fix(settings): release MCP toggle before client discovery completes

Continuation of #3969 by @hexart (Joseph Hau). Preserves original commit recognition and adds spaces / %#→# coverage so idle macOS zsh terminals accept AI commands.

Codex CLEAN (gpt-6.1-terra) vs main. CI green. No release.

Co-authored-by: Joseph Hau <hexart@gmail.com>

application/app/AppView.tsx

@@ -27,6 +27,7 @@ import { AppHostTreeLayer } from './AppHostTreeLayer';
 import { AppHostEditorLayer } from './AppHostEditorLayer';
 import { AppPluginKeybindingHost } from './AppPluginKeybindingHost';
 import { PluginAIContextHost } from '../../components/plugins/PluginAIContextHost';
+import { PluginAgentHost } from '../../components/plugins/PluginAgentHost';
 import { shouldOpenHostEditOnWorkSurface } from './workTabSurface';
 import { useConnectionLogsStore } from '../state/connectionLogsStore';
 import {
@@ -858,6 +859,7 @@ function AppViewInner({ domains }: AppViewProps) {
           workspaces={workspaces}
         />
         <PluginAIContextHost sessions={sessions} workspaces={workspaces} />
+        <PluginAgentHost sessions={sessions} />
       </div>
 
       {/* Global "quick add / edit snippet" modal, triggered by the

application/i18n/locales/en/ai.ts

@@ -525,6 +525,8 @@ export const enAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Always',
   'ai.chat.slashStopDesc': 'Stop the current AI turn and cancel in-flight tools',
   'ai.chat.slashCompactDesc': 'Summarize earlier conversation context',
+  'ai.chat.slashRenameDesc': 'Rename the current chat (/rename <title>)',
+  'ai.chat.slashChatsDesc': 'List the chats visible to this panel',
   'ai.chat.reject': 'Reject',
   'ai.chat.toolLabel': 'Tool',
   'ai.chat.targetLabel': 'Target',
@@ -587,6 +589,28 @@ export const enAiMessages: Messages = {
   'ai.chat.recent': 'Recent',
   'ai.chat.viewAll': 'View All',
   'ai.chat.untitled': 'Untitled',
+  'ai.chat.renameChat': 'Rename chat',
+  'ai.chat.renameUsage': 'Usage: /rename <new title>',
+  'ai.chat.renameNoActive': 'No active chat to rename.',
+  'ai.chat.renameDone': 'Chat renamed to "{title}".',
+  'ai.chat.exportSessions': 'Export AI chats',
+  'ai.chat.importSessions': 'Import AI chats',
+  'ai.chat.exportDone': 'AI chats exported to {path}.',
+  'ai.chat.exportDoneNoPath': 'AI chats exported.',
+  'ai.chat.exportUnavailable': 'AI chat export is unavailable in this environment.',
+  'ai.chat.importDone': 'Imported {n} AI chat(s).',
+  'ai.chat.importNone': 'No AI chats found in the selected file.',
+  'ai.chat.chatsHeader': 'Chats visible in this panel:',
+  'ai.chat.chatsEmpty': 'No chats visible in this panel.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Terminal',
+  'ai.chat.chatsScopeGlobal': 'Global',
+  'ai.chat.chatsScopeDangling': 'Dissociated',
+  'ai.chat.slashRebindDesc': 'Rebind a disconnected chat to this panel (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Disconnected chats can be restored with /rebind <n>.',
+  'ai.chat.rebindUsage': 'Usage: /rebind <number from /chats>',
+  'ai.chat.rebindDone': 'Chat "{title}" rebound to this panel.',
+  'ai.chat.rebindUnavailable': 'No rebind target in this panel scope.',
   'ai.chat.justNow': 'Just now',
   'ai.chat.minutesAgo': '{n}m ago',
   'ai.chat.hoursAgo': '{n}h ago',
@@ -795,4 +819,27 @@ export const enAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Skip',
   'zmodem.overwrite.cancel': 'Cancel',
   'settings.shortcuts.resetToDefault': 'Reset to default',
+  "ai.toolSettings.immediate": "Changes take effect immediately. Closing this window does not undo them.",
+  "ai.toolSettings.privacyOn": "Text redaction enabled",
+  "ai.toolSettings.privacyOff": "Text redaction disabled",
+  "ai.toolSettings.ruleSummary": "{cidrs} additional IP ranges · {patterns} custom patterns",
+  "ai.toolSettings.configurePrivacy": "Configure privacy",
+  "ai.toolSettings.unsaved": "Unsaved changes",
+  "ai.toolSettings.viewSkills": "View CLI guidance",
+  "ai.toolSettings.viewPrompt": "View setup prompt",
+  "ai.toolSettings.behavior": "MCP behavior",
+  "ai.toolSettings.configureBehavior": "Configure behavior",
+  "ai.toolSettings.configureClients": "Configure clients",
+  "ai.toolSettings.httpOn": "HTTP enabled",
+  "ai.toolSettings.httpOff": "HTTP disabled",
+  "ai.toolSettings.loopback": "Local connections only (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Configure HTTP",
+  "ai.toolSettings.hideSecret": "Hide secret",
+  "ai.toolSettings.showSecret": "Show secret",
+  "ai.toolSettings.manualSetup": "Manual setup",
+  "ai.toolSettings.format": "Format",
+  "ai.toolSettings.connectionDetails": "Connection details",
+  "ai.toolSettings.conflict": "Settings changed in another window. Your draft is preserved. Cancel and reopen to load the saved settings.",
+  "ai.toolSettings.retry": "Retry",
+  "ai.toolSettings.applyingHttp": "Applying HTTP configuration...",
 };

application/i18n/locales/en/core.ts

@@ -582,6 +582,8 @@ Highlight the focused split pane:
   'settings.appearance.uiFont.desc': 'Choose the font for the application interface',
   'settings.appearance.windowOpacity': 'Window Opacity',
   'settings.appearance.windowOpacity.desc': 'Adjust the transparency of the entire application window. Lower values also fade terminal text. Some Linux desktop environments may not support this.',
+  'settings.appearance.windowBackgroundBlur': 'Frosted glass background',
+  'settings.appearance.windowBackgroundBlur.desc': 'Blur the desktop behind the window. At 100% opacity the effect is hidden, but your choice is preserved.',
   'settings.appearance.appIcon': 'App Icon',
   'settings.appearance.appIcon.desc': 'Choose a dock/taskbar icon style to make Netcatty easier to spot when switching apps. On Windows, the notification area icon uses the same style. Applies at runtime; the installed app bundle icon is unchanged.',
   'settings.appearance.appIcon.original': 'Original',
@@ -1262,6 +1264,8 @@ Highlight the focused split pane:
   'deepLink.jms.unsupported': 'Unsupported JumpServer protocol: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
   "settings.plugins.manager.installed": "Installed plugins",
+  "settings.plugins.author.official": "Official maintainer",
+  "settings.plugins.author.officialMeaning": "Maintained by the Netcatty project. This is not a safety certification.",
   "settings.plugins.manager.import": "Import .ncpkg",
   "settings.plugins.manager.preview": "Imported packages stay disabled until you review and enable them.",
   "settings.plugins.manager.empty": "Import a local plugin package to get started.",
@@ -1419,7 +1423,7 @@ Highlight the focused split pane:
   'plugins.authentication.responseFailedWithMessage': 'Could not send the authentication response: {message}. Try again or cancel the request.',
   'plugins.authentication.continue': 'Continue',
   'plugins.hostActions.select': 'Share selected host metadata',
-  'plugins.hostActions.selectionNote': 'Share saved labels, addresses, usernames, protocols, groups and tags with this plugin. Group selection includes only the hosts selected now. Connecting requires a separate confirmation.',
+  'plugins.hostActions.selectionNote': 'Only the selected hosts\' saved labels, addresses, usernames, protocols, groups and tags are shared. Group selection includes only the hosts selected now. Later edit or connection requests follow this plugin\'s permission settings.',
   'plugins.hostActions.create': 'Review host draft',
   'plugins.hostActions.edit': 'Review host changes',
   'plugins.hostActions.connect': 'Confirm connection',

