configure privacy');
+    const dialog = document.querySelector('[role="dialog"]')!;
+    assert.match(dialog.textContent!, /cannot detect every secret/);
+    assert.match(dialog.textContent!, /Catty, integrated agents and external MCP clients/);
+    assert.match(dialog.textContent!, /Only Netcatty-managed data and tools are covered/);
+    assert.match(dialog.textContent!, /native tools, direct file access and other MCP servers/);
+    assert.match(dialog.textContent!, /Binary tool responses are blocked/);
+    assert.match(dialog.textContent!, /one managed conversation or external MCP connection/);
+    assert.match(dialog.textContent!, /reconnect external MCP clients/);
+    assert.equal(dialog.querySelectorAll('[role="switch"][aria-checked="false"]').length, 2);
+    assert.equal(button('Apply').disabled, true);
+  } finally { await unmount(); }
 });
 
-test('AI privacy is shared Tool Access UI, not nested under External MCP', async () => {
-  const settingsTab = await readFile(new URL('../SettingsAITab.tsx', import.meta.url), 'utf8');
-  const externalCard = await readFile(new URL('./ExternalMcpCard.tsx', import.meta.url), 'utf8');
-  const toolsTab = settingsTab.split('<TabsContent value="tools"')[1].split('</TabsContent>')[0];
-  assert.match(toolsTab, /<\/SettingsSection>\s*<AIPrivacySection \/>\s*<SettingsSection anchorId="ai-external-mcp"/);
-  assert.doesNotMatch(externalCard, /AIPrivacySection|ExternalMcpRedactionSection/);
-});
-
-test('privacy drafts apply together, retain rejected input and persist only validated settings', async () => {
+test('rejected privacy draft stays open and accepted draft commits once and returns focus', async () => {
   const calls: unknown[] = [];
   let accepted = false;
-  const env = installEnvironment(async (config) => {
-    calls.push(config);
-    return accepted ? { ok: true } : { ok: false, error: 'Invalid privacy rules.' };
-  });
-  let renderer: ReactTestRenderer | undefined;
+  const unmount = await mount(async (config) => { calls.push(config); return accepted ? { ok: true } : { ok: false, error: 'Invalid privacy rules.' }; });
   try {
-    await act(async () => { renderer = create(view()); });
-    const root = renderer!.root;
-    const privacySwitch = () => root.findAllByType('button').find((node) => (
-      node.props['aria-label'] === 'Enable text redaction'
-    ))!;
-    const apply = () => root.findAllByType('button').find((node) => node.props.children === 'Apply')!;
-    await act(async () => { privacySwitch().props.onClick(); });
-    await act(async () => {
-      root.findAllByType('textarea')[0].props.onChange({ currentTarget: { value: '192.0.2.0/24\n\n2001:db8::/32' } });
-      root.findAllByType('textarea')[1].props.onChange({ currentTarget: { value: '[' } });
-    });
-    assert.equal(calls.length, 0, 'draft edits must not change runtime or storage');
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-    await act(async () => { apply().props.onClick(); });
-    assert.equal(root.findAllByType('textarea')[1].props.value, '[');
-    assert.match(root.findByProps({ role: 'alert' }).children.join(''), /Invalid privacy rules/);
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-
+    const trigger = button('Configure privacy');
+    trigger.focus();
+    await click('Configure privacy');
+    await act(async () => (document.querySelector('[aria-label="Enable text redaction"]') as HTMLButtonElement).click());
+    await input(0, '192.0.2.0/24\n\n2001:db8::/32');
+    await input(1, '[');
+    assert.equal(calls.length, 0);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
+    await click('Apply');
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /Invalid privacy rules/);
+    assert.equal(document.querySelectorAll('textarea')[1].value, '[');
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
     accepted = true;
-    await act(async () => {
-      root.findAllByType('textarea')[1].props.onChange({ currentTarget: { value: 'INTERNAL_[A-Z0-9]+' } });
-    });
-    await act(async () => { apply().props.onClick(); });
-    const saved = JSON.parse(env.values.get(STORAGE_KEY_AI_PRIVACY)!);
-    assert.deepEqual(saved, {
-      enabled: true,
-      redactPrivateIps: false,
-      cidrs: ['192.0.2.0/24', '2001:db8::/32'],
-      patterns: ['INTERNAL_[A-Z0-9]+'],
-    });
+    await input(1, 'INTERNAL_[A-Z0-9]+');
+    await click('Apply');
+    const saved = JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY)!);
+    assert.deepEqual(saved, { enabled: true, redactPrivateIps: false, cidrs: ['192.0.2.0/24', '2001:db8::/32'], patterns: ['INTERNAL_[A-Z0-9]+'] });
     assert.deepEqual(calls[1], { redaction: saved });
-    assert.equal(root.findAllByProps({ role: 'alert' }).length, 0);
-    assert.match(root.findByProps({ role: 'status' }).children.join(''), /new managed conversation/);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(document.activeElement, trigger);
+    assert.match(document.querySelector('[role="status"]')!.textContent!, /new managed conversation/);
+    await click('Configure privacy');
+    assert.equal(document.querySelectorAll('textarea')[1].value, 'INTERNAL_[A-Z0-9]+');
+  } finally { await unmount(); }
 });
 
-test('malformed saved privacy settings remain visible as a recoverable error', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('Cancel, X and Escape discard edits and reopening reads saved values', async () => {
+  let calls = 0;
+  const unmount = await mount(async () => { calls += 1; return { ok: true }; });
   try {
-    env.values.set(STORAGE_KEY_AI_PRIVACY, '{');
-    await act(async () => { renderer = create(view()); });
-    assert.match(renderer!.root.findByProps({ role: 'alert' }).children.join(''), /Invalid saved AI privacy settings/);
-    assert.ok(renderer!.root.findAllByType('button').some((node) => node.props.children === 'Apply'));
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), '{');
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    for (const close of ['Cancel', 'X', 'Escape']) {
+      await click('Configure privacy');
+      await input(0, '192.0.2.0/24');
+      assert.match(document.querySelector('[role="status"]')!.textContent!, /Unsaved changes/);
+      if (close === 'Cancel') await click('Cancel');
+      else if (close === 'X') await act(async () => (document.querySelector('[data-dialog-close]:not([aria-hidden])') as HTMLButtonElement).click());
+      else await act(async () => { document.dispatchEvent(new dom.window.KeyboardEvent('keydown', { key: 'Escape', bubbles: true })); });
+      assert.equal(document.querySelector('[role="dialog"]'), null);
+      await click('Configure privacy');
+      assert.equal(document.querySelector('textarea')!.value, '');
+      await click('Cancel');
+    }
+    assert.equal(calls, 0);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
+  } finally { await unmount(); }
 });
 
-test('privacy apply disables draft controls until shared validation settles', async () => {
-  let resolveConfig!: (result: unknown) => void;
-  const env = installEnvironment(() => new Promise((resolve) => { resolveConfig = resolve; }));
-  let renderer: ReactTestRenderer | undefined;
+test('busy Apply blocks duplicate submits, edits and Escape', async () => {
+  let resolve!: (value: unknown) => void;
+  let calls = 0;
+  const unmount = await mount(() => { calls += 1; return new Promise((done) => { resolve = done; }); });
   try {
-    await act(async () => { renderer = create(view()); });
-    const root = renderer!.root;
-    await act(async () => {
-      root.findAllByType('button').find((node) => node.props['aria-label'] === 'Enable text redaction')!.props.onClick();
-    });
-    await act(async () => {
-      root.findAllByType('button').find((node) => node.props.children === 'Apply')!.props.onClick();
-    });
-    assert.ok(root.findAllByType('button').every((node) => node.props.disabled));
-    assert.ok(root.findAllByType('textarea').every((node) => node.props.disabled));
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-    await act(async () => { resolveConfig({ ok: true }); });
-    assert.ok(root.findAllByType('button').every((node) => !node.props.disabled));
-    assert.equal(JSON.parse(env.values.get(STORAGE_KEY_AI_PRIVACY)!).enabled, true);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    await click('Configure privacy');
+    await input(0, '192.0.2.0/24');
+    await click('Apply');
+    assert.ok([...document.querySelectorAll('[role="dialog"] textarea, [role="dialog"] [role="switch"]')].every((el) => (el as HTMLInputElement).disabled));
+    assert.equal(button('Cancel').disabled, true);
+    await act(async () => { button('Applying...').click(); document.dispatchEvent(new dom.window.KeyboardEvent('keydown', { key: 'Escape', bubbles: true })); });
+    assert.ok(document.querySelector('[role="dialog"]'));
+    assert.equal(calls, 1);
+    await act(async () => { resolve({ ok: true }); });
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+  } finally { await unmount(); }
 });
 
-test('shared privacy controls refresh when another window changes the shared preference', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('malformed saved settings remain visible and repairable without being rewritten on open', async () => {
+  const unmount = await mount(undefined, '{');
   try {
-    await act(async () => { renderer = create(view()); });
-    const settings = { enabled: true, redactPrivateIps: true, cidrs: ['192.0.2.0/24'], patterns: ['INTERNAL_.*'] };
-    env.values.set(STORAGE_KEY_AI_PRIVACY, JSON.stringify(settings));
-    const event = new Event('storage');
-    Object.defineProperty(event, 'key', { value: STORAGE_KEY_AI_PRIVACY });
-    await act(async () => { window.dispatchEvent(event); });
-    assert.equal(renderer!.root.findAllByType('button').filter((node) => node.props['aria-checked'] === true).length, 2);
-    assert.equal(renderer!.root.findAllByType('textarea')[0].props.value, '192.0.2.0/24');
-    assert.equal(renderer!.root.findAllByType('textarea')[1].props.value, 'INTERNAL_.*');
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /Invalid saved AI privacy settings/);
+    await click('Configure privacy');
+    assert.equal(button('Apply').disabled, false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), '{');
+  } finally { await unmount(); }
+});
+
+test('cross-window changes refresh clean drafts but preserve dirty drafts with a conflict notice', async () => {
+  const unmount = await mount();
+  const settings = { enabled: true, redactPrivateIps: true, cidrs: ['192.0.2.0/24'], patterns: ['INTERNAL_.*'] };
+  const update = async () => {
+    dom.window.localStorage.setItem(STORAGE_KEY_AI_PRIVACY, JSON.stringify(settings));
+    await act(async () => { window.dispatchEvent(new dom.window.StorageEvent('storage', { key: STORAGE_KEY_AI_PRIVACY })); });
+  };
+  try {
+    await click('Configure privacy');
+    await update();
+    assert.equal(document.querySelector('textarea')!.value, '192.0.2.0/24');
+    await input(0, '198.51.100.0/24');
+    settings.cidrs = ['203.0.113.0/24'];
+    await update();
+    assert.equal(document.querySelector('textarea')!.value, '198.51.100.0/24');
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /another window/);
+    assert.equal(button('Apply').disabled, true);
+    await click('Cancel');
+    await click('Configure privacy');
+    assert.equal(document.querySelector('textarea')!.value, '203.0.113.0/24');
+  } finally { await unmount(); }
 });

components/settings/tabs/ai/AIPrivacySection.tsx

@@ -1,7 +1,8 @@
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
 import { useAIPrivacyState } from "../../../../application/state/useExternalMcpToggleState";
 import { Button } from "../../../ui/button";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
 import { SettingCard, SettingRow, SettingsSection, Toggle } from "../../settings-ui";
 
 export const AIPrivacySection: React.FC = () => {
@@ -12,8 +13,32 @@ export const AIPrivacySection: React.FC = () => {
   const [cidrs, setCidrs] = useState(settings.cidrs.join("\n"));
   const [patterns, setPatterns] = useState(settings.patterns.join("\n"));
   const [applied, setApplied] = useState(false);
+  const [open, setOpen] = useState(false);
+  const errorRef = useRef<HTMLParagraphElement>(null);
+  useEffect(() => { if (open && error) errorRef.current?.focus(); }, [open, error]);
+  const [draftBase, setDraftBase] = useState(settings);
+  const [conflict, setConflict] = useState(false);
+  const dirty = enabled !== draftBase.enabled || privateIps !== draftBase.redactPrivateIps
+    || cidrs !== draftBase.cidrs.join("\n") || patterns !== draftBase.patterns.join("\n");
+  const changeOpen = (next: boolean) => {
+    if (applying) return;
+    setDraftBase(settings);
+    setEnabled(settings.enabled);
+    setPrivateIps(settings.redactPrivateIps);
+    setCidrs(settings.cidrs.join("\n"));
+    setPatterns(settings.patterns.join("\n"));
+    setConflict(false);
+    setOpen(next);
+  };
 