application/i18n/locales/es/ai.ts

@@ -525,6 +525,8 @@ export const esAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Siempre',
   'ai.chat.slashStopDesc': 'Detener el turno actual de IA y cancelar las herramientas en curso',
   'ai.chat.slashCompactDesc': 'Resumir el contexto anterior de la conversación',
+  'ai.chat.slashRenameDesc': 'Renombrar el chat actual (/rename <título>)',
+  'ai.chat.slashChatsDesc': 'Listar los chats visibles en este panel',
   'ai.chat.reject': 'Rechazar',
   'ai.chat.toolLabel': 'Herramienta',
   'ai.chat.targetLabel': 'Destino',
@@ -587,6 +589,28 @@ export const esAiMessages: Messages = {
   'ai.chat.recent': 'Recientes',
   'ai.chat.viewAll': 'Ver todo',
   'ai.chat.untitled': 'Sin título',
+  'ai.chat.renameChat': 'Renombrar chat',
+  'ai.chat.renameUsage': 'Uso: /rename <nuevo título>',
+  'ai.chat.renameNoActive': 'No hay ningún chat activo para renombrar.',
+  'ai.chat.renameDone': 'Chat renombrado a «{title}».',
+  'ai.chat.exportSessions': 'Exportar chats de IA',
+  'ai.chat.importSessions': 'Importar chats de IA',
+  'ai.chat.exportDone': 'Chats de IA exportados a {path}.',
+  'ai.chat.exportDoneNoPath': 'Chats de IA exportados.',
+  'ai.chat.exportUnavailable': 'La exportación de chats de IA no está disponible en este entorno.',
+  'ai.chat.importDone': 'Se importaron {n} chat(s) de IA.',
+  'ai.chat.importNone': 'No se encontraron chats de IA en el archivo seleccionado.',
+  'ai.chat.chatsHeader': 'Chats visibles en este panel:',
+  'ai.chat.chatsEmpty': 'No hay chats visibles en este panel.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Terminal',
+  'ai.chat.chatsScopeGlobal': 'Global',
+  'ai.chat.chatsScopeDangling': 'Desasociado',
+  'ai.chat.slashRebindDesc': 'Reasociar un chat desconectado a este panel (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Los chats desconectados se pueden restaurar con /rebind <n>.',
+  'ai.chat.rebindUsage': 'Uso: /rebind <número de /chats>',
+  'ai.chat.rebindDone': 'Chat «{title}» reasociado a este panel.',
+  'ai.chat.rebindUnavailable': 'No hay destino de reasociación en el ámbito de este panel.',
   'ai.chat.justNow': 'Ahora mismo',
   'ai.chat.minutesAgo': 'hace {n} min',
   'ai.chat.hoursAgo': 'hace {n} h',
@@ -795,4 +819,27 @@ export const esAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Omitir',
   'zmodem.overwrite.cancel': 'Cancelar',
   'settings.shortcuts.resetToDefault': 'Restablecer al predeterminado',
+  "ai.toolSettings.immediate": "Los cambios se aplican inmediatamente. Cerrar esta ventana no los deshace.",
+  "ai.toolSettings.privacyOn": "Ocultación de texto activada",
+  "ai.toolSettings.privacyOff": "Ocultación de texto desactivada",
+  "ai.toolSettings.ruleSummary": "{cidrs} rangos IP adicionales · {patterns} patrones personalizados",
+  "ai.toolSettings.configurePrivacy": "Configurar privacidad",
+  "ai.toolSettings.unsaved": "Cambios sin guardar",
+  "ai.toolSettings.viewSkills": "Ver instrucciones de CLI",
+  "ai.toolSettings.viewPrompt": "Ver instrucciones de conexión",
+  "ai.toolSettings.behavior": "Comportamiento de MCP",
+  "ai.toolSettings.configureBehavior": "Configurar comportamiento",
+  "ai.toolSettings.configureClients": "Configurar clientes",
+  "ai.toolSettings.httpOn": "HTTP activado",
+  "ai.toolSettings.httpOff": "HTTP desactivado",
+  "ai.toolSettings.loopback": "Solo conexiones locales (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Configurar HTTP",
+  "ai.toolSettings.hideSecret": "Ocultar secreto",
+  "ai.toolSettings.showSecret": "Mostrar secreto",
+  "ai.toolSettings.manualSetup": "Configuración manual",
+  "ai.toolSettings.format": "Formato",
+  "ai.toolSettings.connectionDetails": "Detalles de conexión",
+  "ai.toolSettings.conflict": "La configuración cambió en otra ventana. Se conserva el borrador. Cancela y vuelve a abrir para cargar la configuración guardada.",
+  "ai.toolSettings.retry": "Reintentar",
+  "ai.toolSettings.applyingHttp": "Aplicando la configuración HTTP...",
 };

application/i18n/locales/es/core.ts

@@ -582,6 +582,8 @@ Resalta el panel dividido enfocado:
   'settings.appearance.uiFont.desc': 'Elige la fuente para la interfaz de la aplicación',
   'settings.appearance.windowOpacity': 'Opacidad de la ventana',
   'settings.appearance.windowOpacity.desc': 'Ajusta la transparencia de toda la ventana de la aplicación. Los valores más bajos también atenúan el texto de la terminal. Algunos entornos de escritorio de Linux pueden no admitir esto.',
+  'settings.appearance.windowBackgroundBlur': 'Fondo de cristal esmerilado',
+  'settings.appearance.windowBackgroundBlur.desc': 'Desenfoca el escritorio detrás de la ventana. Con una opacidad del 100 %, el efecto no es visible, pero se conserva tu elección.',
   'settings.appearance.appIcon': 'Ícono de la aplicación',
   'settings.appearance.appIcon.desc': 'Elige un estilo de ícono para el dock o la barra de tareas que haga más fácil distinguir Netcatty al cambiar de aplicación. En Windows, el icono del área de notificación usa el mismo estilo. Se aplica en tiempo de ejecución; el ícono del paquete instalado no cambia.',
   'settings.appearance.appIcon.original': 'Original',
@@ -1261,6 +1263,8 @@ Resalta el panel dividido enfocado:
   'deepLink.jms.invalid': 'Enlace JumpServer inválido',
   'deepLink.jms.unsupported': 'Protocolo JumpServer no compatible: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
+  "settings.plugins.author.official": "Mantenimiento oficial",
+  "settings.plugins.author.officialMeaning": "Mantenido por el proyecto Netcatty. No es una certificación de seguridad.",
   "settings.plugins.manager.installed": "Plugins instalados",
   "settings.plugins.manager.import": "Importar .ncpkg",
   "settings.plugins.manager.preview": "Los paquetes importados permanecen desactivados hasta que los revises y actives.",
@@ -1419,7 +1423,7 @@ Resalta el panel dividido enfocado:
   'plugins.authentication.responseFailedWithMessage': 'No se pudo enviar la respuesta de autenticación: {message}. Inténtalo de nuevo o cancela la solicitud.',
   'plugins.authentication.continue': 'Continuar',
   'plugins.hostActions.select': 'Compartir metadatos de los equipos seleccionados',
-  'plugins.hostActions.selectionNote': 'Comparte nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados con este complemento. Los grupos solo incluyen los equipos seleccionados ahora. Conectar requiere otra confirmación.',
+  'plugins.hostActions.selectionNote': 'Solo se comparten los nombres, direcciones, usuarios, protocolos, grupos y etiquetas guardados de los equipos seleccionados. Los grupos solo incluyen los equipos seleccionados ahora. Las solicitudes posteriores de edición o conexión siguen los permisos de este complemento.',
   'plugins.hostActions.create': 'Revisar borrador de equipo',
   'plugins.hostActions.edit': 'Revisar cambios del equipo',
   'plugins.hostActions.connect': 'Confirmar conexión',