+  const draftState = useRef({ open, dirty, applying });
+  draftState.current = { open, dirty, applying };
   useEffect(() => {
+    if (draftState.current.open && draftState.current.dirty && !draftState.current.applying) {
+      setConflict(true);
+      return;
+    }
+    setDraftBase(settings);
     setEnabled(settings.enabled);
     setPrivateIps(settings.redactPrivateIps);
     setCidrs(settings.cidrs.join("\n"));
@@ -21,6 +46,7 @@ export const AIPrivacySection: React.FC = () => {
   }, [settings]);
 
   const onApply = async () => {
+    if (applying || conflict) return;
     setApplied(false);
     const saved = await apply({
       enabled,
@@ -29,13 +55,36 @@ export const AIPrivacySection: React.FC = () => {
       patterns: patterns.split(/\r?\n/).filter((line) => line.trim().length > 0),
     });
     setApplied(saved);
+    if (saved) setOpen(false);
   };
 
   return (
     <SettingsSection anchorId="ai-privacy" title={t("ai.privacy.title")}>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.description")}</p>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.boundary")}</p>
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingCard>
+        <SettingRow
+          className="flex-col items-start md:flex-row md:items-center"
+          label={t(settings.enabled ? "ai.toolSettings.privacyOn" : "ai.toolSettings.privacyOff")}
+          description={`${t("ai.privacy.privateIps")}: ${t(settings.redactPrivateIps ? "common.enabled" : "common.disabled")} · ${t("ai.toolSettings.ruleSummary", { cidrs: String(settings.cidrs.length), patterns: String(settings.patterns.length) })}`}
+        >
+          <ToolSettingsDialog
+            title={t("ai.privacy.title")}
+            triggerLabel={t("ai.toolSettings.configurePrivacy")}
+            open={open}
+            onOpenChange={changeOpen}
+            busy={applying}
+            footer={<>
+              {dirty ? <span role="status" className="mr-auto self-center text-xs text-muted-foreground">{t("ai.toolSettings.unsaved")}</span> : null}
+              <Button type="button" variant="outline" onClick={() => changeOpen(false)} disabled={applying}>{t("common.cancel")}</Button>
+              <Button type="button" onClick={() => { void onApply(); }} disabled={applying || conflict || (!dirty && !error)}>
+                {t(applying ? "ai.privacy.applying" : "ai.privacy.apply")}
+              </Button>
+            </>}
+          >
+            <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.description")}</p>
+            <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.boundary")}</p>
+      <SettingCard divided className="border-0 rounded-none bg-transparent p-0">
         <SettingRow label={t("ai.privacy.enable")}>
           <Toggle
             checked={enabled}
@@ -56,9 +105,9 @@ export const AIPrivacySection: React.FC = () => {
           />
         </SettingRow>
       </SettingCard>
-      <div className="space-y-3 rounded-md border border-border/60 bg-background/50 p-3">
+      <div className="space-y-4">
         <label className="block space-y-1.5">
-          <span className="text-xs font-medium">{t("ai.privacy.cidrs")}</span>
+          <span className="text-sm font-medium">{t("ai.privacy.cidrs")}</span>
           <span className="block text-xs text-muted-foreground">{t("ai.privacy.cidrs.description")}</span>
           <textarea
             value={cidrs}
@@ -72,7 +121,7 @@ export const AIPrivacySection: React.FC = () => {
           />
         </label>
         <label className="block space-y-1.5">
-          <span className="text-xs font-medium">{t("ai.privacy.patterns")}</span>
+          <span className="text-sm font-medium">{t("ai.privacy.patterns")}</span>
           <span className="block text-xs text-muted-foreground">{t("ai.privacy.patterns.description")}</span>
           <textarea
             value={patterns}
@@ -86,20 +135,15 @@ export const AIPrivacySection: React.FC = () => {
           />
         </label>
         <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.connectionScope")}</p>
-        <div className="flex items-center justify-between gap-3">
-          <p className="text-xs text-amber-500">{t("ai.privacy.reconnect")}</p>
-          <Button size="sm" variant="outline" onClick={() => { void onApply(); }} disabled={applying}>
-            {t(applying ? "ai.privacy.applying" : "ai.privacy.apply")}
-          </Button>
-        </div>
-        {error ? (
-          <p role="alert" className="text-xs text-destructive">
-            {t("ai.privacy.failed")} {error}
-          </p>
-        ) : applied ? (
-          <p role="status" className="text-xs text-emerald-500">{t("ai.privacy.applied")}</p>
-        ) : null}
+        <p className="text-xs text-amber-500">{t("ai.privacy.reconnect")}</p>
       </div>
+            {conflict ? <p role="alert" className="text-xs text-destructive">{t("ai.toolSettings.conflict")}</p> : null}
+            {error ? <p ref={errorRef} tabIndex={-1} role="alert" className="text-xs text-destructive">{t("ai.privacy.failed")} {error}</p> : null}
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
+      {error && !open ? <p role="alert" className="text-xs text-destructive">{t("ai.privacy.failed")} {error}</p>
+        : applied ? <p role="status" className="text-xs text-emerald-500">{t("ai.privacy.applied")}</p> : null}
     </SettingsSection>
   );
 };

components/settings/tabs/ai/CopyableCodeBlock.tsx

@@ -1,10 +1,12 @@
 import React from "react";
-import { Check, Copy } from "lucide-react";
+import { Check, Copy, Eye, EyeOff } from "lucide-react";
 import { cn } from "../../../../lib/utils";
+import { useI18n } from "../../../../application/i18n/I18nProvider";
 import { Button } from "../../../ui/button";
 
 type CopyableCodeBlockProps = {
   label?: string;
+  sensitive?: boolean;
   value: string;
   copyKey: string;
   copied: string | null;
@@ -17,6 +19,7 @@ type CopyableCodeBlockProps = {
 
 export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
   label,
+  sensitive = false,
   value,
   copyKey,
   copied,
@@ -26,7 +29,9 @@ export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
   emptyLabel,
   className,
 }) => {
-  const display = value || emptyLabel || "";
+  const { t } = useI18n();
+  const [revealed, setRevealed] = React.useState(false);
+  const display = sensitive && value && !revealed ? "••••••••" : value || emptyLabel || "";
   const canCopy = Boolean(value);
   const isCopied = copied === copyKey;
 
@@ -38,12 +43,15 @@ export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
       <div className="group relative rounded-md border border-border/60 bg-muted/20">
         <pre
           className={cn(
-            "max-h-40 overflow-auto whitespace-pre-wrap break-all px-3 py-2.5 pr-11 font-mono text-xs leading-5",
+            "max-h-40 overflow-auto whitespace-pre-wrap break-all px-3 py-2.5 pr-20 font-mono text-xs leading-5",
             !value && "text-muted-foreground",
           )}
         >
           {display}
         </pre>
+        {sensitive && value ? <Button type="button" variant="ghost" size="sm" className="absolute right-10 top-1.5 h-7 w-7 p-0" onClick={() => setRevealed(!revealed)} aria-label={t(revealed ? "ai.toolSettings.hideSecret" : "ai.toolSettings.showSecret")}>
+          {revealed ? <EyeOff size={14} /> : <Eye size={14} />}
+        </Button> : null}
         <Button
           type="button"
           variant="ghost"

components/settings/tabs/ai/ExternalMcpCard.httpErrors.test.tsx

@@ -0,0 +1,133 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React, { act } from 'react';
+import { JSDOM } from 'jsdom';
+import { installAiToolAccessFixture } from '../../../../scripts/fixtures/ai-tool-access/bridge.cjs';
+
+const dom = new JSDOM('<div id="root"></div>', { url: 'http://localhost/#/settings' });
+for (const key of ['window', 'document', 'location', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'FocusEvent', 'getComputedStyle', 'localStorage'] as const) {
+  Object.defineProperty(globalThis, key, { value: dom.window[key], configurable: true });
+}
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true, requestAnimationFrame: (fn: () => void) => setTimeout(fn, 0), cancelAnimationFrame: clearTimeout });
+const { createRoot } = await import('react-dom/client');
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { TooltipProvider } = await import('../../../ui/tooltip');
+const { ExternalMcpCard } = await import('./ExternalMcpCard');
+
+type FixtureControl = { rejectHttp: boolean; throwHttp: boolean; holdHttp: boolean; pendingHttp: (() => void)[]; pendingClients: (() => void)[]; rejectRotate: boolean; throwRotate: boolean; calls: { name: string; args: unknown[] }[] };
+async function mount(options: { enabled?: boolean; holdClients?: boolean } = {}, openHttp = true) {
+  installAiToolAccessFixture({ locale: 'en', enabled: true, ...options });
+  Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => {} } });
+  const qa = (window as unknown as { __aiToolQa: FixtureControl }).__aiToolQa;
+  const root = createRoot(document.getElementById('root')!);
+  await act(async () => root.render(<I18nProvider locale="en"><TooltipProvider><ExternalMcpCard /></TooltipProvider></I18nProvider>));
+  if (openHttp) await click('Configure HTTP');
+  return { qa, close: async () => { await act(async () => root.unmount()); } };
+}
+const dialog = () => document.querySelector<HTMLElement>('[role="dialog"]')!;
+const button = (text: string, scope: ParentNode = document) => [...scope.querySelectorAll<HTMLButtonElement>('button')].find((el) => el.textContent === text)!;
+const click = async (text: string) => { await act(async () => button(text).click()); };
+async function changePort(value: string) {
+  const port = dialog().querySelector<HTMLInputElement>('[aria-label="Port"]')!;
+  await act(async () => {
+    port.focus();
+    Object.getOwnPropertyDescriptor(dom.window.HTMLInputElement.prototype, 'value')!.set!.call(port, value);
+    port.dispatchEvent(new dom.window.Event('input', { bubbles: true }));
+  });
+  await act(async () => port.blur());
+  return port;
+}
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`HTTP ${failure} configuration failure is visible inside the dialog, preserves input and can retry`, async () => {
+    const h = await mount();
+    try {
+      h.qa.rejectHttp = failure === 'returned';
+      h.qa.throwHttp = failure === 'thrown';
+      const port = await changePort('47401');
+      const message = failure === 'returned' ? 'Fixture: port unavailable.' : 'Fixture: HTTP configuration threw.';
+      const alert = dialog().querySelector('[role="alert"]')!;
+      assert.match(alert.textContent!, new RegExp(message.replaceAll('.', '\\.')));
+      assert.equal(document.activeElement, alert, 'the error must be reachable without scrolling back manually');
+      assert.equal(port.value, '47401');
+      assert.ok(document.querySelector('[role="dialog"]'));
+      assert.match(document.querySelector('[data-settings-anchor="ai-external-mcp-http"]')!.textContent!, /Fixture:/);
+      const beforeRetry = h.qa.calls.filter((call) => call.name === 'config').length;
+      h.qa.rejectHttp = false;
+      h.qa.throwHttp = false;
+      await click('Retry');
+      assert.equal(h.qa.calls.filter((call) => call.name === 'config').length, beforeRetry + 1);
+      assert.equal(dialog().querySelector('[role="alert"]'), null);
+      assert.equal(port.value, '47401');
+    } finally { await h.close(); }
+  });
+}
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`HTTP ${failure} token rotation failure stays in the active dialog and retries explicitly`, async () => {
+    const h = await mount();
+    try {
+      await act(async () => (dialog().querySelector('[aria-label="Enable HTTP"]') as HTMLButtonElement).click());
+      await act(async () => dialog().querySelector('summary')!.click());
+      h.qa.rejectRotate = failure === 'returned';
+      h.qa.throwRotate = failure === 'thrown';
+      await click('Regenerate');
+      assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /Fixture: token rotation/);
+      assert.equal(dialog().textContent!.includes('SYNTHETIC_FIXTURE_TOKEN_NEVER_REAL'), false);
+      h.qa.rejectRotate = false;
+      h.qa.throwRotate = false;
+      await click('Retry');
+      assert.equal(dialog().querySelector('[role="alert"]'), null);
+      assert.equal(dialog().textContent!.includes('SYNTHETIC_ROTATED_FIXTURE_TOKEN'), false);
+    } finally { await h.close(); }
+  });
+}
+
+test('HTTP clipboard failure is visible in the dialog and clears only after another copy attempt', async () => {
+  const h = await mount();
+  try {
+    await act(async () => dialog().querySelector('summary')!.click());
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => { throw new Error('Fixture clipboard failure'); } } });
+    const copy = () => dialog().querySelector<HTMLButtonElement>('[aria-label="Copy"]:not([disabled])')!;
+    await act(async () => copy().click());
+    assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /copy/i);
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => {} } });
+    await act(async () => copy().click());
+    assert.equal(dialog().querySelector('[role="alert"]'), null);
+  } finally { await h.close(); }
+});
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`a completed runtime poll cannot suppress a pending HTTP ${failure} failure`, async () => {
+    const h = await mount();
+    try {
+      h.qa.holdHttp = true;
+      h.qa.rejectHttp = failure === 'returned';
+      h.qa.throwHttp = failure === 'thrown';
+      const beforePoll = h.qa.calls.filter((call) => call.name === 'status').length;
+      const port = await changePort('47402');
+      assert.match(dialog().querySelector('[role="status"]')!.textContent!, /Applying HTTP/);
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 3200)); });
+      assert.ok(h.qa.calls.filter((call) => call.name === 'status').length > beforePoll);
+      await act(async () => h.qa.pendingHttp.splice(0).forEach((resolve) => resolve()));
+      assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /Fixture:/);
+      assert.equal(port.value, '47402');
+      assert.equal(dialog().querySelector('[role="status"]'), null);
+    } finally { await h.close(); }
+  });
+}
+
+test('completed MCP enable can be turned off while unrelated client discovery is still pending', async () => {
+  const h = await mount({ enabled: false, holdClients: true }, false);
+  try {
+    const toggle = document.querySelector<HTMLButtonElement>('[role="switch"][aria-label="External MCP"]')!;
+    await act(async () => toggle.click());
+    assert.equal(toggle.getAttribute('aria-checked'), 'true');
+    assert.ok(h.qa.pendingClients.length > 0, 'client discovery remains intentionally unresolved');
+    assert.equal(toggle.disabled, false, 'successful enable must release the switch before client discovery finishes');
+    await act(async () => toggle.click());
+    assert.equal(toggle.getAttribute('aria-checked'), 'false');
+    assert.equal(toggle.disabled, false);
+    assert.deepEqual(h.qa.calls.filter((call) => call.name === 'enable').map((call) => call.args[0]), [true, false]);
+  } finally { await h.close(); }
+});

components/settings/tabs/ai/ExternalMcpCard.tsx

@@ -1,4 +1,4 @@
-import React, { useCallback, useEffect, useMemo, useState } from "react";
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { HelpCircle, RefreshCw } from "lucide-react";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
 import {
@@ -31,8 +31,13 @@ import {
 } from "../../../../application/state/useExternalMcpToggleState";
 import { cn } from "../../../../lib/utils";
 import { Button } from "../../../ui/button";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "../../../ui/tabs";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../../../ui/tooltip";
-import { Select, SettingCard, SettingRow, Toggle } from "../../../settings/settings-ui";
+import { Select, SettingCard, SettingRow, SettingsSection, Toggle } from "../../../settings/settings-ui";
+import { ToolStatusPill, type ToolStatusTone } from "./ToolStatusPill";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
+import { useOptionalSettingsFocus } from "../../SettingsFocusContext";
+import { SettingsAnchor } from "../../settings-ui";
 import { CopyableCodeBlock } from "./CopyableCodeBlock";
 import { ExternalMcpHttpSection, type ExternalMcpHttpViewStatus } from "./ExternalMcpHttpSection";
 import { getBridge } from "./types";
@@ -72,23 +77,13 @@ type StatusView = {
   className: string;
 };
 
-function getBridgeStatusView(status: ExternalMcpStatus | null, enabled: boolean): StatusView {
-  if (!enabled) {
-    return { labelKey: "ai.externalMcp.status.disabled", className: "text-muted-foreground" };
-  }
-  if (!status || !status.ok) {
-    return { labelKey: "ai.externalMcp.status.unavailable", className: "text-amber-500" };
-  }
-  if (status.state === "running") {
-    return { labelKey: "ai.externalMcp.status.running", className: "text-emerald-500" };
-  }
-  if (status.state === "starting") {
-    return { labelKey: "ai.externalMcp.status.starting", className: "text-amber-500" };
-  }
-  if (status.state === "error") {
-    return { labelKey: "ai.externalMcp.status.error", className: "text-destructive" };
-  }
-  return { labelKey: "ai.externalMcp.status.disabled", className: "text-muted-foreground" };
+function getBridgeStatusView(status: ExternalMcpStatus | null, enabled: boolean): { labelKey: string; tone: ToolStatusTone } {
+  if (!enabled) return { labelKey: "ai.externalMcp.status.disabled", tone: "inactive" };
+  if (!status || !status.ok) return { labelKey: "ai.externalMcp.status.unavailable", tone: status?.error ? "error" : "inactive" };
+  if (status.state === "running") return { labelKey: "ai.externalMcp.status.running", tone: "active" };
+  if (status.state === "starting") return { labelKey: "ai.externalMcp.status.starting", tone: "inactive" };
+  if (status.state === "error") return { labelKey: "ai.externalMcp.status.error", tone: "error" };
+  return { labelKey: "ai.externalMcp.status.disabled", tone: "inactive" };
 }
 
 /** Map bridge permissionMode to a Safety i18n key for display. */
@@ -252,6 +247,15 @@ export function buildCursorSnippet(launcherPath: string, discoveryPath?: string
 
 export const ExternalMcpCard: React.FC = () => {
   const { t } = useI18n();
+  const [behaviorOpen, setBehaviorOpen] = useState(false);
+  const focus = useOptionalSettingsFocus();
+  useEffect(() => {
+    if (focus?.request?.anchorId === "ai-external-mcp-approval-alert") setBehaviorOpen(true);
+  }, [focus?.request]);
+  const statusGeneration = useRef(0);
+  const clientStatusGeneration = useRef(0);
+  const httpOperationGeneration = useRef(0);
+  useEffect(() => () => { statusGeneration.current += 1; clientStatusGeneration.current += 1; httpOperationGeneration.current += 1; }, []);
   const { enabled, setEnabled, error: configError } = useExternalMcpToggleState();
   const [mode, setModeRaw] = useState<ExternalMcpMode>(() => readExternalMcpMode());
   const [idleTimeoutMinutes, setIdleTimeoutRaw] = useState<number>(() => readExternalMcpIdleTimeoutMinutes());
@@ -268,8 +272,11 @@ export const ExternalMcpCard: React.FC = () => {
     listenAddress: readExternalMcpHttpListenAddress(),
     clientHost: readExternalMcpHttpClientHost(),
   }));
+  const [isApplyingHttp, setIsApplyingHttp] = useState(false);
+  const [isToggling, setIsToggling] = useState(false);
   const [isRotatingHttpToken, setIsRotatingHttpToken] = useState(false);
   const [status, setStatus] = useState<ExternalMcpStatus | null>(null);
+  const [manualFormat, setManualFormat] = useState("command");
   const [selectedClient, setSelectedClient] = useState<ExternalMcpClient>("codex");
   const [codexStatus, setCodexStatus] = useState<ClientSetupStatus | null>(null);
   const [claudeStatus, setClaudeStatus] = useState<ClientSetupStatus | null>(null);
@@ -280,6 +287,8 @@ export const ExternalMcpCard: React.FC = () => {
   const [isAddingClaude, setIsAddingClaude] = useState(false);
   const [isAddingGrok, setIsAddingGrok] = useState(false);
   const [copied, setCopied] = useState<string | null>(null);
+  const [httpCopyError, setHttpCopyError] = useState<string | null>(null);
+  const [httpActionError, setHttpActionError] = useState<{ kind: "config" | "rotate"; message: string } | null>(null);
   const [actionMessage, setActionMessage] = useState<{ tone: "error" | "warning" | "success"; text: string } | null>(null);
   const bridgeUnavailableMessage = t("ai.externalMcp.bridgeUnavailable");
 
@@ -324,6 +333,10 @@ export const ExternalMcpCard: React.FC = () => {
   }, []);
 
   const applyHttpSettings = useCallback(async (next: ExternalMcpHttpSettings) => {
+    const operation = ++httpOperationGeneration.current;
+    const generation = ++statusGeneration.current;
+    setHttpActionError(null);
+    setIsApplyingHttp(true);
     const normalized: ExternalMcpHttpSettings = {
       enabled: writeExternalMcpHttpEnabled(next.enabled),
       port: writeExternalMcpHttpPort(next.port),
@@ -332,36 +345,56 @@ export const ExternalMcpCard: React.FC = () => {
       clientHost: writeExternalMcpHttpClientHost(next.clientHost),
     };
     setHttpSettings(normalized);
-    const nextStatus = await getBridge()?.externalMcpSetConfig?.({
-      httpEnabled: normalized.enabled,
-      httpPort: normalized.port,
-      httpAllowCustomBind: normalized.allowCustomBind,
-      httpListenAddress: normalized.listenAddress,
-      httpClientHost: normalized.clientHost,
-    });
-    if (nextStatus && typeof nextStatus === "object") {
-      setStatus(nextStatus as ExternalMcpStatus);
+    try {
+      const nextStatus = await getBridge()?.externalMcpSetConfig?.({
+        httpEnabled: normalized.enabled,
+        httpPort: normalized.port,
+        httpAllowCustomBind: normalized.allowCustomBind,
+        httpListenAddress: normalized.listenAddress,
+        httpClientHost: normalized.clientHost,
+      }) as ExternalMcpStatus | undefined;
+      if (operation !== httpOperationGeneration.current) return;
+      if (!nextStatus?.ok || nextStatus.error || nextStatus.http?.error) {
+        setHttpActionError({ kind: "config", message: nextStatus?.error || nextStatus?.http?.error || bridgeUnavailableMessage });
+        return;
+      }
+      if (generation === statusGeneration.current) setStatus(nextStatus);
+    } catch (error) {
+      if (operation === httpOperationGeneration.current) {
+        setHttpActionError({ kind: "config", message: error instanceof Error ? error.message : String(error) });
+      }
+    } finally {
+      if (operation === httpOperationGeneration.current) setIsApplyingHttp(false);
     }
-  }, []);
+  }, [bridgeUnavailableMessage]);
 
   const rotateHttpToken = useCallback(async () => {
-    const bridge = getBridge();
-    if (!bridge?.externalMcpSetConfig) return;
+    const operation = ++httpOperationGeneration.current;
+    const generation = ++statusGeneration.current;
     setIsRotatingHttpToken(true);
-    setActionMessage(null);
+    setHttpActionError(null);
     try {
-      const nextStatus = await bridge.externalMcpSetConfig({ rotateHttpToken: true });
-      if (nextStatus && typeof nextStatus === "object") {
-        setStatus(nextStatus as ExternalMcpStatus);
+      const nextStatus = await getBridge()?.externalMcpSetConfig?.({ rotateHttpToken: true }) as ExternalMcpStatus | undefined;
+      if (operation !== httpOperationGeneration.current) return;
+      if (!nextStatus?.ok || nextStatus.error || nextStatus.http?.error) {
+        setHttpActionError({ kind: "rotate", message: nextStatus?.error || nextStatus?.http?.error || bridgeUnavailableMessage });
+        return;
+      }
+      if (generation === statusGeneration.current) setStatus(nextStatus);
+    } catch (error) {
+      if (operation === httpOperationGeneration.current) {
+        setHttpActionError({ kind: "rotate", message: error instanceof Error ? error.message : String(error) });
       }
     } finally {
       setIsRotatingHttpToken(false);
     }
-  }, []);
+  }, [bridgeUnavailableMessage]);
 
   const refreshStatus = useCallback(async (options?: { quiet?: boolean; clients?: boolean }) => {
+    const generation = ++statusGeneration.current;
     const bridge = getBridge();
     const includeClients = options?.clients !== false;
+    const clientGeneration = includeClients ? ++clientStatusGeneration.current : clientStatusGeneration.current;
     if (
       !bridge?.externalMcpGetStatus
       || !bridge?.externalMcpCodexGetStatus
@@ -411,10 +444,15 @@ export const ExternalMcpCard: React.FC = () => {
           bridge.externalMcpGetUniversalSetupPrompt?.()
             ?? Promise.resolve({ ok: false, prompt: "" }),
         ]);
-        setStatus(nextStatus as ExternalMcpStatus);
-        if (enabled && nextStatus?.ok && !nextStatus.enabled) {
-          setEnabled(false);
+        // Runtime polling and CLI/client discovery have separate lifetimes.
+        // A fast quiet poll must not discard a slow, still-current client batch.
+        if (generation === statusGeneration.current) {
+          setStatus(nextStatus as ExternalMcpStatus);
+          if (enabled && nextStatus?.ok && !nextStatus.enabled) {
+            setEnabled(false);
+          }
         }
+        if (clientGeneration !== clientStatusGeneration.current) return;
         setCodexStatus(nextCodexStatus as ClientSetupStatus);
         setClaudeStatus(nextClaudeStatus as ClientSetupStatus);
         setGrokStatus(nextGrokStatus as ClientSetupStatus);
@@ -425,13 +463,14 @@ export const ExternalMcpCard: React.FC = () => {
         );
       } else {
         const nextStatus = await bridge.externalMcpGetStatus();
+        if (generation !== statusGeneration.current) return;
         setStatus(nextStatus as ExternalMcpStatus);
         if (enabled && nextStatus?.ok && !nextStatus.enabled) {
           setEnabled(false);
         }
       }
     } finally {
-      if (!options?.quiet) setIsRefreshing(false);
+      if (!options?.quiet && clientGeneration === clientStatusGeneration.current) setIsRefreshing(false);
     }
   }, [bridgeUnavailableMessage, enabled, setEnabled]);
 
@@ -481,8 +520,10 @@ export const ExternalMcpCard: React.FC = () => {
   const canAddToClaude = claudeStatus?.state === "not_configured";
   const canAddToGrok = grokStatus?.state === "not_configured";
 
-  const copyText = useCallback(async (key: string, text: string) => {
+  const copyText = useCallback(async (key: string, text: string, scope: "client" | "http" = "client") => {
     if (!text) return;
+    setCopied((current) => current === key ? null : current);
+    if (scope === "http") setHttpCopyError(null);
     try {
       await navigator.clipboard.writeText(text);
       setCopied(key);
@@ -490,7 +531,8 @@ export const ExternalMcpCard: React.FC = () => {
         setCopied((current) => (current === key ? null : current));
       }, 1200);
     } catch {
-      setActionMessage({ tone: "error", text: t("ai.externalMcp.copyFailed") });
+      if (scope === "http") setHttpCopyError(t("ai.externalMcp.copyFailed"));
+      else setActionMessage({ tone: "error", text: t("ai.externalMcp.copyFailed") });
     }
   }, [t]);
 
@@ -634,8 +676,13 @@ export const ExternalMcpCard: React.FC = () => {
   ]);
 
   return (
-    <div className="rounded-lg border bg-card p-4 space-y-3">
-      <div className="flex items-start justify-between gap-4">
+    <SettingsSection
+      anchorId="ai-external-mcp"
+      title={t("ai.externalMcp.title")}
+      actions={<ToolStatusPill tone={bridgeStatusView.tone}>{t(bridgeStatusView.labelKey)}</ToolStatusPill>}
+    >
+      <div className="space-y-4">
+      <div className="flex items-start gap-4">
         <div className="min-w-0 flex items-start gap-1.5">
           <p className="min-w-0 text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.description")}
@@ -665,12 +712,10 @@ export const ExternalMcpCard: React.FC = () => {
             </TooltipContent>
           </Tooltip>
         </div>
-        <div className={cn("text-xs font-medium shrink-0", bridgeStatusView.className)}>
-          {t(bridgeStatusView.labelKey)}
-        </div>
       </div>
 
-      <div className="flex items-center justify-between gap-4 rounded-md border border-border/60 bg-background/70 px-3 py-2">
+      <SettingCard divided>
+      <div className="flex items-center justify-between gap-4 py-3">
         <div className="min-w-0">
           <div className="text-sm font-medium">{t("ai.externalMcp.title")}</div>
           <div className="text-xs text-muted-foreground">
@@ -679,17 +724,21 @@ export const ExternalMcpCard: React.FC = () => {
         </div>
         <Toggle
           checked={enabled}
+          disabled={isToggling}
+          ariaLabel={t("ai.externalMcp.title")}
           onChange={(nextEnabled) => {
+            statusGeneration.current += 1;
             setActionMessage(null);
-            void setEnabled(nextEnabled).then(() => refreshStatus());
+            setIsToggling(true);
+            void setEnabled(nextEnabled).then(() => { void refreshStatus(); }).finally(() => setIsToggling(false));
           }}
         />
       </div>
 