application/i18n/locales/ru/ai.ts

@@ -464,6 +464,8 @@ export const ruAiMessages: Messages = {
   'ai.chat.alwaysAllow': 'Всегда разрешать',
   'ai.chat.slashStopDesc': 'Остановить текущий ход AI и отменить выполняющиеся инструменты',
   'ai.chat.slashCompactDesc': 'Сжать ранний контекст разговора',
+  'ai.chat.slashRenameDesc': 'Переименовать текущий чат (/rename <название>)',
+  'ai.chat.slashChatsDesc': 'Показать чаты, видимые в этой панели',
   'ai.chat.reject': 'Отклонить',
   'ai.chat.toolLabel': 'Инструмент',
   'ai.chat.targetLabel': 'Цель',
@@ -526,6 +528,28 @@ export const ruAiMessages: Messages = {
   'ai.chat.recent': 'Недавние',
   'ai.chat.viewAll': 'Показать всё',
   'ai.chat.untitled': 'Без названия',
+  'ai.chat.renameChat': 'Переименовать чат',
+  'ai.chat.renameUsage': 'Использование: /rename <новое название>',
+  'ai.chat.renameNoActive': 'Нет активного чата для переименования.',
+  'ai.chat.renameDone': 'Чат переименован в «{title}».',
+  'ai.chat.exportSessions': 'Экспортировать чаты ИИ',
+  'ai.chat.importSessions': 'Импортировать чаты ИИ',
+  'ai.chat.exportDone': 'Чаты ИИ экспортированы в {path}.',
+  'ai.chat.exportDoneNoPath': 'Чаты ИИ экспортированы.',
+  'ai.chat.exportUnavailable': 'Экспорт чатов ИИ недоступен в этой среде.',
+  'ai.chat.importDone': 'Импортировано чатов ИИ: {n}.',
+  'ai.chat.importNone': 'В выбранном файле не найдено чатов ИИ.',
+  'ai.chat.chatsHeader': 'Чаты, видимые в этой панели:',
+  'ai.chat.chatsEmpty': 'В этой панели нет видимых чатов.',
+  'ai.chat.chatsScopeWorkspace': 'Workspace',
+  'ai.chat.chatsScopeTerminal': 'Терминал',
+  'ai.chat.chatsScopeGlobal': 'Глобально',
+  'ai.chat.chatsScopeDangling': 'Связь потеряна',
+  'ai.chat.slashRebindDesc': 'Привязать потерянный чат к этой панели (/rebind <n>)',
+  'ai.chat.chatsRebindHint': 'Потерянные чаты можно восстановить командой /rebind <n>.',
+  'ai.chat.rebindUsage': 'Использование: /rebind <номер из /chats>',
+  'ai.chat.rebindDone': 'Чат «{title}» привязан к этой панели.',
+  'ai.chat.rebindUnavailable': 'В области этой панели нет цели для привязки.',
   'ai.chat.justNow': 'Только что',
   'ai.chat.minutesAgo': '{n}м назад',
   'ai.chat.hoursAgo': '{n}ч назад',
@@ -724,4 +748,27 @@ export const ruAiMessages: Messages = {
   'zmodem.overwrite.skip': 'Пропустить',
   'zmodem.overwrite.cancel': 'Отмена',
   'settings.shortcuts.resetToDefault': 'Сбросить по умолчанию',
+  "ai.toolSettings.immediate": "Изменения применяются сразу. Закрытие окна не отменяет их.",
+  "ai.toolSettings.privacyOn": "Скрытие текста включено",
+  "ai.toolSettings.privacyOff": "Скрытие текста выключено",
+  "ai.toolSettings.ruleSummary": "Дополнительные диапазоны IP: {cidrs} · Пользовательские шаблоны: {patterns}",
+  "ai.toolSettings.configurePrivacy": "Настроить приватность",
+  "ai.toolSettings.unsaved": "Есть несохранённые изменения",
+  "ai.toolSettings.viewSkills": "Инструкции CLI",
+  "ai.toolSettings.viewPrompt": "Инструкции подключения",
+  "ai.toolSettings.behavior": "Поведение MCP",
+  "ai.toolSettings.configureBehavior": "Настроить поведение",
+  "ai.toolSettings.configureClients": "Настроить клиенты",
+  "ai.toolSettings.httpOn": "HTTP включён",
+  "ai.toolSettings.httpOff": "HTTP выключен",
+  "ai.toolSettings.loopback": "Только локальные подключения (127.0.0.1)",
+  "ai.toolSettings.configureHttp": "Настроить HTTP",
+  "ai.toolSettings.hideSecret": "Скрыть секрет",
+  "ai.toolSettings.showSecret": "Показать секрет",
+  "ai.toolSettings.manualSetup": "Ручная настройка",
+  "ai.toolSettings.format": "Формат",
+  "ai.toolSettings.connectionDetails": "Параметры подключения",
+  "ai.toolSettings.conflict": "Настройки изменены в другом окне. Черновик сохранён. Отмените и откройте окно снова, чтобы загрузить сохранённые настройки.",
+  "ai.toolSettings.retry": "Повторить",
+  "ai.toolSettings.applyingHttp": "Применение настроек HTTP...",
 };

application/i18n/locales/ru/core.ts

@@ -525,6 +525,8 @@ export const ruCoreMessages: Messages = {
   'settings.appearance.uiFont.desc': 'Выберите шрифт для интерфейса приложения',
   'settings.appearance.windowOpacity': 'Прозрачность окна',
   'settings.appearance.windowOpacity.desc': 'Настройте прозрачность всего окна приложения. При низких значениях текст терминала тоже бледнеет. В некоторых средах Linux это может не поддерживаться.',
+  'settings.appearance.windowBackgroundBlur': 'Матовое стекло',
+  'settings.appearance.windowBackgroundBlur.desc': 'Размывает рабочий стол за окном. При непрозрачности 100 % эффект не виден, но ваш выбор сохраняется.',
   'settings.appearance.appIcon': 'Значок приложения',
   'settings.appearance.appIcon.desc': 'Выберите стиль значка для Dock/панели задач, чтобы Netcatty было проще найти при переключении приложений. В Windows значок области уведомлений использует тот же стиль. Применяется во время работы; значок установленного пакета не меняется.',
   'settings.appearance.appIcon.original': 'Оригинал',
@@ -1130,6 +1132,8 @@ export const ruCoreMessages: Messages = {
   'deepLink.jms.unsupported': 'Неподдерживаемый протокол JumpServer: {{protocol}}',
 
   'settings.tab.plugins': 'Плагины',
+  "settings.plugins.author.official": "Официальная поддержка",
+  "settings.plugins.author.officialMeaning": "Поддерживается проектом Netcatty. Это не сертификат безопасности.",
   "settings.plugins.manager.installed": "Установленные плагины",
   "settings.plugins.manager.import": "Импорт .ncpkg",
   "settings.plugins.manager.preview": "Импортированные пакеты отключены до проверки и включения.",
@@ -1284,7 +1288,7 @@ export const ruCoreMessages: Messages = {
   'plugins.authentication.responseFailedWithMessage': 'Не удалось отправить ответ аутентификации: {message}. Повторите попытку или отмените запрос.',
   'plugins.authentication.continue': 'Продолжить',
   'plugins.hostActions.select': 'Передать метаданные выбранных хостов',
-  'plugins.hostActions.selectionNote': 'Плагину будут переданы сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Подключение требует отдельного подтверждения.',
+  'plugins.hostActions.selectionNote': 'Передаются только метаданные выбранных хостов: сохранённые имена, адреса, пользователи, протоколы, группы и теги. Группа включает только выбранные сейчас хосты. Дальнейшие запросы изменения или подключения зависят от настроек разрешений плагина.',
   'plugins.hostActions.create': 'Проверить черновик хоста',
   'plugins.hostActions.edit': 'Проверить изменения хоста',
   'plugins.hostActions.connect': 'Подтвердить подключение',

application/i18n/locales/settingsLocales.test.ts

@@ -29,6 +29,16 @@ const ALL_SETTINGS_LOCALES = [
   ...LOCALIZED_SETTINGS_LOCALES,
 ];
 