       {/* Permission mode is controlled in Safety settings; surface it here so External MCP
           users see why write tools may still prompt (confirm) or run freely (auto). */}
-      <div className="flex items-start justify-between gap-4 rounded-md border border-border/60 bg-background/70 px-3 py-2">
-        <div className="min-w-0 space-y-1">
+      <div className="flex items-start justify-between gap-4 py-3">
+        <div className="min-w-0 flex-1 space-y-1">
           <div className="text-sm font-medium">{t("ai.externalMcp.permissionMode.label")}</div>
           <div className="text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.permissionMode.hint")}
@@ -706,9 +755,11 @@ export const ExternalMcpCard: React.FC = () => {
         </div>
       </div>
 
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingsAnchor anchorId="ai-external-mcp-approval-alert">
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t("ai.toolSettings.behavior")} description={t(mode === "persistent" ? "ai.externalMcp.mode.persistent" : "ai.externalMcp.mode.temporary")}>
+          <ToolSettingsDialog title={t("ai.toolSettings.behavior")} triggerLabel={t("ai.toolSettings.configureBehavior")} immediate open={behaviorOpen} onOpenChange={setBehaviorOpen}>
+      <SettingCard divided className="border-0 bg-transparent p-0">
         <SettingRow
-          anchorId="ai-external-mcp-approval-alert"
           label={t("ai.externalMcp.approvalAlert")}
           description={t("ai.externalMcp.approvalAlert.description")}
         >
@@ -803,6 +854,10 @@ export const ExternalMcpCard: React.FC = () => {
             <span className="text-xs text-muted-foreground">{t("ai.externalMcp.idleTimeout.minutes")}</span>
           </div>
         </SettingRow>
+      </SettingCard>
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingsAnchor>
       </SettingCard>
 
       <ExternalMcpHttpSection
@@ -811,93 +866,36 @@ export const ExternalMcpCard: React.FC = () => {
         status={status?.http || null}
         copied={copied}
         rotating={isRotatingHttpToken}
-        onCopy={copyText}
+        onCopy={(key, text) => { void copyText(key, text, "http"); }}
+        applying={isApplyingHttp}
+        operationError={httpActionError?.message ?? null}
+        copyError={httpCopyError}
+        onRetry={httpActionError ? () => {
+          if (httpActionError.kind === "rotate") void rotateHttpToken();
+          else void applyHttpSettings(httpSettings);
+        } : undefined}
         onChange={(next) => { void applyHttpSettings(next); }}
         onRotateToken={() => { void rotateHttpToken(); }}
       />
 
-      <div className="space-y-2">
-        <div className="flex min-h-8 items-center justify-between gap-2">
-          <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.discovery")}</div>
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={() => void refreshStatus()}
-            disabled={isRefreshing}
-          >
-            <RefreshCw size={14} className={cn("mr-1.5", isRefreshing && "animate-spin")} />
-            {t("ai.externalMcp.refresh")}
-          </Button>
-        </div>
-        <div className="space-y-2.5 rounded-md border border-border/60 bg-background/50 p-3">
-          <CopyableCodeBlock
-            label={t("ai.externalMcp.launcher")}
-            value={launcherPath || ""}
-            copyKey="launcher"
-            copied={copied}
-            onCopy={copyText}
-            copyLabel={t("ai.externalMcp.copy")}
-            copiedLabel={t("ai.externalMcp.copied")}
-            emptyLabel={t("ai.externalMcp.unavailable")}
-          />
-          <CopyableCodeBlock
-            label={t("ai.externalMcp.discovery")}
-            value={status?.discoveryPath || ""}
-            copyKey="discovery"
-            copied={copied}
-            onCopy={copyText}
-            copyLabel={t("ai.externalMcp.copy")}
-            copiedLabel={t("ai.externalMcp.copied")}
-            emptyLabel={t("ai.externalMcp.unavailable")}
-          />
-          {!enabled ? (
-            <p className="text-xs text-amber-500">{t("ai.externalMcp.enableForLauncher")}</p>
-          ) : null}
-        </div>
-      </div>
+      <SettingCard>
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t("ai.externalMcp.clientConfiguration")} description={t("ai.externalMcp.clientConfiguration.description")}>
+          <ToolSettingsDialog title={t("ai.externalMcp.clientConfiguration")} triggerLabel={t("ai.toolSettings.configureClients")}>
 
       <div className="space-y-2">
         <div className="space-y-1">
-          <div className="text-sm font-semibold text-foreground">
-            {t("ai.externalMcp.clientConfiguration")}
-          </div>
           <p className="text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.clientConfiguration.description")}
           </p>
         </div>
 
-        <div
-          role="tablist"
-          aria-label={t("ai.externalMcp.clientConfiguration")}
-          className="grid grid-cols-5 gap-1 rounded-md bg-muted p-1"
-        >
-          {CLIENT_TABS.map((client) => {
-            const active = selectedClient === client;
-            return (
-              <button
-                key={client}
-                type="button"
-                role="tab"
-                aria-selected={active}
-                onClick={() => {
-                  setSelectedClient(client);
-                  setActionMessage(null);
-                }}
-                className={cn(
-                  "inline-flex h-8 items-center justify-center rounded-sm px-2 text-xs font-medium transition-colors",
-                  "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
-                  active
-                    ? "bg-background text-foreground shadow-sm"
-                    : "text-muted-foreground hover:text-foreground",
-                )}
-              >
-                {t(`ai.externalMcp.client.${client}`)}
-              </button>
-            );
-          })}
-        </div>
+        <Tabs value={selectedClient} onValueChange={(value) => { setSelectedClient(value as ExternalMcpClient); setManualFormat(value === "other" || value === "cursor" ? "snippet" : "command"); setActionMessage(null); }}>
+          <TabsList aria-label={t("ai.externalMcp.clientConfiguration")} className="flex h-auto flex-wrap justify-start">
+            {CLIENT_TABS.map((client) => <TabsTrigger key={client} value={client}>{t(`ai.externalMcp.client.${client}`)}</TabsTrigger>)}
+          </TabsList>
+          <TabsContent value={selectedClient}>
 
-        <div className="space-y-3 rounded-md border border-border/60 bg-background/50 p-3">
+        <div className="space-y-4">
           {selectedClientMeta.kind === "installable" && selectedClientMeta.statusView ? (
             <div className="flex items-center justify-between gap-3">
               <div className={cn("text-xs font-medium", selectedClientMeta.statusView.className)}>
@@ -924,57 +922,76 @@ export const ExternalMcpCard: React.FC = () => {
             </p>
           )}
 
-          {selectedClientMeta.kind === "installable" ? (
-            <>
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.cliCommand")}
-                value={selectedClientMeta.command}
-                copyKey="command"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.configSnippet")}
-                value={selectedClientMeta.snippet}
-                copyKey="snippet"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-            </>
-          ) : (
-            <>
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.configSnippet")}
-                value={selectedClientMeta.snippet}
-                copyKey="cursor"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-              {selectedClient === "other" ? (
-                <CopyableCodeBlock
-                  label={t("ai.externalMcp.universalSetupPrompt")}
-                  value={universalSetupPrompt}
-                  copyKey="universal-setup-prompt"
-                  copied={copied}
-                  onCopy={copyText}
-                  copyLabel={t("ai.externalMcp.copy")}
-                  copiedLabel={t("ai.externalMcp.copied")}
-                  emptyLabel={t("ai.externalMcp.unavailable")}
-                />
-              ) : null}
-            </>
-          )}
+          <details className="space-y-3">
+            <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.manualSetup")}</summary>
+            <label className="flex flex-wrap items-center justify-between gap-2 text-sm">
+              {t("ai.toolSettings.format")}
+              <select aria-label={t("ai.toolSettings.format")} className="h-9 max-w-full rounded-md border border-input bg-background px-3 text-sm" value={manualFormat} onChange={(event) => setManualFormat(event.currentTarget.value)}>
+                {selectedClientMeta.kind === "installable" ? <option value="command">{t("ai.externalMcp.cliCommand")}</option> : null}
+                <option value="snippet">{t("ai.externalMcp.configSnippet")}</option>
+                {selectedClient === "other" ? <option value="prompt">{t("ai.externalMcp.universalSetupPrompt")}</option> : null}
+              </select>
+            </label>
+            <CopyableCodeBlock
+              label={t(manualFormat === "command" ? "ai.externalMcp.cliCommand" : manualFormat === "prompt" ? "ai.externalMcp.universalSetupPrompt" : "ai.externalMcp.configSnippet")}
+              value={manualFormat === "command" ? selectedClientMeta.command : manualFormat === "prompt" ? universalSetupPrompt : selectedClientMeta.snippet}
+              copyKey={manualFormat}
+              copied={copied}
+              onCopy={copyText}
+              copyLabel={t("ai.externalMcp.copy")}
+              copiedLabel={t("ai.externalMcp.copied")}
+              emptyLabel={t("ai.externalMcp.unavailable")}
+            />
+          </details>
         </div>
+          </TabsContent>
+        </Tabs>
       </div>
+      <details className="space-y-3">
+        <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.connectionDetails")}</summary>
+        <div className="flex min-h-8 items-center justify-between gap-2">
+          <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.discovery")}</div>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void refreshStatus()}
+            disabled={isRefreshing}
+          >
+            <RefreshCw size={14} className={cn("mr-1.5", isRefreshing && "animate-spin")} />
+            {t("ai.externalMcp.refresh")}
+          </Button>
+        </div>
+        <div className="space-y-3">
+          <CopyableCodeBlock
+            label={t("ai.externalMcp.launcher")}
+            value={launcherPath || ""}
+            copyKey="launcher"
+            copied={copied}
+            onCopy={copyText}
+            copyLabel={t("ai.externalMcp.copy")}
+            copiedLabel={t("ai.externalMcp.copied")}
+            emptyLabel={t("ai.externalMcp.unavailable")}
+          />
+          <CopyableCodeBlock
+            label={t("ai.externalMcp.discovery")}
+            value={status?.discoveryPath || ""}
+            copyKey="discovery"
+            copied={copied}
+            onCopy={copyText}
+            copyLabel={t("ai.externalMcp.copy")}
+            copiedLabel={t("ai.externalMcp.copied")}
+            emptyLabel={t("ai.externalMcp.unavailable")}
+          />
+          {!enabled ? (
+            <p className="text-xs text-amber-500">{t("ai.externalMcp.enableForLauncher")}</p>
+          ) : null}
+        </div>
+      </details>
+
+            {actionMessage ? <p role={actionMessage.tone === "error" ? "alert" : "status"} className={cn("text-xs", actionMessage.tone === "error" ? "text-destructive" : "text-muted-foreground")}>{actionMessage.text}</p> : null}
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
 
       {actionMessage ? (
         <div
@@ -991,6 +1008,7 @@ export const ExternalMcpCard: React.FC = () => {
       {configError || status?.error ? (
         <div role="alert" className="text-xs text-destructive">{configError || status?.error}</div>
       ) : null}
-    </div>
+      </div>
+    </SettingsSection>
   );
 };

components/settings/tabs/ai/ExternalMcpHttpSection.tsx

@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React, { useEffect, useId, useRef, useState } from "react";
 import {
   buildClaudeHttpAddCommand,
   buildCodexHttpEnvLine,
@@ -8,9 +8,12 @@ import {
   DEFAULT_EXTERNAL_MCP_HTTP_PORT,
 } from "../../../../domain/externalMcpHttp";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
-import { cn } from "../../../../lib/utils";
 import { Button } from "../../../ui/button";
 import { SettingCard, SettingRow, Toggle } from "../../settings-ui";
+import { ToolStatusPill } from "./ToolStatusPill";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
+import { useOptionalSettingsFocus } from "../../SettingsFocusContext";
+import { SettingsAnchor } from "../../settings-ui";
 import { CopyableCodeBlock } from "./CopyableCodeBlock";
 
 export type ExternalMcpHttpViewStatus = {
@@ -41,6 +44,10 @@ type ExternalMcpHttpSectionProps = {
   status: ExternalMcpHttpViewStatus | null;
   copied: string | null;
   rotating: boolean;
+  applying?: boolean;
+  operationError?: string | null;
+  copyError?: string | null;
+  onRetry?: () => void;
   onCopy: (key: string, text: string) => void;
   onChange: (next: ExternalMcpHttpViewSettings) => void;
   onRotateToken: () => void;
@@ -73,11 +80,25 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   status,
   copied,
   rotating,
+  applying,
+  operationError,
+  copyError,
+  onRetry,
   onCopy,
   onChange,
   onRotateToken,
 }) => {
   const { t } = useI18n();
+  const operationErrorRef = useRef<HTMLDivElement>(null);
+  const errorId = useId();
+  const [open, setOpen] = useState(false);
+  useEffect(() => {
+    if (open && (operationError || copyError)) operationErrorRef.current?.focus();
+  }, [open, operationError, copyError]);
+  const focus = useOptionalSettingsFocus();
+  useEffect(() => {
+    if (focus?.request?.anchorId === "ai-external-mcp-http") setOpen(true);
+  }, [focus?.request]);
   const [portDraft, setPortDraft] = useState(String(settings.port || DEFAULT_EXTERNAL_MCP_HTTP_PORT));
   const [addressDraft, setAddressDraft] = useState(settings.listenAddress || "0.0.0.0");
   const [clientHostDraft, setClientHostDraft] = useState(settings.clientHost || "");
@@ -85,6 +106,16 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   const [addressError, setAddressError] = useState(false);
   const [clientHostError, setClientHostError] = useState(false);
 