+test("Host selection disclosure describes later permission-controlled actions without promising another confirmation", () => {
+  const permissionWords: Record<string, RegExp> = { en: /permission settings/i, es: /permisos/i, ru: /разрешени/u, 'zh-CN': /权限设置/u, 'zh-TW': /權限設定/u };
+  const oldPromise = /requires a separate confirmation|requiere otra confirmación|требует отдельного подтверждения|需要单独确认|需要另外確認/iu;
+  for (const locale of ALL_SETTINGS_LOCALES) {
+    const note = locale.messages['plugins.hostActions.selectionNote'];
+    assert.match(note, permissionWords[locale.name], locale.name);
+    assert.doesNotMatch(note, oldPromise, locale.name);
+  }
+});
+
 test("localized settings include names for every default shortcut", () => {
   for (const locale of ALL_SETTINGS_LOCALES) {
     const missing = DEFAULT_KEY_BINDINGS

application/i18n/locales/zh-CN/ai.ts

@@ -525,6 +525,8 @@ export const zhCNAiMessages: Messages = {
   'ai.chat.alwaysAllow': '始终',
   'ai.chat.slashStopDesc': '停止当前 AI 回合并取消进行中的工具',
   'ai.chat.slashCompactDesc': '压缩较早的会话上下文',
+  'ai.chat.slashRenameDesc': '重命名当前聊天（/rename <标题>）',
+  'ai.chat.slashChatsDesc': '列出此面板可见的聊天',
   'ai.chat.reject': '拒绝',
   'ai.chat.toolLabel': '工具',
   'ai.chat.targetLabel': '目标',
@@ -587,6 +589,28 @@ export const zhCNAiMessages: Messages = {
   'ai.chat.recent': '最近',
   'ai.chat.viewAll': '查看全部',
   'ai.chat.untitled': '无标题',
+  'ai.chat.renameChat': '重命名聊天',
+  'ai.chat.renameUsage': '用法：/rename <新标题>',
+  'ai.chat.renameNoActive': '当前没有可重命名的聊天。',
+  'ai.chat.renameDone': '聊天已重命名为「{title}」。',
+  'ai.chat.exportSessions': '导出 AI 会话',
+  'ai.chat.importSessions': '导入 AI 会话',
+  'ai.chat.exportDone': 'AI 会话已导出到 {path}。',
+  'ai.chat.exportDoneNoPath': 'AI 会话已导出。',
+  'ai.chat.exportUnavailable': '当前环境不支持导出 AI 会话。',
+  'ai.chat.importDone': '已导入 {n} 个 AI 会话。',
+  'ai.chat.importNone': '所选文件中没有可导入的 AI 会话。',
+  'ai.chat.chatsHeader': '此面板可见的聊天：',
+  'ai.chat.chatsEmpty': '此面板没有可见的聊天。',
+  'ai.chat.chatsScopeWorkspace': '工作区',
+  'ai.chat.chatsScopeTerminal': '终端',
+  'ai.chat.chatsScopeGlobal': '全局',
+  'ai.chat.chatsScopeDangling': '已断开关联',
+  'ai.chat.slashRebindDesc': '将断联的聊天重绑到此面板（/rebind <序号>）',
+  'ai.chat.chatsRebindHint': '断联的聊天可用 /rebind <序号> 恢复。',
+  'ai.chat.rebindUsage': '用法：/rebind <序号>',
+  'ai.chat.rebindDone': '聊天“{title}”已重绑到此面板。',
+  'ai.chat.rebindUnavailable': '当前面板范围内没有可用的重绑目标。',
   'ai.chat.justNow': '刚刚',
   'ai.chat.minutesAgo': '{n}分钟前',
   'ai.chat.hoursAgo': '{n}小时前',
@@ -795,4 +819,27 @@ export const zhCNAiMessages: Messages = {
   'zmodem.overwrite.skip': '跳过',
   'zmodem.overwrite.cancel': '取消',
   'settings.shortcuts.resetToDefault': '重置为默认',
+  "ai.toolSettings.immediate": "更改立即生效，关闭此窗口不会撤销。",
+  "ai.toolSettings.privacyOn": "已启用文本脱敏",
+  "ai.toolSettings.privacyOff": "未启用文本脱敏",
+  "ai.toolSettings.ruleSummary": "{cidrs} 个附加 IP 范围 · {patterns} 条自定义规则",
+  "ai.toolSettings.configurePrivacy": "配置隐私",
+  "ai.toolSettings.unsaved": "有未保存的更改",
+  "ai.toolSettings.viewSkills": "查看 CLI 指引",
+  "ai.toolSettings.viewPrompt": "查看接入提示词",
+  "ai.toolSettings.behavior": "MCP 行为",
+  "ai.toolSettings.configureBehavior": "配置行为",
+  "ai.toolSettings.configureClients": "配置客户端",
+  "ai.toolSettings.httpOn": "HTTP 已启用",
+  "ai.toolSettings.httpOff": "HTTP 未启用",
+  "ai.toolSettings.loopback": "仅本地连接（127.0.0.1）",
+  "ai.toolSettings.configureHttp": "配置 HTTP",
+  "ai.toolSettings.hideSecret": "隐藏密钥",
+  "ai.toolSettings.showSecret": "显示密钥",
+  "ai.toolSettings.manualSetup": "手动配置",
+  "ai.toolSettings.format": "格式",
+  "ai.toolSettings.connectionDetails": "连接详情",
+  "ai.toolSettings.conflict": "设置已在另一窗口更改，当前草稿已保留。请取消并重新打开以加载已保存的设置。",
+  "ai.toolSettings.retry": "重试",
+  "ai.toolSettings.applyingHttp": "正在应用 HTTP 配置…",
 };

application/i18n/locales/zh-CN/core.ts

@@ -586,6 +586,8 @@ Vaults 标签保持扁平，不使用这块背景。
   'settings.appearance.uiFont.desc': '选择软件界面使用的字体',
   'settings.appearance.windowOpacity': '窗口透明度',
   'settings.appearance.windowOpacity.desc': '调节整个应用窗口的透明度，方便叠在其他内容上方。较低时终端文字也会变淡；部分 Linux 桌面环境可能不支持。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊窗口后方的桌面。100% 不透明时效果不可见，但会保留你的开关设置。',
   'settings.appearance.appIcon': '应用图标',
   'settings.appearance.appIcon.desc': '选择 Dock/任务栏图标风格，切换应用时更容易找到 Netcatty。Windows 通知区域图标会使用同一套风格。运行时生效，安装包内的图标不会改变。',
   'settings.appearance.appIcon.original': '原始',
@@ -1177,6 +1179,8 @@ Vaults 标签保持扁平，不使用这块背景。
   'qs.default': '默认',
   'settings.tab.plugins': '插件',
   "settings.plugins.manager.installed": "已安装插件",
+  "settings.plugins.author.official": "官方维护",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 项目维护。这不是安全认证。",
   "settings.plugins.manager.import": "导入 .ncpkg",
   "settings.plugins.manager.preview": "导入的插件保持停用，请检查后再启用。",
   "settings.plugins.manager.empty": "导入本地插件包以开始使用。",
@@ -1334,7 +1338,7 @@ Vaults 标签保持扁平，不使用这块背景。
   'plugins.authentication.responseFailedWithMessage': '无法发送认证响应：{message}。请重试或取消此请求。',
   'plugins.authentication.continue': '继续',
   'plugins.hostActions.select': '分享所选主机的元数据',
-  'plugins.hostActions.selectionNote': '向此插件分享已保存的名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。连接主机需要单独确认。',
+  'plugins.hostActions.selectionNote': '仅向此插件共享所选主机的元数据：名称、地址、用户名、协议、分组和标签。选择分组仅包含本次选中的成员。后续编辑或连接请求遵循此插件的权限设置。',
   'plugins.hostActions.create': '预览主机草稿',
   'plugins.hostActions.edit': '预览主机修改',
   'plugins.hostActions.connect': '确认连接',