+  const changeOpen = (next: boolean) => {
+    setPortDraft(String(settings.port || DEFAULT_EXTERNAL_MCP_HTTP_PORT));
+    setAddressDraft(settings.listenAddress || "0.0.0.0");
+    setClientHostDraft(settings.clientHost || "");
+    setPortError(false);
+    setAddressError(false);
+    setClientHostError(false);
+    setOpen(next);
+  };
+
   const listenAddress = settings.allowCustomBind
     ? (status?.listenAddress || settings.listenAddress)
     : "127.0.0.1";
@@ -97,14 +128,9 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   );
   const token = status?.bearerToken || "";
   const listening = Boolean(status?.listening);
-  const statusLabel = listening
-    ? t("ai.externalMcp.http.listening")
-    : t("ai.externalMcp.http.notListening");
-  const statusClass = status?.errorCode
-    ? "text-destructive"
-    : listening
-      ? "text-emerald-500"
-      : "text-muted-foreground";
+  const hasRuntimeError = Boolean(operationError || status?.errorCode || status?.error);
+  const statusLabel = hasRuntimeError ? t("ai.externalMcp.status.error")
+    : t(listening ? "ai.externalMcp.http.listening" : "ai.externalMcp.http.notListening");
 
   let errorText = "";
   if (portError) errorText = t("ai.externalMcp.http.invalidPort");
@@ -116,6 +142,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   } else if (status?.errorCode === "invalid_address") errorText = t("ai.externalMcp.http.invalidAddress");
   else if (status?.errorCode === "invalid_port") errorText = t("ai.externalMcp.http.invalidPort");
   else if (status?.errorCode === "listen_failed") errorText = status.error || t("ai.externalMcp.http.listenFailed");
+  else if (status?.error) errorText = status.error;
 
   const commitPort = () => {
     const port = parsePort(portDraft);
@@ -151,16 +178,25 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   };
 
   return (
-    <div className="space-y-2">
+    <SettingsAnchor anchorId="ai-external-mcp-http" className="space-y-2">
       <div className="flex items-center justify-between gap-3">
         <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.http.title")}</div>
-        <div className={cn("text-xs font-medium", statusClass)}>{statusLabel}</div>
+        <ToolStatusPill tone={hasRuntimeError ? "error" : listening ? "active" : "inactive"}>{statusLabel}</ToolStatusPill>
       </div>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.description")}</p>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.legacySseNote")}</p>
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingCard>
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t(settings.enabled ? "ai.toolSettings.httpOn" : "ai.toolSettings.httpOff")} description={settings.allowCustomBind ? t("ai.externalMcp.http.warning") : t("ai.toolSettings.loopback")}>
+          <ToolSettingsDialog title={t("ai.externalMcp.http.title")} triggerLabel={t("ai.toolSettings.configureHttp")} immediate open={open} onOpenChange={changeOpen}>
+      {applying ? <p role="status" className="text-xs text-muted-foreground">{t("ai.toolSettings.applyingHttp")}</p> : null}
+      {operationError || copyError ? <div ref={operationErrorRef} role="alert" tabIndex={-1} className="space-y-2 text-xs text-destructive">
+        {operationError ? <p>{operationError}</p> : null}
+        {copyError ? <p>{copyError}</p> : null}
+        {operationError && onRetry ? <Button type="button" variant="outline" size="sm" disabled={rotating || applying} onClick={onRetry}>{t("ai.toolSettings.retry")}</Button> : null}
+      </div> : null}
+      <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.description")}</p>
+      <SettingCard divided className="border-0 bg-transparent p-0">
         <SettingRow
-          anchorId="ai-external-mcp-http"
           label={t("ai.externalMcp.http.enable")}
         >
           <Toggle
@@ -176,6 +212,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
           <input
             type="number"
             aria-label={t("ai.externalMcp.http.port")}
+            aria-invalid={portError}
+            aria-describedby={portError ? errorId : undefined}
             min={1024}
             max={65535}
             value={portDraft}
@@ -207,6 +245,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             <input
               type="text"
               aria-label={t("ai.externalMcp.http.listenAddress")}
+              aria-invalid={addressError}
+              aria-describedby={addressError ? errorId : undefined}
               placeholder={t("ai.externalMcp.http.listenAddress.placeholder")}
               value={addressDraft}
               onChange={(event) => {
@@ -226,6 +266,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             <input
               type="text"
               aria-label={t("ai.externalMcp.http.clientHost")}
+              aria-invalid={clientHostError}
+              aria-describedby={clientHostError ? errorId : undefined}
               placeholder={t("ai.externalMcp.http.clientHost.placeholder")}
               value={clientHostDraft}
               onChange={(event) => {
@@ -245,8 +287,9 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
       {settings.enabled && !externalMcpEnabled ? (
         <p className="text-xs text-amber-500">{t("ai.externalMcp.http.requiresExternalMcp")}</p>
       ) : null}
-      {errorText ? <p className="text-xs text-destructive">{errorText}</p> : null}
-      <div className="space-y-2.5 rounded-md border border-border/60 bg-background/50 p-3">
+      {errorText ? <p id={errorId} role="alert" className="text-xs text-destructive">{errorText}</p> : null}
+      <details className="space-y-4">
+        <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.connectionDetails")}</summary>
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.url")}
           value={url}
@@ -259,6 +302,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.token")}
           value={token}
+          sensitive
           copyKey="http-token"
           copied={copied}
           onCopy={onCopy}
@@ -272,7 +316,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             type="button"
             variant="outline"
             size="sm"
-            disabled={!externalMcpEnabled || !settings.enabled || rotating}
+            disabled={!externalMcpEnabled || !settings.enabled || rotating || applying}
             onClick={onRotateToken}
           >
             {t("ai.externalMcp.http.regenerate")}
@@ -290,6 +334,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.envLine")}
           value={token ? buildCodexHttpEnvLine(token) : ""}
+          sensitive
           copyKey="http-env"
           copied={copied}
           onCopy={onCopy}
@@ -300,6 +345,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.claudeCommand")}
           value={token ? buildClaudeHttpAddCommand(url, token) : ""}
+          sensitive
           copyKey="http-claude"
           copied={copied}
           onCopy={onCopy}
@@ -310,6 +356,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.genericSnippet")}
           value={token ? buildGenericHttpMcpJson(url, token) : ""}
+          sensitive
           copyKey="http-json"
           copied={copied}
           onCopy={onCopy}
@@ -317,7 +364,14 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
           copiedLabel={t("ai.externalMcp.copied")}
           emptyLabel={t("ai.externalMcp.unavailable")}
         />
-      </div>
-    </div>
+      </details>
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
+      {settings.enabled && !externalMcpEnabled ? <p className="text-xs text-amber-500">{t("ai.externalMcp.http.requiresExternalMcp")}</p> : null}
+      {applying ? <p role="status" className="text-xs text-muted-foreground">{t("ai.toolSettings.applyingHttp")}</p> : null}
+      {copyError ? <p role="alert" className="text-xs text-destructive">{copyError}</p> : null}
+      {operationError || status?.error ? <p role="alert" className="text-xs text-destructive">{operationError || status?.error}</p> : null}
+    </SettingsAnchor>
   );
 };

components/settings/tabs/ai/ModelSelector.discovery.test.tsx

@@ -0,0 +1,177 @@
+import assert from 'node:assert/strict';
+import test, { after } from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { JSDOM } from 'jsdom';
+
+const dom = new JSDOM('<!doctype html><html><body></body></html>', { url: 'http://localhost/' });
+const previous = new Map<string, PropertyDescriptor | undefined>();
+for (const name of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'MutationObserver', 'CustomEvent', 'Event'] as const) {
+  previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
+  Object.defineProperty(globalThis, name, { value: dom.window[name], configurable: true });
+}
+for (const [name, value] of Object.entries({ IS_REACT_ACT_ENVIRONMENT: true, fetch: () => { throw new Error('Network is forbidden in model discovery tests'); } })) {
+  previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
+  Object.defineProperty(globalThis, name, { value, configurable: true });
+}
+after(() => {
+  dom.window.close();
+  for (const [name, descriptor] of previous) {
+    if (descriptor) Object.defineProperty(globalThis, name, descriptor);
+    else Reflect.deleteProperty(globalThis, name);
+  }
+});
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { TooltipProvider } = await import('../../../ui/tooltip');
+const { ModelSelector } = await import('./ModelSelector');
+
+type Response = { ok: boolean; status?: number; data: string; error?: string };
+function deferred() {
+  let resolve!: (value: Response) => void;
+  let reject!: (error: Error) => void;
+  const promise = new Promise<Response>((yes, no) => { resolve = yes; reject = no; });
+  return { promise, resolve, reject };
+}
+type Props = React.ComponentProps<typeof ModelSelector>;
+const baseProps: Props = {
+  value: '', onChange: () => {}, baseURL: 'http://127.0.0.1:9217/v1',
+  providerId: 'custom', style: 'openai', apiKey: 'SYNTHETIC_FIXTURE_KEY', customHeaders: {},
+};
+async function mount() {
+  const requests: ({ url: string; method: string; body: string | undefined } & ReturnType<typeof deferred>)[] = [];
+  const allowlistCalls: string[] = [];
+  let overflow = false;
+  Object.defineProperty(window, 'netcatty', { configurable: true, value: {
+    aiAllowlistAddHost: async (baseURL: string) => { allowlistCalls.push(baseURL); return { ok: true }; },
+    aiFetch: (url: string, method: string, _headers: unknown, body: string | undefined) => {
+      // Hold instead of rejecting if a regression exceeds the budget, so even a
+      // broken auto-fetch effect cannot create an uncontrolled test loop.
+      if (requests.length >= 4) { overflow = true; return new Promise<Response>(() => {}); }
+      const pending = deferred();
+      requests.push({ url, method, body, ...pending });
+      return pending.promise;
+    },
+  } });
+  let renderer!: ReactTestRenderer;
+  const view = (updates: Partial<Props> = {}) => <I18nProvider locale="en"><TooltipProvider>
+    <ModelSelector {...baseProps} {...updates} />
+  </TooltipProvider></I18nProvider>;
+  await act(async () => { renderer = create(view()); });
+  const input = () => renderer.root.findByType('input');
+  const open = async () => { await act(async () => input().props.onFocus()); };
+  const close = async () => { await act(async () => input().props.onBlur()); };
+  const refresh = async () => {
+    const button = renderer.root.findAllByType('button').find((node) => typeof node.props.onClick === 'function')!;
+    await act(async () => button.props.onClick({ defaultPrevented: false }));
+  };
+  const markup = () => JSON.stringify(renderer.toJSON());
+  return {
+    requests, allowlistCalls, input, open, close, refresh, markup,
+    update: async (updates: Partial<Props>) => { await act(async () => renderer.update(view(updates))); },
+    assertBounded: () => assert.equal(overflow, false, 'mock request budget was not exceeded'),
+    unmount: async () => { await act(async () => renderer.unmount()); },
+  };
+}
+const notFound: Response = { ok: false, status: 404, data: '{"error":"fixture has no model-list route"}' };
+const models = (id: string): Response => ({ ok: true, status: 200, data: JSON.stringify({ data: [{ id }] }) });
+
+for (const failure of ['404', 'transport', 'invalid-json'] as const) {
+  test(`model discovery ${failure} failure stays visible without auto-retry; Refresh retries once`, async () => {
+    const h = await mount();
+    const reject = (index: number) => {
+      if (failure === 'transport') h.requests[index].reject(new Error('Synthetic model-list transport failure'));
+      else h.requests[index].resolve(failure === '404' ? notFound : { ok: true, status: 200, data: '{not json' });
+    };
+    try {
+      assert.equal(h.requests.length, 0);
+      await h.open();
+      assert.equal(h.requests.length, 1);
+      assert.equal(h.requests[0].url, 'http://127.0.0.1:9217/v1/models');
+      assert.equal(h.requests[0].method, 'GET');
+      assert.equal(h.requests[0].body, undefined);
+      await act(async () => reject(0));
+      assert.equal(h.requests.length, 1, 'failure must settle instead of triggering the loading effect again');
+      assert.match(h.markup(), /text-destructive/);
+      assert.doesNotMatch(h.markup(), /Loading models/);
+      await h.close();
+      await h.open();
+      await h.update({ customHeaders: {} });
+      assert.equal(h.requests.length, 1, 'reopen or an equal-config render must not retry a failure');
+      assert.match(h.markup(), /text-destructive/);
+      await h.refresh();
+      assert.equal(h.requests.length, 2);
+      await act(async () => reject(1));
+      assert.equal(h.requests.length, 2);
+      assert.match(h.markup(), /text-destructive/);
+      assert.equal(h.allowlistCalls.length, 2);
+      h.assertBounded();
+    } finally { await h.unmount(); }
+  });
+}
+
+test('changing provider configuration clears a settled error and permits one fresh discovery', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 1);
+    await h.update({ baseURL: 'http://127.0.0.1:9217/second-provider/v1', providerId: 'openai' });
+    assert.equal(h.requests.length, 2);
+    assert.equal(h.requests[1].url, 'http://127.0.0.1:9217/second-provider/v1/models');
+    await act(async () => h.requests[1].resolve(models('second-model')));
+    assert.equal(h.requests.length, 2);
+    assert.match(h.markup(), /second-model/);
+    assert.doesNotMatch(h.markup(), /Failed to fetch models/);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('a provider switch ignores an older pending discovery failure', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await h.update({ baseURL: 'http://127.0.0.1:9217/second-provider/v1' });
+    assert.equal(h.requests.length, 2);
+    await act(async () => h.requests[1].resolve(models('current-model')));
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 2);
+    assert.match(h.markup(), /current-model/);
+    assert.doesNotMatch(h.markup(), /Failed to fetch models/);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('successful discovery remains cached across reopen and manual model entry remains controlled', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await act(async () => h.requests[0].resolve(models('listed-model')));
+    await h.close();
+    await h.open();
+    assert.equal(h.requests.length, 1);
+    assert.match(h.markup(), /listed-model/);
+    const changed: string[] = [];
+    await h.update({ onChange: (value) => { changed.push(value); } });
+    await act(async () => h.input().props.onChange({ target: { value: 'manual-model' } }));
+    await h.update({ value: changed[0] });
+    assert.deepEqual(changed, ['manual-model']);
+    assert.equal(h.input().props.value, 'manual-model');
+    assert.equal(h.requests.length, 1);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('closing and unmounting with a pending discovery do not trigger another request', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await h.close();
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 1);
+    await h.refresh();
+    assert.equal(h.requests.length, 2);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+  await act(async () => h.requests[1].resolve(notFound));
+  assert.equal(h.requests.length, 2);
+});

components/settings/tabs/ai/ModelSelector.tsx

@@ -175,12 +175,12 @@ export const ModelSelector: React.FC<{
     }
   }, [baseURL, effectiveModelsEndpoint, apiKey, customHeaders, resolvedStyle, skipTLSVerify, discoveryKey]);
 