application/i18n/locales/zh-TW/ai.ts

@@ -515,6 +515,8 @@ export const zhTWAiMessages: Messages = {
   'ai.chat.alwaysAllow': '始終',
   'ai.chat.slashStopDesc': '停止目前 AI 回合並取消進行中的工具',
   'ai.chat.slashCompactDesc': '壓縮較早的對話上下文',
+  'ai.chat.slashRenameDesc': '重新命名目前聊天（/rename <標題>）',
+  'ai.chat.slashChatsDesc': '列出此面板可見的聊天',
   'ai.chat.reject': '拒絕',
   'ai.chat.toolLabel': '工具',
   'ai.chat.targetLabel': '目標',
@@ -577,6 +579,28 @@ export const zhTWAiMessages: Messages = {
   'ai.chat.recent': '最近',
   'ai.chat.viewAll': '檢視全部',
   'ai.chat.untitled': '無標題',
+  'ai.chat.renameChat': '重新命名聊天',
+  'ai.chat.renameUsage': '用法：/rename <新標題>',
+  'ai.chat.renameNoActive': '目前沒有可重新命名的聊天。',
+  'ai.chat.renameDone': '聊天已重新命名為「{title}」。',
+  'ai.chat.exportSessions': '匯出 AI 會話',
+  'ai.chat.importSessions': '匯入 AI 會話',
+  'ai.chat.exportDone': 'AI 會話已匯出到 {path}。',
+  'ai.chat.exportDoneNoPath': 'AI 會話已匯出。',
+  'ai.chat.exportUnavailable': '目前環境不支援匯出 AI 會話。',
+  'ai.chat.importDone': '已匯入 {n} 個 AI 會話。',
+  'ai.chat.importNone': '所選檔案中沒有可匯入的 AI 會話。',
+  'ai.chat.chatsHeader': '此面板可見的聊天：',
+  'ai.chat.chatsEmpty': '此面板沒有可見的聊天。',
+  'ai.chat.chatsScopeWorkspace': '工作區',
+  'ai.chat.chatsScopeTerminal': '終端',
+  'ai.chat.chatsScopeGlobal': '全域',
+  'ai.chat.chatsScopeDangling': '已斷開關聯',
+  'ai.chat.slashRebindDesc': '將斷開關聯的聊天重新綁定到此面板（/rebind <序號>）',
+  'ai.chat.chatsRebindHint': '斷開關聯的聊天可用 /rebind <序號> 恢復。',
+  'ai.chat.rebindUsage': '用法：/rebind <序號>',
+  'ai.chat.rebindDone': '聊天「{title}」已重新綁定到此面板。',
+  'ai.chat.rebindUnavailable': '目前面板範圍內沒有可用的重新綁定目標。',
   'ai.chat.justNow': '剛剛',
   'ai.chat.minutesAgo': '{n}分鐘前',
   'ai.chat.hoursAgo': '{n}小時前',
@@ -785,4 +809,27 @@ export const zhTWAiMessages: Messages = {
   'zmodem.overwrite.skip': '跳過',
   'zmodem.overwrite.cancel': '取消',
   'settings.shortcuts.resetToDefault': '重設為預設值',
+  "ai.toolSettings.immediate": "變更立即生效，關閉此視窗不會復原。",
+  "ai.toolSettings.privacyOn": "已啟用文字遮蔽",
+  "ai.toolSettings.privacyOff": "未啟用文字遮蔽",
+  "ai.toolSettings.ruleSummary": "{cidrs} 個額外 IP 範圍 · {patterns} 條自訂規則",
+  "ai.toolSettings.configurePrivacy": "設定隱私",
+  "ai.toolSettings.unsaved": "有未儲存的變更",
+  "ai.toolSettings.viewSkills": "查看 CLI 指引",
+  "ai.toolSettings.viewPrompt": "查看接入提示詞",
+  "ai.toolSettings.behavior": "MCP 行為",
+  "ai.toolSettings.configureBehavior": "設定行為",
+  "ai.toolSettings.configureClients": "設定用戶端",
+  "ai.toolSettings.httpOn": "HTTP 已啟用",
+  "ai.toolSettings.httpOff": "HTTP 未啟用",
+  "ai.toolSettings.loopback": "僅本機連線（127.0.0.1）",
+  "ai.toolSettings.configureHttp": "設定 HTTP",
+  "ai.toolSettings.hideSecret": "隱藏金鑰",
+  "ai.toolSettings.showSecret": "顯示金鑰",
+  "ai.toolSettings.manualSetup": "手動設定",
+  "ai.toolSettings.format": "格式",
+  "ai.toolSettings.connectionDetails": "連線詳情",
+  "ai.toolSettings.conflict": "設定已在其他視窗變更，目前草稿已保留。請取消並重新開啟以載入已儲存的設定。",
+  "ai.toolSettings.retry": "重試",
+  "ai.toolSettings.applyingHttp": "正在套用 HTTP 設定…",
 };

application/i18n/locales/zh-TW/core.ts

@@ -588,6 +588,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'settings.appearance.uiFont.desc': '選擇軟體介面使用的字型',
   'settings.appearance.windowOpacity': '視窗透明度',
   'settings.appearance.windowOpacity.desc': '調節整個應用程式視窗的透明度，方便疊在其他內容上方。較低時終端文字也會變淡；部分 Linux 桌面環境可能不支援。',
+  'settings.appearance.windowBackgroundBlur': '毛玻璃背景',
+  'settings.appearance.windowBackgroundBlur.desc': '模糊視窗後方的桌面。100% 不透明時效果不可見，但會保留你的開關設定。',
   'settings.appearance.appIcon': '應用程式圖示',
   'settings.appearance.appIcon.desc': '選擇 Dock/工作列圖示風格，切換應用程式時更容易找到 Netcatty。Windows 通知區域圖示會使用同一套風格。執行時生效，安裝檔內的圖示不會改變。',
   'settings.appearance.appIcon.original': '原始',
@@ -1179,6 +1181,8 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'qs.default': '預設',
 
   'settings.tab.plugins': '外掛程式',
+  "settings.plugins.author.official": "官方維護",
+  "settings.plugins.author.officialMeaning": "由 Netcatty 專案維護。這不是安全認證。",
   "settings.plugins.manager.installed": "已安裝插件",
   "settings.plugins.manager.import": "導入 .ncpkg",
   "settings.plugins.manager.preview": "導入的插件保持停用，請檢查後再啟用。",
@@ -1337,7 +1341,7 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'plugins.authentication.responseFailedWithMessage': '無法送出驗證回應：{message}。請重試或取消此要求。',
   'plugins.authentication.continue': '繼續',
   'plugins.hostActions.select': '分享所選主機的中繼資料',
-  'plugins.hostActions.selectionNote': '向此外掛分享已儲存的名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。連線需要另外確認。',
+  'plugins.hostActions.selectionNote': '僅向此外掛分享所選主機的中繼資料：名稱、位址、使用者名稱、協定、群組和標籤。選擇群組僅包含本次選取的成員。後續編輯或連線請求遵循此外掛的權限設定。',
   'plugins.hostActions.create': '預覽主機草稿',
   'plugins.hostActions.edit': '預覽主機修改',
   'plugins.hostActions.connect': '確認連線',

application/state/aiScopeCleanup.test.ts

@@ -2,14 +2,9 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 import type {
-  AIPanelView,
   AISession,
 } from "../../infrastructure/ai/types.ts";
-import { createEmptyDraft } from "./aiDraftState.ts";
-import {
-  pruneInactiveScopedSessions,
-  pruneInactiveScopedTransientState,
-} from "./aiScopeCleanup.ts";
+import { pruneInactiveScopedSessions } from "./aiScopeCleanup.ts";
 
 function createSession(id: string, scope: AISession["scope"], externalSessionId?: string): AISession {
   return {
@@ -24,47 +19,6 @@ function createSession(id: string, scope: AISession["scope"], externalSessionId?
   };
 }
 
-test("pruneInactiveScopedTransientState removes closed workspace and terminal scope state", () => {
-  const activeSessionIdMap = {
-    "terminal:open-terminal": "session-open",
-    "terminal:closed-terminal": "session-closed-terminal",
-    "workspace:open-workspace": "session-open-workspace",
-    "workspace:closed-workspace": "session-closed-workspace",
-  };
-  const draftsByScope = {
-    "terminal:open-terminal": createEmptyDraft("catty"),
-    "terminal:closed-terminal": createEmptyDraft("catty"),
-    "workspace:open-workspace": createEmptyDraft("catty"),
-    "workspace:closed-workspace": createEmptyDraft("catty"),
-  };
-  const panelViewByScope = {
-    "terminal:open-terminal": { mode: "draft" },
-    "terminal:closed-terminal": { mode: "session", sessionId: "session-closed-terminal" },
-    "workspace:open-workspace": { mode: "draft" },
-    "workspace:closed-workspace": { mode: "session", sessionId: "session-closed-workspace" },
-  } satisfies Record<string, AIPanelView>;
-
-  const next = pruneInactiveScopedTransientState(
-    activeSessionIdMap,
-    draftsByScope,
-    panelViewByScope,
-    new Set(["open-terminal", "open-workspace"]),
-  );
-
-  assert.deepEqual(next.activeSessionIdMap, {
-    "terminal:open-terminal": "session-open",
-    "workspace:open-workspace": "session-open-workspace",
-  });
-  assert.deepEqual(next.draftsByScope, {
-    "terminal:open-terminal": draftsByScope["terminal:open-terminal"],
-    "workspace:open-workspace": draftsByScope["workspace:open-workspace"],
-  });
-  assert.deepEqual(next.panelViewByScope, {
-    "terminal:open-terminal": panelViewByScope["terminal:open-terminal"],
-    "workspace:open-workspace": panelViewByScope["workspace:open-workspace"],
-  });
-});
-
 test("pruneInactiveScopedSessions reports inactive targets without deleting persisted history", () => {
   const sessions = [
     createSession("terminal-restorable", {

application/state/aiScopeCleanup.ts

@@ -6,7 +6,6 @@ import type {
 
 type DraftsByScope = Partial<Record<string, AIDraft>>;
 type PanelViewByScope = Partial<Record<string, AIPanelView>>;
-type ActiveSessionIdMap = Record<string, string | null>;
 
 function isInactiveScopedTarget(
   scopeKey: string,
@@ -55,41 +54,6 @@ export function pruneInactiveScopedState(
   };
 }
 
-export function pruneInactiveScopedTransientState(
-  activeSessionIdMap: ActiveSessionIdMap,
-  draftsByScope: DraftsByScope,
-  panelViewByScope: PanelViewByScope,
-  activeTargetIds: Set<string>,
-): {
-  activeSessionIdMap: ActiveSessionIdMap;
-  draftsByScope: DraftsByScope;
-  panelViewByScope: PanelViewByScope;
-} {
-  let activeSessionMapChanged = false;
-  const nextActiveSessionIdMap: ActiveSessionIdMap = {};
-
-  for (const [scopeKey, sessionId] of Object.entries(activeSessionIdMap)) {
-    if (isInactiveScopedTarget(scopeKey, activeTargetIds)) {
-      activeSessionMapChanged = true;
-      continue;
-    }
-
-    nextActiveSessionIdMap[scopeKey] = sessionId;
-  }
-
-  const nextScopedState = pruneInactiveScopedState(
-    draftsByScope,
-    panelViewByScope,
-    activeTargetIds,
-  );
-
-  return {
-    activeSessionIdMap: activeSessionMapChanged ? nextActiveSessionIdMap : activeSessionIdMap,
-    draftsByScope: nextScopedState.draftsByScope,
-    panelViewByScope: nextScopedState.panelViewByScope,
-  };
-}
-
 export function pruneInactiveScopedSessions(
   sessions: AISession[],
   activeTargetIds: Set<string>,