-  // Auto-fetch when dropdown first opens
+  // Failed discovery stays settled until explicit refresh or a new discovery key.
   useEffect(() => {
-    if (isOpen && canFetch && !hasFetched && !isLoading) {
+    if (isOpen && canFetch && !hasFetched && !isLoading && error === null) {
       void fetchModels();
     }
-  }, [isOpen, canFetch, hasFetched, isLoading, fetchModels]);
+  }, [isOpen, canFetch, hasFetched, isLoading, error, fetchModels]);
 
   // Filter preset and discovered models by current input value (inline autocomplete).
   const suggestions = useMemo(() => {

components/settings/tabs/ai/ToolAccessGuidance.tsx

@@ -4,6 +4,7 @@ import { useI18n } from "../../../../application/i18n/I18nProvider";
 import type { AIToolIntegrationMode } from "../../../../infrastructure/ai/types";
 import { cn } from "../../../../lib/utils";
 import { useToolAccessGuidanceState } from "../../../../application/state/useToolAccessGuidanceState";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
 import { EXTERNAL_MCP_DISCOVERY_ENV_VAR } from "./ExternalMcpCard";
 
 /** Build a ready-to-paste prompt so an external AI client can register Netcatty MCP itself. */
@@ -45,16 +46,20 @@ type CopyRowProps = {
 
 const CopyRow: React.FC<CopyRowProps> = ({ value, label, copyLabel, copiedLabel, testId }) => {
   const [copied, setCopied] = useState(false);
+  const [copyError, setCopyError] = useState(false);
+  const { t } = useI18n();
   const canCopy = Boolean(value);
 
   const handleCopy = async () => {
     if (!value) return;
+    setCopyError(false);
+    setCopied(false);
     try {
       await navigator.clipboard.writeText(value);
       setCopied(true);
       window.setTimeout(() => setCopied(false), 1200);
     } catch {
-      // Clipboard may be unavailable; the text stays selectable in the block.
+      setCopyError(true);
     }
   };
 
@@ -82,6 +87,7 @@ const CopyRow: React.FC<CopyRowProps> = ({ value, label, copyLabel, copiedLabel,
           {copied ? <Check size={14} className="text-emerald-500" /> : <Copy size={14} />}
         </button>
       </div>
+      {copyError ? <p role="alert" className="text-xs text-destructive">{t("ai.externalMcp.copyFailed")}</p> : null}
     </div>
   );
 };
@@ -93,7 +99,7 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
 
   if (mode === "skills") {
     return (
-      <div className="rounded-md border border-border/60 bg-background/50 p-3 space-y-2">
+      <ToolSettingsDialog title={t("ai.toolAccess.skills.file")} triggerLabel={t("ai.toolSettings.viewSkills")}>
         <p className="text-xs text-muted-foreground leading-5">
           {t("ai.toolAccess.skills.description")}
         </p>
@@ -110,12 +116,12 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
         {commandPrefix ? (
           <p className="text-xs text-muted-foreground/80 font-mono break-all">{commandPrefix}</p>
         ) : null}
-      </div>
+      </ToolSettingsDialog>
     );
   }
 
   return (
-    <div className="rounded-md border border-border/60 bg-background/50 p-3 space-y-2">
+    <ToolSettingsDialog title={t("ai.toolAccess.mcpPrompt.title")} triggerLabel={t("ai.toolSettings.viewPrompt")}>
       <p className="text-xs text-muted-foreground leading-5">
         {t("ai.toolAccess.mcpPrompt.description")}
       </p>
@@ -129,6 +135,6 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
       {!mcpLauncherPath ? (
         <p className="text-xs text-amber-500">{t("ai.toolAccess.mcpPrompt.enableHint")}</p>
       ) : null}
-    </div>
+    </ToolSettingsDialog>
   );
 };

components/settings/tabs/ai/ToolSettingsDialog.tsx

@@ -0,0 +1,47 @@
+import React from "react";
+import { useI18n } from "../../../../application/i18n/I18nProvider";
+import { Button } from "../../../ui/button";
+import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle, DialogTrigger } from "../../../ui/dialog";
+
+/** Shared, bounded settings dialog. Callers retain their original commit semantics. */
+export const ToolSettingsDialog: React.FC<{
+  title: string;
+  triggerLabel: string;
+  children: React.ReactNode;
+  immediate?: boolean;
+  open?: boolean;
+  onOpenChange?: (open: boolean) => void;
+  footer?: React.ReactNode;
+  busy?: boolean;
+}> = ({ title, triggerLabel, children, immediate, open, onOpenChange, footer, busy }) => {
+  const { t } = useI18n();
+  const [localOpen, setLocalOpen] = React.useState(false);
+  const changeOpen = (next: boolean) => {
+    if (busy) return;
+    setLocalOpen(next);
+    onOpenChange?.(next);
+  };
+  return (
+    <Dialog open={open ?? localOpen} onOpenChange={changeOpen}>
+      <DialogTrigger asChild>
+        <Button type="button" variant="outline" size="sm">{triggerLabel}</Button>
+      </DialogTrigger>
+      <DialogContent
+        className="flex max-h-[calc(100dvh-2rem)] w-[calc(100vw-2rem)] max-w-2xl flex-col gap-0 overflow-hidden p-0"
+        aria-busy={busy || undefined}
+        hideCloseButton={busy}
+        onEscapeKeyDown={(event) => { if (busy) event.preventDefault(); }}
+        onInteractOutside={(event) => { if (busy) event.preventDefault(); }}
+      >
+        <DialogHeader className="shrink-0 px-6 pb-4 pt-6 pr-12 text-left">
+          <DialogTitle>{title}</DialogTitle>
+          {immediate ? <p className="text-xs text-muted-foreground">{t("ai.toolSettings.immediate")}</p> : null}
+        </DialogHeader>
+        <div className="min-h-0 overflow-y-auto px-6 pb-6 space-y-4">{children}</div>
+        <DialogFooter className="shrink-0 gap-2 border-t px-6 py-4">
+          {footer ?? <Button type="button" variant="outline" onClick={() => changeOpen(false)}>{t("common.close")}</Button>}
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

components/settings/tabs/ai/ToolStatusPill.tsx

@@ -0,0 +1,14 @@
+import React from "react";
+import { cn } from "../../../../lib/utils";
+
+export type ToolStatusTone = "active" | "inactive" | "error";
+
+/** Non-interactive runtime status, shared by the MCP and HTTP section headers. */
+export const ToolStatusPill: React.FC<{ tone: ToolStatusTone; children: React.ReactNode }> = ({ tone, children }) => (
+  <span role="status" className={cn(
+    "inline-flex shrink-0 items-center rounded-full px-2.5 py-0.5 text-xs font-medium leading-5",
+    tone === "active" ? "bg-primary/10 text-primary"
+      : tone === "error" ? "bg-destructive/10 text-destructive"
+        : "bg-muted text-muted-foreground",
+  )}>{children}</span>
+);

components/sftp/SftpOverlays.tsx

@@ -264,6 +264,7 @@ export const SftpOverlays: React.FC<SftpOverlaysProps> = React.memo(({
               open={showTextEditor}
               onClose={closeTextEditor}
               fileName={textEditorFileName}
+              filePath={textEditorTarget?.fullPath}
               initialContent={textEditorContent}
               onSave={handleSaveTextFile}
               editorWordWrap={editorWordWrap}

components/sftp/hooks/useSftpViewFileOps.ts

@@ -248,7 +248,7 @@ export const useSftpViewFileOps = ({
       hostId: target.hostId,
       remotePath: target.fullPath,
       fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
       content: snapshot.content,
       baselineContent: snapshot.baselineContent,
       wordWrap: snapshot.wordWrap,
@@ -284,7 +284,7 @@ export const useSftpViewFileOps = ({
       hostId: target.hostId,
       remotePath: target.fullPath,
       fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
       content: snapshot.content,
       baselineContent: snapshot.baselineContent,
       wordWrap: snapshot.wordWrap,

components/sftp/nginxEditorLanguage.test.ts

@@ -0,0 +1,131 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import ts from 'typescript';
+import type { TextEditorPaneProps } from '../editor/TextEditorPane';
+import type { SftpStateApi } from '../../application/state/useSftpState';
+import { editorTabStore } from '../../application/state/editorTabStore';
+import { activeTabStore } from '../../application/state/activeTabStore';
+import { useSftpViewFileOps } from './hooks/useSftpViewFileOps';
+
+// Keep the real modal state/save flow; replace only Monaco and visual chrome.
+function loadModal(pane: React.ComponentType<TextEditorPaneProps>) {
+  const url = new URL('../TextEditorModal.tsx', import.meta.url);
+  const compiled = ts.transpileModule(readFileSync(url, 'utf8'), { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+    jsx: ts.JsxEmit.ReactJSX, esModuleInterop: true,
+  } }).outputText;
+  const require = createRequire(url);
+  const passthrough = ({ children }: { children: React.ReactNode }) => children;
+  const replacements: Record<string, unknown> = {
+    './editor/TextEditorPane': { TextEditorPane: pane },
+    './ui/dialog': { Dialog: passthrough, DialogContent: passthrough, DialogTitle: passthrough },
+    './ui/toast': { toast: { success() {}, error() {} } },
+    '../application/state/windowInputFocus': { scheduleWindowInputFocus() {} },
+  };
+  const module = { exports: {} as { default: React.ComponentType<Record<string, unknown>> } };
+  new Function('require', 'module', 'exports', compiled)(
+    (id: string) => replacements[id] ?? require(id), module, module.exports,
+  );
+  return module.exports.default;
+}
+
+test('SFTP modal uses full paths, preserves manual selection and saves exact content', async () => {
+  const globals = globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean };
+  const previousAct = globals.IS_REACT_ACT_ENVIRONMENT;
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
+  const previousActiveTab = activeTabStore.getActiveTabId();
+  const detached: Array<{ languageId: string; content: string; remotePath: string }> = [];
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
+    setTimeout, clearTimeout,
+    netcatty: { openEditorWindow: async (snapshot: typeof detached[number]) => {
+      detached.push(snapshot);
+      return { success: true };
+    } },
+  } });
+  globals.IS_REACT_ACT_ENVIRONMENT = true;
+  let paneProps: TextEditorPaneProps | undefined;
+  const Modal = loadModal((props) => { paneProps = props; return null; });
+  let ops: ReturnType<typeof useSftpViewFileOps> | undefined;
+  const original = '# fixture\r\nserver { proxy_pass http://$host; }\r\n';
+  const writes: unknown[][] = [];
+  const connection = { id: 'nginx-fixture', hostId: 'nginx-host', currentPath: '/etc/nginx/conf.d' };
+  const sftpRef = { current: {
+    leftPane: { id: 'nginx-pane', connection }, rightPane: { id: 'nginx-pane', connection },
+    joinPath: (parent: string, name: string) => `${parent}/${name}`,
+    readTextFile: async () => original,
+    writeTextFile: async (...args: unknown[]) => { writes.push(args); },
+  } as unknown as SftpStateApi };
+  function Probe() {
+    ops = useSftpViewFileOps({
+      sftpRef, behaviorRef: { current: '' }, autoSyncRef: { current: false },
+      getOpenerForFileRef: { current: () => null }, setOpenerForExtension() {}, t: (key) => key,
+    });
+    return ops.showTextEditor ? React.createElement(Modal, {
+      open: true, onClose() {}, fileName: ops.textEditorTarget!.file.name,
+      filePath: ops.textEditorTarget!.fullPath, initialContent: ops.textEditorContent,
+      onSave: ops.handleSaveTextFile, editorWordWrap: false, onToggleWordWrap() {},
+      hotkeyScheme: 'pc', keyBindings: [], onPromoteToTab: ops.onPromoteToTab,
+    }) : null;
+  }
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    const file = { name: 'site.conf', size: original.length, type: 'file' as const, lastModified: 0, sizeFormatted: '', lastModifiedFormatted: '' };
+    await act(async () => { await ops!.onEditFileLeft(file); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    assert.equal(paneProps!.fileName, 'site.conf');
+    // Keep the modal mounted: basename and content stay identical, only path changes.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/site.conf'); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    await act(async () => { paneProps!.onLanguageChange('ini'); });
+    await act(async () => { paneProps!.onSave(); });
+    assert.deepEqual(writes, [['left', '/etc/nginx/conf.d/site.conf', original]]);
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    let tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'ini', 'promotion preserves a manual override');
+    assert.equal(tab?.content, original);
+    editorTabStore.close(tab!.id);
+
+    // A generic config can still be switched to Nginx manually.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { paneProps!.onLanguageChange('nginx'); });
+    assert.equal(paneProps!.languageId, 'nginx', 'arbitrary config supports manual Nginx selection');
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'nginx');
+
+    // Legacy snapshots without language still infer from the full target path.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/fallback.conf'); });
+    await act(async () => { ops!.onPromoteToTab({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(editorTabStore.getTabs().find(({ remotePath }) => remotePath.endsWith('/fallback.conf'))?.languageId, 'nginx');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/sites-enabled/example.com'); });
+    await act(async () => { ops!.onPopOut({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(detached.at(-1)?.languageId, 'nginx', 'pop-out fallback also uses the full path');
+    assert.equal(detached.at(-1)?.remotePath, '/etc/nginx/sites-enabled/example.com');
+    assert.equal(detached.at(-1)?.content, original);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    for (const tab of editorTabStore.getTabs().filter(({ sessionId }) => sessionId === connection.id)) editorTabStore.close(tab.id);
+    activeTabStore.setActiveTabId(previousActiveTab);
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+    globals.IS_REACT_ACT_ENVIRONMENT = previousAct;
+    if (previousWindow) Object.defineProperty(globalThis, 'window', previousWindow);
+    else Reflect.deleteProperty(globalThis, 'window');
+  }
+});
+
+test('the SFTP overlay forwards path context to the lazy modal', () => {
+  const overlay = readFileSync(new URL('./SftpOverlays.tsx', import.meta.url), 'utf8');
+  assert.match(overlay, /<LazyTextEditorModal[\s\S]*?filePath=\{textEditorTarget\?\.fullPath\}/);
+  const pane = readFileSync(new URL('../editor/TextEditorPane.tsx', import.meta.url), 'utf8');
+  assert.match(pane, /beforeMount=\{registerNginxLanguage\}/);
+});

components/terminalLayer/TerminalLayerSupport.tsx

@@ -283,6 +283,8 @@ interface AIChatPanelsHostProps {
   mountedTabIds: string[];
   activeTabId: string | null;
   activeSidePanelTab: SidePanelTab | null;
+  /** All live terminal+workspace target ids (for /chats dangling detection). */
+  liveScopeTargetIds: Set<string>;
   contextsByTabId: Map<string, AIPanelContext>;
   resolveExecutorContext: (scope: {
     type: 'terminal' | 'workspace';
@@ -298,6 +300,8 @@ interface AIChatPanelsHostProps {
   onOpenVaultHostFromChat?: (hostId: string) => void;
   onOpenVaultSectionFromChat?: (section: 'notes' | 'hosts' | 'snippets') => void;
   onOpenVaultSnippetFromChat?: (snippetId: string) => void;
+  /** Live workspaces, threaded to AI chats for `/chats` scope titles. */
+  workspaces?: Workspace[] | null;
 }
 
 const EMPTY_WORKSPACES: Workspace[] = [];
@@ -450,6 +454,7 @@ function aiChatPanelsHostAreEqual(
   next: AIChatPanelsHostProps,
 ): boolean {
   if (prev.mountedTabIds !== next.mountedTabIds) return false;
+  if (prev.liveScopeTargetIds !== next.liveScopeTargetIds) return false;
   if (prev.contextsByTabId !== next.contextsByTabId) return false;
   if (prev.activeSidePanelTab !== next.activeSidePanelTab) return false;
   if (prev.pendingTerminalSelection !== next.pendingTerminalSelection) return false;
@@ -462,6 +467,7 @@ function aiChatPanelsHostAreEqual(
   if (prev.onOpenVaultHostFromChat !== next.onOpenVaultHostFromChat) return false;
   if (prev.onOpenVaultSectionFromChat !== next.onOpenVaultSectionFromChat) return false;
   if (prev.onOpenVaultSnippetFromChat !== next.onOpenVaultSnippetFromChat) return false;
+  if (prev.workspaces !== next.workspaces) return false;
   if (prev.activeTabId === next.activeTabId) return true;
 
   for (let i = 0; i < prev.mountedTabIds.length; i += 1) {
@@ -489,6 +495,7 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
   mountedTabIds,
   activeTabId,
   activeSidePanelTab,
+  liveScopeTargetIds,
   contextsByTabId,
   resolveExecutorContext,
   pendingTerminalSelection,
@@ -500,6 +507,7 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
   onOpenVaultHostFromChat,
   onOpenVaultSectionFromChat,
   onOpenVaultSnippetFromChat,
+  workspaces,
 }) => {
   const aiConfig = useContext(AIConfigContext);
 
@@ -517,6 +525,10 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
     showDraftView,
     updateDraft,
   } = aiConfig;
+  const aiPanelWorkspaces = useMemo(
+    () => (workspaces ?? []).map((workspace) => ({ id: workspace.id, title: workspace.title })),
+    [workspaces],
+  );
 
   useEffect(() => {
     if (!pendingTerminalSelection) return;
@@ -588,6 +600,9 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
                     undoLastTurnInSession={aiConfig.undoLastTurnInSession}
                     deleteSession={aiConfig.deleteSession}
                     updateSessionTitle={aiConfig.updateSessionTitle}
+                    rebindSessionScope={aiConfig.rebindSessionScope}
+                    exportSessionsBackup={aiConfig.exportSessionsBackup}
+                    importSessionsBackup={aiConfig.importSessionsBackup}
                     updateSessionExternalSessionId={aiConfig.updateSessionExternalSessionId}
                     addMessageToSession={aiConfig.addMessageToSession}
                     updateLastMessage={aiConfig.updateLastMessage}
@@ -621,7 +636,9 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
                     scopeHostIds={context.scopeHostIds}
                     scopeLabel={context.scopeLabel}
                     focusedSessionId={context.focusedSessionId}
+                    workspaces={aiPanelWorkspaces}
                     terminalSessions={context.terminalSessions}
+                    liveScopeTargetIds={liveScopeTargetIds}
                     resolveExecutorContext={resolveExecutorContext}
                     isVisible={isVisible}
                     notes={notes}

components/terminalLayer/terminalLayerSidePanelSlots.tsx

@@ -654,6 +654,7 @@ function SidePanelAiSlotInner({
         mountedTabIds={mountedAiTabIds}
         activeTabId={activeTabId}
         activeSidePanelTab={isVisible ? 'ai' : null}
+        liveScopeTargetIds={validAIScopeTargetIds}
         contextsByTabId={aiContextsByTabId}
         resolveExecutorContext={resolveAIExecutorContext}
         pendingTerminalSelection={pendingTerminalSelectionForAI}
@@ -665,6 +666,7 @@ function SidePanelAiSlotInner({
         onOpenVaultHostFromChat={onOpenVaultHostFromChat}
         onOpenVaultSectionFromChat={onOpenVaultSectionFromChat}
         onOpenVaultSnippetFromChat={onOpenVaultSnippetFromChat}
+        workspaces={workspaces}
       />
     </AISidePanelStateRoot>
   );

components/ui/confirm-dialog.tsx

@@ -17,6 +17,7 @@ interface ConfirmDialogProps {
   confirmLabel: string;
   busy?: boolean;
   destructive?: boolean;
+  hostSecuritySurface?: boolean;
   onOpenChange: (open: boolean) => void;
   onConfirm: () => void;
 }
@@ -28,6 +29,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
   confirmLabel,
   busy = false,
   destructive = false,
+  hostSecuritySurface = false,
   onOpenChange,
   onConfirm,
 }: ConfirmDialogProps) {
@@ -35,7 +37,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
+      <DialogContent data-host-security-surface={hostSecuritySurface ? "" : undefined} className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
         <DialogHeader className="min-w-0 pr-6">
           <DialogTitle className="truncate">{title}</DialogTitle>
         </DialogHeader>

docs/plugin-platform/acceptance-candidate.md

@@ -1,5 +1,9 @@
 # Unified plugin acceptance candidate
 
+This file records the frozen 677 native baseline. For the subsequent permission
+policy and AI candidate, use [the new integration record](policy-ai-integration.md)
+and its package manifest. Historical consent flows below are not the revised UX.
+
 The dedicated branch is `integration/plugin-native-acceptance`. Its Draft PR
 records the exact current head and CI runs. Native AI, database, Host/Vault, and
 settings/logging checks use this candidate rather than separate feature trees.

docs/plugin-platform/ai-provider-startup.md

@@ -0,0 +1,108 @@
+# Plugin model transport cold start
+
+Commit `092438803bed96753bfe68cb78da9ca1137dee25` removes an independent startup
+dependency on the internal AI sidebar. It does not establish the cause or outcome
+of the original native failure; that still requires an authorized native retest.
+
+## Reproduced boundary
+
+At native candidate `677aac33b1eec9dbd4a367417a49c964cdea63e7`, the plugin model
+selector reads the saved host provider, while main's provider registry starts
+empty. The existing sidebar synchronizes that registry when visible or sending.
+The plugin startup path did not. A nondefault configured loopback port can
+therefore fail main's provider allowlist before HTTP transport starts.
+
+The revised `components/PluginAIContextHost.test.tsx` installs the browser sample,
+mounts the trusted host component, uses the real application preload, and routes
+model requests through `registerProviderHandlers` and its actual allowlist. It
+does not mount the internal sidebar or manually alter the allowlist. Credential
+injection uses synthetic fixture markers; the HTTP edge and deterministic local
+fixture use the existing transport. No paid service, real key, Note, or host is
+used. This remains DOM/in-process evidence, not native sandbox acceptance.
+
+Failed-before evidence is `/tmp/netcatty-ai-cold-provider-before-final.log`:
+
+```text
+ok: false
+allowlistRejected: true
+statusCode: undefined
+```
+
+The corrected regression passes and preserves both the selected fixture provider
+and a second host-configured synthetic provider. It checks that provider markers
+and configuration do not enter plugin-facing model/context envelopes. Expected
+SDK error output is suppressed during this diagnostic so request payloads and
+headers are not logged.
+
+## Correction
+
+Before publishing a selected model handle, the trusted renderer synchronizes the
+current host-owned provider settings through the existing `aiSyncProviders`
+application API. It checks that the selected model revision matches the snapshot
+being synchronized. The runtime rechecks activity, cancellation, model revision,
+and pending-selection ownership after the await. Pending selections count toward
+the model-handle cap; release and shutdown invalidate late results.
+
+Plugin requests supply no URL, credential, or provider configuration. The existing
+main sender validation, endpoint allowlist, source binding, and model invocation
+budgets are unchanged. No new schema feature, plugin permission, or consent
+dialog is added. The assistant package is unchanged and retains SHA-256
+`c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395`.
+
+Production integration touches `configuredModel.ts`, `trustedHostRuntime.ts`, and
+`usePluginAIContextHost.ts`. The hook's import and `prepareModel` option may
+overlap host-selection work; preserve both when integrating the separate policy
+task. Permission-engine, consent-dialog, and sample-UI changes are outside this
+correction.
+
+## Native and policy status
+
+The native open/close sidebar comparison was incomplete. Execution auto-review
+denied the Application-scope `context.selected.list` grant; that action did not
+execute. No post-sidebar inference was performed, the prompt expired, and the
+sample was disabled while the worker cleaned up. This is not native confirmation
+of the startup cause. The original `677aac33` app remains frozen for comparison;
+this fix does not authorize retrying the denied execution action.
+
+In the earlier permission engine, **Application** grants are memory-only for the
+application lifetime; **Always** grants are persisted. An explicitly authorized
+Application grant can fit bounded temporary QA. A one-use prompt on every stream
+read is not an unavoidable target UX. The separate policy task implements the
+new direction: default Allow for declared supported capabilities, per-plugin
+Allow/Ask/Deny settings, audit, and in-app Ask dialogs. That product change is
+separate from execution-tool authorization and must not be used to evade a tool
+denial. This transport correction does not redesign that policy.
+
+Native outcome, independent verification, and the sample's light-theme appearance
+follow-up remain separate acceptance work. No GUI launch, sandbox bypass, paid
+model invocation, main merge, or release was performed for this correction.
+
+## Node 22 CI observer correction
+
+The new cold-start test failed on exact head `9ca70f329` in test run
+`40436198585`, Linux job `121965743101`: 15,206 passed, 1 failed, 50 skipped.
+The sole failure was the empty SDK/renderer-error assertion receiving one
+`SDK_OR_RENDERER_ERROR` marker. This red result is retained as evidence; it is
+not an unrelated baseline failure.
+
+The CI runtime was Node `22.23.3`; local validation had used Node `24.19.0`.
+Reproduction on the exact CI version identified the safe category
+`setup:node-sqlite-experimental`, before any model operation. The existing
+`node:sqlite` import schedules its ExperimentalWarning on the next tick via
+`console.error`. The newly added observer was installed before that warning
+drained. The same test passed on Node 24, which did not emit that warning.
+
+The test now lets pending module warnings reach normal stderr before installing
+the SDK/renderer observer. The warning remains visible, and the zero-runtime-error
+assertion is unchanged. Safe phase/error categories make future failures
+diagnosable without request payloads or headers. No production behavior, timeout,
+permission, or cancellation assertion changed. Both Node versions pass the
+focused test; the Node 22 parallel fixture/UI/provider/preload group passes all
+16 tests with concurrency 4.
+
+Diagnostic evidence: `/tmp/netcatty-ai-cold-ci-node22-sqlite-category.log` fails
+before correction, `/tmp/netcatty-ai-cold-ci-node22-after.log` passes with the
+SQLite warning still visible, and `/tmp/netcatty-ai-cold-ci-node22-parallel.log`
+records the parallel check. The appearance-only sample change is independently
+published as `e325742abf9fd329f1f7858eda66367e7a62357c`; its package hash is
+`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.