application/state/aiSessionsBackup.test.ts

@@ -0,0 +1,147 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import type { AISession } from '../../infrastructure/ai/types';
+import {
+  DebouncedBackupMirror,
+  isMissingOrCorruptSessionsStore,
+  mergeImportedSessions,
+  parseBackupSessions,
+  readLiveSessionsArray,
+  shouldRestoreFromBackup,
+} from './aiSessionsBackup';
+import { prepareRestoredSessions, pruneSessionsForStorage } from './aiStateSnapshots';
+
+function makeSession(id: string, updatedAt = 1_000): AISession {
+  return {
+    id,
+    title: id,
+    agentId: 'catty',
+    scope: { type: 'workspace', targetId: 'ws-1' },
+    messages: [],
+    createdAt: updatedAt,
+    updatedAt,
+  } as never;
+}
+
+test('isMissingOrCorruptSessionsStore distinguishes missing or corrupt stores from valid arrays', () => {
+  assert.equal(isMissingOrCorruptSessionsStore(null), true);
+  assert.equal(isMissingOrCorruptSessionsStore(''), true);
+  assert.equal(isMissingOrCorruptSessionsStore('[]'), false);
+  assert.equal(isMissingOrCorruptSessionsStore('{corrupt'), true);
+  assert.equal(isMissingOrCorruptSessionsStore('{}'), true);
+  assert.equal(isMissingOrCorruptSessionsStore('[{"id":"s1"}]'), false);
+});
+
+test('readLiveSessionsArray normalizes missing and corrupt stores', () => {
+  for (const raw of [null, undefined, '', '{}', 'not-json']) {
+    assert.deepEqual(readLiveSessionsArray(raw), []);
+  }
+  const sessions = [makeSession('s1')];
+  assert.deepEqual(readLiveSessionsArray(JSON.stringify(sessions)), sessions);
+});
+
+test('parseBackupSessions ignores corrupt payloads and drops malformed entries', () => {
+  assert.equal(parseBackupSessions(null), null);
+  assert.equal(parseBackupSessions(''), null);
+  assert.equal(parseBackupSessions('not json'), null);
+  assert.equal(parseBackupSessions('{"id":"s1"}'), null);
+  assert.equal(parseBackupSessions(JSON.stringify([{ id: 's1' }])), null);
+  const sessions = parseBackupSessions(JSON.stringify([
+    { id: 's1' },
+    { nope: true },
+    { id: 'missing-scope', title: 'Missing scope', agentId: 'catty', messages: [], updatedAt: 1000 },
+    { ...makeSession('null-scope'), scope: null },
+    { ...makeSession('missing-title'), title: undefined },
+    { ...makeSession('missing-agent'), agentId: undefined },
+    { ...makeSession('null-message'), messages: [null] },
+    { ...makeSession('incomplete-message'), messages: [{ id: 'm' }] },
+    { ...makeSession('missing-content'), messages: [{ id: 'm', role: 'user', timestamp: 1000 }] },
+    { ...makeSession('invalid-content'), messages: [{ id: 'm', role: 'user', timestamp: 1000, content: null }] },
+    { ...makeSession('invalid-timestamp'), messages: [{ id: 'm', role: 'user', timestamp: null, content: 'hello' }] },
+    null,
+    { ...makeSession('s2'), messages: [{ id: 'm', role: 'user', timestamp: 1000, content: 'hello' }] },
+  ]));
+  assert.deepEqual(sessions?.map((session) => session.id), ['s2']);
+});
+
+test('restore preserves all sessions when cloud sync is enabled', () => {
+  const sessions = Array.from({ length: 51 }, (_, index) => makeSession(`s${index}`, index));
+  assert.deepEqual(prepareRestoredSessions(sessions, true), sessions);
+  const local = prepareRestoredSessions(sessions, false);
+  assert.equal(local.length, 50);
+  assert.equal(local.some(session => session.id === 's0'), false);
+});
+
+test('malformed imports cannot reach pruning or inject broken sessions', () => {
+  const current = [makeSession('live')];
+  const malformed = parseBackupSessions(JSON.stringify([{ id: 's1' }]));
+  assert.deepEqual(mergeImportedSessions(current, pruneSessionsForStorage(malformed ?? [])), current);
+  const valid = parseBackupSessions(JSON.stringify([{ id: 's1' }, makeSession('valid')]));
+  const merged = mergeImportedSessions(current, pruneSessionsForStorage(valid ?? []));
+  assert.deepEqual(new Set(merged.map((session) => session.id)), new Set(['live', 'valid']));
+});
+
+test('restore happens only on a missing or corrupt live store with a non-empty backup', () => {
+  const backup = JSON.stringify([makeSession('s1')]);
+  // Empty (or wiped) store -> restore.
+  assert.equal(shouldRestoreFromBackup(null, backup), true);
+  assert.equal(shouldRestoreFromBackup('', backup), true);
+  assert.equal(shouldRestoreFromBackup('[]', backup), false);
+  assert.equal(shouldRestoreFromBackup('{corrupt', backup), true);
+  // Non-empty live store -> never restore (explicit deletions must win).
+  assert.equal(shouldRestoreFromBackup('[{"id":"live"}]', backup), false);
+  // Empty/corrupt backup -> nothing to restore.
+  assert.equal(shouldRestoreFromBackup(null, null), false);
+  assert.equal(shouldRestoreFromBackup(null, '[]'), false);
+  assert.equal(shouldRestoreFromBackup(null, '{corrupt'), false);
+});
+
+test('mergeImportedSessions keys by id with the newer updatedAt winning', () => {
+  const current = [makeSession('keep', 100), makeSession('older', 100)];
+  const imported = [makeSession('newer', 200), makeSession('older', 50), makeSession('added', 1)];
+  const merged = mergeImportedSessions(current, imported);
+  const byId = new Map(merged.map((session) => [session.id, session]));
+  assert.equal(byId.get('older')?.updatedAt, 100);
+  assert.equal(byId.get('newer')?.updatedAt, 200);
+  assert.equal(byId.has('added'), true);
+  assert.equal(byId.has('keep'), true);
+  // Sorted newest-first for stable history ordering.
+  assert.deepEqual(
+    merged.map((session) => session.updatedAt),
+    [...merged.map((session) => session.updatedAt)].sort((a, b) => b - a),
+  );
+});
+
+test('DebouncedBackupMirror writes once per batch with the last payload', async () => {
+  const writes: string[] = [];
+  const mirror = new DebouncedBackupMirror((json) => writes.push(json), 15);
+  mirror.schedule('{"gen":1}');
+  mirror.schedule('{"gen":2}');
+  await new Promise((resolve) => setTimeout(resolve, 30));
+  mirror.schedule('{"gen":3}');
+  mirror.schedule('{"gen":4}');
+  await new Promise((resolve) => setTimeout(resolve, 40));
+  assert.deepEqual(writes, ['{"gen":2}', '{"gen":4}']);
+});
+
+test('DebouncedBackupMirror flushNow writes the pending payload immediately', () => {
+  const writes: string[] = [];
+  const mirror = new DebouncedBackupMirror((json) => writes.push(json), 60_000);
+  mirror.schedule('{"gen":1}');
+  mirror.flushNow();
+  assert.deepEqual(writes, ['{"gen":1}']);
+  // A second flush with nothing pending is a no-op.
+  mirror.flushNow();
+  assert.deepEqual(writes, ['{"gen":1}']);
+});
+
+test('readLiveSessionsArray treats non-array JSON as empty (corrupt)', () => {
+  assert.deepEqual(readLiveSessionsArray(null), []);
+  assert.deepEqual(readLiveSessionsArray(''), []);
+  assert.deepEqual(readLiveSessionsArray('{}'), []);
+  assert.deepEqual(readLiveSessionsArray('{"sessions":[]}'), []);
+  assert.deepEqual(readLiveSessionsArray('not-json'), []);
+  assert.deepEqual(readLiveSessionsArray('[]'), []);
+  assert.equal(readLiveSessionsArray('[{"id":"a"}]').length, 1);
+});