docs/plugin-platform/ask-routing-integration.md

@@ -0,0 +1,125 @@
+# Managed-window Ask acceptance candidate
+
+The dedicated branch is `integration/plugin-ask-routing-acceptance`. Its Draft
+PR records the exact frozen integration head, CI and private renderer artifact
+handoff. It starts from frozen #4001 at
+`02049102b6732778adcd0f33b0a0ade6b4752327`; the old source checkout, QA workspace,
+profile and renderer artifact remain unchanged.
+
+## Exact inputs and ownership
+
+The only new input is policy owner's reviewed Ask correction
+`89beeb93749c751f255beb6d0e0f95d23bdd9a7b`, imported by ordinary merge
+`1b21c41fa26c0173084c7ae75e640ef3274285dd`. There were no merge conflicts or
+manual production edits. These seven production files exactly match that input:
+
+| File | Owned production delta |
+| --- | --- |
+| `electron/bridges/windowManager.cjs` | Enumerate managed app windows, including Settings |
+| `electron/main/registerBridges.cjs` | Supply the managed permission-window getter |
+| `electron/plugins/hostService.cjs` | Pass that getter to the existing decision host |
+| `electron/plugins/permissionDecisionHost.cjs` | Bind ready/focused/visible/unlocked managed renderer selection and request lifecycle to the chosen receiver |
+| `electron/plugins/pluginBridge.cjs` | Guard permission readiness/replies by managed app window and main frame; reject plugin/foreign/subframe senders |
+| `components/SettingsPage.tsx` | Mount the existing permission host for standalone Settings |
+| `components/plugins/PluginPermissionHost.tsx` | Mark Ask with the existing host-security surface so attached native views yield |
+
+The input also owns the Settings-installed-entrypoint regression, renderer test
+updates and policy/security documentation. AI d33 startup wiring, sample assets,
+the combined cold-start assertions and all earlier policy/transport history are
+preserved from 020. `ModelSelector.tsx` is unchanged from 020; the separate
+model-selector failure-loop repair is not imported. Diagnostic #3999 remains
+excluded. No broker resource/source rules, stream restrictions, package/lock
+inputs, native dependencies or sandbox configuration change in this integration.
+
+## Frozen 020 native evidence
+
+The parent closed that QA session and released the GUI. Its partial outcome is:
+
+| Native case on 020 | Result |
+| --- | --- |
+| Default Allow cold Send and completion | Passed |
+| Stop, AI Deny, restore without automatic replay | Passed |
+| Themes in new views | Passed |
+| Ask visible dialog | Failed: no visible dialog, timeout, zero new model requests |
+| Ask acceptance/cancel and content-read matrix | Not run; remain pending |
+
+The input's independent source-only delta review is scoped clean. Its installed
+SDK/registered IPC test reproduces the old Settings-owned failure and passes with
+the correction using represented Electron objects. That is not native Ask
+success. No new native acceptance is claimed by this coding executor.
+
+Earlier terminal solo/split core passes with corrected fixtures, unreliable/
+unverified Focus and one QA Enter in A during a palette attempt remain historical
+evidence. There is no global zero-input or full terminal native-pass claim. The
+old Rfam run failed socket transport before connect resolved, without reaching
+authentication/SELECT; its cause and auth/TLS compatibility remain unverified.
+The next native priority is the new Ask path, not more old-baseline loops.
+
+## Checks and retained CI history
+
+| Local check | Result |
+| --- | --- |
+| Registered runtime | 696 tests: 695 passed, one native skip, zero failed/cancelled |
+| Contract/SDK/CLI | 91 passed |
+| Offline examples | Five passed, one Docker opt-in skip |
+| Mounted cold-start AI/permission/selected-summary/Host group | 21 passed |
+| Settings and security-surface visibility group | 37 passed |
+| Contract/capability/Codex generation and drift | Clean |
+| Lint | Zero errors, seven existing warnings |
+| Five sample archives | Validated; two builds each are identical and match frozen 020 |
+
+The exact integration production build, renderer inventory and final CI are
+recorded in the Draft PR and artifact provenance. Local native packaging and
+unpackaged GUI acceptance are not claimed. This environment uses locked
+dependencies and standard patches; the official pinned Electron binary uses its
+documented cache/proxy support. No header workaround, native shim, HOME change
+or sandbox change is introduced.
+
+Input89 [test CI 40453446775](https://github.com/binaricat/Netcatty/actions/runs/40453446775)
+succeeded on the parent's single infrastructure-only rerun: 15,342 passed, 50
+skipped, zero failed/cancelled. The original runner interruption remains evidence;
+this worker did not duplicate its retry. Input89
+[four-platform packages](https://github.com/binaricat/Netcatty/actions/runs/40453446781)
+passed with release jobs skipped. Frozen 020's successful full/platform CI and
+all earlier diagnosed/unexplained failures remain separate predecessor evidence.
+
+The [sample manifest](ask-routing-packages.json) records exact IDs, versions,
+features, permissions/resources and archive/content hashes. All five archives
+are byte-identical to 020, including Assistant
+`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.
+No archive was activated by this executor. Its unchanged owner README retains
+old review wording; the current Allow/Ask/Deny procedure governs acceptance.
+
+## Production-renderer preparation and native Ask recipe
+
+1. Create a new isolated checkout at this Draft's exact head and a separate
+   disposable synthetic QA profile. Keep the old 020 workspace/profile intact.
+2. Match `package.json` and `package-lock.json` hashes to the renderer artifact's
+   provenance and the independently normally rebuilt native dependencies. They
+   are unchanged from 020. Prepare matching host workspace packages normally.
+   **The complete backend checkout must match the new head:** the frontend-only
+   bundle does not include the new CJS window-routing code or native binaries.
+3. Materialize the exact private Library file/version in the consumer's own
+   environment. Verify its archive SHA-256 and every dist file with the supplied
+   inventory/verification script. Producer-local paths are not portable.
+4. Use those verified production assets as a whole `dist/` in the matching
+   checkout, with the ordinary Electron entrypoint, no Vite environment and
+   normal sandbox/helper settings. This is native **unpackaged production-
+   renderer QA**, not packaged-binary certification. Process-loss causality
+   remains unclassified; no native build/header workaround is supplied.
+5. Recreate only the synthetic provider/Note/sample setup. Verify Default Allow
+   remains functional; then set the plugin operation to Ask in the active main
+   or standalone Settings window. Keep the selected receiver visible, focused,
+   ready and unlocked; opening Ask must not force focus back to main.
+6. Record visible readable Ask and native-view yielding. Check cancellation and
+   acceptance as separate explicit operations: cancel must send no model request;
+   accept must authorize only the current bounded operation. Complete the
+   content-read Allow/Ask/Deny matrix and lifecycle invalidation cases. Do not
+   treat the earlier zero-request timeout as an Ask pass.
+7. Record exact head, archive/sample hashes, request counters, prompt ownership,
+   screenshots/video and any unrun cases. Report a model-selector failure
+   separately rather than folding its other owner's repair into this candidate.
+
+Hosting/distribution/deployment and remaining DB/terminal acceptance gates stay
+parent-coordinated. No main merge, Ready transition or release is part of this
+handoff.

docs/plugin-platform/ask-routing-packages.json

@@ -0,0 +1,197 @@
+[
+  {
+    "name": "assistant",
+    "id": "com.netcatty.assistant",
+    "version": "0.1.0",
+    "fileCount": 6,
+    "bytes": 17214,
+    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "contentSha256": "c3e31e9613422bf9a05ccaa5b6f234304208f1a8298b1c1ee19262ba88af6cd0",
+    "features": {
+      "required": [
+        "ai.model-invocation",
+        "context.selected-read"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        "ai.invoke",
+        "context.selected.list",
+        "context.selected.read"
+      ]
+    },
+    "package": "assistant.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395",
+    "changedEntriesFromFrozen677": [
+      "README.md",
+      "panel.css",
+      "panel.js"
+    ],
+    "previous7856Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom020": []
+  },
+  {
+    "name": "database-owned",
+    "id": "com.netcatty.database-minimal",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11660,
+    "sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "contentSha256": "4d628c41c7a231e31cd56dacb822acaaa37f61e1e98b285b0086a4f783be199d",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://10.77.0.20:3306"
+          ],
+          "reason": "Connect only to the prepared disposable fixture."
+        }
+      ]
+    },
+    "package": "database-owned.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom020": []
+  },
+  {
+    "name": "database-rfam-readonly",
+    "id": "com.netcatty.database-rfam-readonly",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11003,
+    "sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "contentSha256": "f542ca7b8e821d684cf7f71f0930458bd3ad97bc94bf654c88b0f353111e9162",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
+          ],
+          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
+        }
+      ]
+    },
+    "package": "database-rfam-readonly.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom020": []
+  },
+  {
+    "name": "host-actions",
+    "id": "com.netcatty.host-actions",
+    "version": "0.1.0",
+    "fileCount": 3,
+    "bytes": 4633,
+    "sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "contentSha256": "d6f8bf3ae9dc417ea838f673966f2e1075fc8f9ef1d939ca85b476b1bb007e6c",
+    "features": {
+      "required": [
+        "vault.host-actions",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "vault.metadata",
+        "vault.write",
+        "ui.interact"
+      ]
+    },
+    "package": "host-actions.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom020": []
+  },
+  {
+    "name": "terminal-selection-draft",
+    "id": "com.netcatty.terminal-selection-draft",
+    "version": "0.1.0",
+    "fileCount": 2,
+    "bytes": 2954,
+    "sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "contentSha256": "99797d8679f34b96580076f922cbec067e511adc0f4ccf396ed129206acb6c4c",
+    "features": {
+      "required": [
+        "terminal.selection-sharing",
+        "terminal.input-drafts",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "terminal.selection.read",
+        "terminal.input.propose"
+      ]
+    },
+    "package": "terminal-selection-draft.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom020": []
+  }
+]

docs/plugin-platform/assistant-native-qa.md

@@ -1,5 +1,10 @@
 # Test the selected Note assistant on an isolated desktop
 
+For the permission-policy/AI acceptance candidate, first use
+[its integration record](policy-ai-integration.md) and exact package manifest.
+The older permission-dialog sequence below is historical baseline evidence;
+apply the current Allow/Ask/Deny semantics when testing the new candidate.
+
 This recipe tests a sandbox plugin against a deterministic loopback provider.
 The provider does not run a model or contact a paid service. The profile contains
 only synthetic data. The parent owns native screenshots and video on the working
@@ -29,9 +34,9 @@ browser runtime entry. It has no Node entry, networking, filesystem, secrets,
 storage, terminal, or command-execution permission. Its `commands` permission
 registers its own view callbacks. It cannot execute terminal commands.
 The six-file artifact at this checkpoint has SHA-256
-`c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395`.
-This replaces the earlier `c0f73369...` artifact after the selected-Note expiry
-recovery repair.
+`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.
+This replaces the earlier `c7d784d5...` artifact with the sample-only appearance
+update. The host provider cold-start correction remains a separate app change.
 
 ## Start the deterministic fixture
 
@@ -119,6 +124,11 @@ Synthetic retry plan: add a retry button and show a connection status label.
     in the dropdown, and click Send yourself. Deny the fresh content permission
     once and cancel text review once before allowing a successful fixture run.
     The draft must survive all steps, and no request may be silently retried.
+14. With the sample idle, switch the host between light and dark and change its
+    accent. The page, controls, muted surfaces, text, focus ring, and Send button
+    must follow the existing view environment tokens without model requests or
+    new permission prompts. Capture both appearances on the same host window.
+    This check does not change or bypass the separately owned permission policy.
 
 The expiry regression in `scripts/plugin-assistant-panel.test.cjs` controls the
 panel and actual host service/selected-context authority clocks and advances past

docs/plugin-platform/author-identity.md

@@ -0,0 +1,58 @@
+# Plugin author presentation
+
+The marketplace displays the catalog's author next to a small avatar. Installed
+views reuse the author row. Missing, loading, unavailable, or invalid imagery
+uses a bundled placeholder. An avatar is presentation metadata, not proof of an
+authenticated GitHub publisher.
+
+The registry binds an image to its reviewed displayed-author subject. Repository
+ownership alone does not establish that subject. The current first-party author
+is the Netcatty project, not an assumed personal GitHub identity. Until an image
+pin is reviewed, its avatar remains null.
+
+## Avatar delivery
+
+Delivery v2 extends the reserved `avatar` field to null or
+`{path, sha256, size}`. The path is exactly `/assets/<sha256>.png` or `.webp`.
+Size is a positive integer no greater than 256KiB. The delivery digest and existing
+id/version/repository/commit tuple bind the reference. Catalog and index identity
+fields do not change. Source-only delivery v1 remains supported.
+
+Only the main process fetches the selected source's same-origin asset. Existing
+URL, credential, redirect, timeout, byte-count, and SHA-256 checks apply. The host
+rechecks the source and selection after asynchronous work. The existing isolated
+icon rasterizer validates and converts PNG or WebP to a bounded PNG data URI,
+using its current queue, pending-work map, and cache. No renderer URL, arbitrary
+file path, GitHub API, or GitHub avatar URL is accepted. Visible rows load lazily.
+
+Installed presentation uses already validated catalog metadata only when source,
+version, package digest, and manifest match the active installation. It does not
+fetch a catalog just because the installed list opens. Without an exact match,
+the declared publisher and placeholder remain visible, without a maintenance
+badge. No installed-data migration or persistent identity cache is added.
+
+## Official maintenance
+
+The borderless gold pill means that the Netcatty project maintains the plugin.
+It does not certify the plugin's safety or grant permissions. It is separate
+from the official marketplace source label.
+
+The main process requires the built-in official source and one of these explicit
+first-party ID and repository pairs:
+
+- `com.netcatty.starter`, `binaricat/Netcatty`
+- `com.netcatty.hello`, `binaricat/Netcatty`
+
+A local import, a third-party copy, an ID prefix, author text, manifest publisher,
+README, or membership in the official marketplace cannot create this badge.
+The renderer consumes the host result through the existing trusted-app IPC
+boundary. No new plugin permission or plugin RPC is introduced.
+
+## Validation scope
+
+Focused registered tests cover source spoofing, exact installed identity,
+hash-bound images, invalid metadata and decoding, redirects, source removal,
+selection changes, cache reuse, lazy loading, stale UI cleanup, placeholders,
+and borderless light/dark theme classes. These tests do not establish native
+layout, actual account identity, live CDN deployment, or successful network access.
+Actual app screenshots and native acceptance remain separately scheduled.

docs/plugin-platform/contract-and-sdk.md

@@ -450,6 +450,13 @@ new child to an opened parent directory without a path race.
 `readDirectory()` likewise keeps its stable SDK/RPC method but fails closed
 unless the main process supplies a native adapter whose inode checks and entry
 enumeration are bound to the same directory handle.
+The host advertises `filesystem.directory-enumeration` only when it supplies that
+adapter. Declare the feature as required, or optional and check
+`context.enabledFeatures.has(PLUGIN_FILESYSTEM_DIRECTORY_ENUMERATION_FEATURE)`.
+The default host supplies no adapter and does not enable this feature. Both the
+SDK and direct RPC return `unsupported` before a permission request or path probe.
+An enabled feature still requires the declared `filesystem.read` directory
+resource and the normal permission, root, symlink and same-handle checks.
 
 Permission names already use the phase-3 enforcement boundaries: clipboard
 read/write, terminal metadata/output/input and input/output interception, Vault