application/state/aiSessionsBackup.ts

@@ -0,0 +1,156 @@
+import type { AISession } from '../../infrastructure/ai/types';
+
+/**
+ * Renderer-side logic for the AI session durability layer (issue #4015 R2
+ * follow-up): a disk mirror of the localStorage session store plus a
+ * restore-on-empty-store boot path. The IPC plumbing lives in
+ * `electron/bridges/aiSessionsBackupBridge.cjs`; this module keeps the
+ * decisions pure so they can be tested without Electron.
+ */
+
+/** Debounce window: at most one backup write per mutation burst (~2s). */
+export const AI_SESSIONS_BACKUP_DEBOUNCE_MS = 2000;
+
+export interface AiSessionsBackupBridge {
+  aiSessionsBackupWrite?: (payload: { json: string }) => Promise<{ ok: boolean }>;
+  aiSessionsBackupReadLatest?: () => Promise<{ ok: boolean; json?: string }>;
+  aiSessionsBackupExport?: (payload: { json: string }) => Promise<{ success: boolean; filePath?: string }>;
+  aiSessionsBackupImport?: () => Promise<{ success: boolean; json?: string }>;
+}
+
+/** Restore only when the live store is missing or malformed. A valid empty
+ * array represents an intentional deletion and must remain authoritative. */
+export function isMissingOrCorruptSessionsStore(raw: string | null | undefined): boolean {
+  if (raw == null || raw === '') return true;
+  try {
+    return !Array.isArray(JSON.parse(raw));
+  } catch {
+    return true;
+  }
+}
+
+/** Read the live sessions array from a raw localStorage string. Returns [] when
+ * missing/corrupt (including parseable non-arrays such as `{}`), so callers never
+ * treat a non-array as AISession[]. */
+export function readLiveSessionsArray(raw: string | null | undefined): AISession[] {
+  if (isMissingOrCorruptSessionsStore(raw)) return [];
+  try {
+    const parsed = JSON.parse(raw as string);
+    return Array.isArray(parsed) ? parsed as AISession[] : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Parse a backup payload into sessions. Returns null when the payload is
+ * corrupt or malformed (ignored gracefully); also drops entries without a
+ * usable required fields. Backup generations are written by the same serializer as the
+ * live store, so entries are expected to be full AISession objects.
+ */
+
+export function parseBackupSessions(json: string | null | undefined): AISession[] | null {
+  if (typeof json !== 'string' || json === '') return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  const sessions = parsed.filter(
+    (entry): entry is AISession => (
+      typeof entry === 'object' && entry !== null
+      && typeof (entry as AISession).id === 'string'
+      && typeof (entry as AISession).title === 'string'
+      && typeof (entry as AISession).agentId === 'string'
+      && typeof (entry as AISession).scope === 'object'
+      && (entry as AISession).scope !== null
+      && typeof (entry as AISession).scope.type === 'string'
+      && Array.isArray((entry as AISession).messages)
+      && (entry as AISession).messages.every(message => (
+        typeof message === 'object' && message !== null
+        && typeof message.id === 'string'
+        && typeof message.role === 'string'
+        && typeof message.content === 'string'
+        && typeof message.timestamp === 'number'
+        && Number.isFinite(message.timestamp)
+      ))
+      && typeof (entry as AISession).updatedAt === 'number'
+      && Number.isFinite((entry as AISession).updatedAt)
+    ),
+  );
+  return sessions.length > 0 ? sessions : null;
+}
+
+/**
+ * Decide whether to restore on boot: only when the live store is missing or corrupt AND
+ * the backup actually contains at least one session.
+ */
+export function shouldRestoreFromBackup(
+  liveRaw: string | null | undefined,
+  backupJson: string | null | undefined,
+): boolean {
+  if (!isMissingOrCorruptSessionsStore(liveRaw)) return false;
+  const sessions = parseBackupSessions(backupJson);
+  return sessions != null && sessions.length > 0;
+}
+
+/**
+ * Merge an imported backup into the current store: entries are keyed by id
+ * and the newer `updatedAt` wins. Explicit user action, so it may overwrite
+ * the live store (unlike the boot restore, which is empty-only).
+ */
+export function mergeImportedSessions(current: AISession[], imported: AISession[]): AISession[] {
+  const byId = new Map<string, AISession>();
+  for (const session of current) byId.set(session.id, session);
+  for (const session of imported) {
+    const existing = byId.get(session.id);
+    if (!existing || (session.updatedAt ?? 0) >= (existing.updatedAt ?? 0)) {
+      byId.set(session.id, session);
+    }
+  }
+  return Array.from(byId.values()).sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+}
+
+/**
+ * Debounced mirror scheduler. One rolling timer per process: the last
+ * mutation batch wins, and the write happens `debounceMs` after the batch
+ * settles (at most once per batch, per the durability spec).
+ */
+export class DebouncedBackupMirror {
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private pendingJson: string | null = null;
+
+  constructor(
+    private readonly write: (json: string) => void,
+    private readonly debounceMs: number = AI_SESSIONS_BACKUP_DEBOUNCE_MS,
+  ) {}
+
+  schedule(json: string) {
+    this.pendingJson = json;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      const json = this.pendingJson;
+      this.pendingJson = null;
+      if (json != null) this.write(json);
+    }, this.debounceMs);
+  }
+
+  flushNow() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const json = this.pendingJson;
+    this.pendingJson = null;
+    if (json != null) this.write(json);
+  }
+
+  reset() {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    this.pendingJson = null;
+  }
+}

application/state/aiStateSnapshots.test.ts

@@ -16,6 +16,7 @@ import {
   latestAISessionsSnapshot,
   setLatestAIActiveSessionMapSnapshot,
   setLatestAISessionsSnapshot,
+  rebindActiveSessionMap,
 } from './aiStateSnapshots';
 
 test('orphan cleanup keeps durable Catty output while explicit deletion removes it', async () => {
@@ -90,7 +91,9 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   const previousWindow = globalThis.window;
   const previousSessions = latestAISessionsSnapshot;
   const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  t.mock.method(localStorageAdapter, 'read', () => null);
   t.mock.method(localStorageAdapter, 'write', () => true);
+  t.mock.method(localStorageAdapter, 'writeString', () => true);
   Object.defineProperty(globalThis, 'window', {
     configurable: true,
     value: {
@@ -122,8 +125,24 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   try {
     cleanupOrphanedAISessions(new Set(['open', 'resumed-into']));
 
-    assert.equal(latestAISessionsSnapshot, sessions);
+    // Issue #4015 R2: the dropped chat is marked dangling but its record and
+    // its active pointer stay intact so /chats can offer a rebind.
+    const persistedSessions = latestAISessionsSnapshot;
+    assert.ok(persistedSessions);
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-orphan')?.scopeDangling,
+      true,
+    );
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-live')?.scopeDangling,
+      undefined,
+    );
+    assert.equal(
+      persistedSessions.find((session) => session.id === 'privacy-resumed')?.scopeDangling,
+      undefined,
+    );
     assert.deepEqual(latestAIActiveSessionMapSnapshot, {
+      'terminal:closed': 'privacy-orphan',
       'terminal:open': 'privacy-live',
       'terminal:resumed-into': 'privacy-resumed',
     });
@@ -158,6 +177,95 @@ test('orphan cleanup preserves resumable privacy maps until explicit chat deleti
   }
 });
 
+test('orphan cleanup marks dangling chats instead of stripping them, and clears the flag when the target returns', (t) => {
+  const previousSessions = latestAISessionsSnapshot;
+  const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  const read = t.mock.method(localStorageAdapter, 'read', () => null);
+  t.mock.method(localStorageAdapter, 'write', () => true);
+  const writeString = t.mock.method(localStorageAdapter, 'writeString', () => true);
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: { dispatchEvent: () => true, netcatty: {} },
+  });
+  const dangling = {
+    ...makeSession('dangling-chat', 1, []),
+    scope: { type: 'terminal' as const, targetId: 'closed-ws' },
+  };
+  const live = {
+    ...makeSession('live-chat', 2, []),
+    scope: { type: 'terminal' as const, targetId: 'open' },
+  };
+  setLatestAISessionsSnapshot([dangling, live]);
+  setLatestAIActiveSessionMapSnapshot({
+    'terminal:closed-ws': 'dangling-chat',
+    'terminal:open': 'live-chat',
+  });
+
+  try {
+    cleanupOrphanedAISessions(new Set(['open']));
+
+    let persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'dangling-chat')?.scopeDangling, true);
+    assert.equal(persisted.find((s) => s.id === 'live-chat')?.scopeDangling, undefined);
+    // The active pointer survives the dangling marking.
+    assert.deepEqual(latestAIActiveSessionMapSnapshot, {
+      'terminal:closed-ws': 'dangling-chat',
+      'terminal:open': 'live-chat',
+    });
+    assert.ok(writeString.mock.callCount() > 0);
+
+    // The scope target becomes live again → the dangling flag clears.
+    read.mock.mockImplementation(() => null);
+    cleanupOrphanedAISessions(new Set(['open', 'closed-ws']));
+    persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'dangling-chat')?.scopeDangling, undefined);
+  } finally {
+    setLatestAISessionsSnapshot(previousSessions ?? []);
+    setLatestAIActiveSessionMapSnapshot(previousActiveSessionMap ?? {});
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
+test('orphan cleanup with an empty live-target set marks all scoped chats dangling', (t) => {
+  const previousSessions = latestAISessionsSnapshot;
+  const previousActiveSessionMap = latestAIActiveSessionMapSnapshot;
+  t.mock.method(localStorageAdapter, 'read', () => null);
+  t.mock.method(localStorageAdapter, 'write', () => true);
+  t.mock.method(localStorageAdapter, 'writeString', () => true);
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: { dispatchEvent: () => true, netcatty: {} },
+  });
+  const orphan = {
+    ...makeSession('orphan-chat', 1, []),
+    scope: { type: 'terminal' as const, targetId: 'gone' },
+  };
+  setLatestAISessionsSnapshot([orphan]);
+  setLatestAIActiveSessionMapSnapshot({ 'terminal:gone': 'orphan-chat' });
+
+  try {
+    // Empty is a valid observed live set (nothing mounted), not "unknown".
+    cleanupOrphanedAISessions(new Set());
+    const persisted = latestAISessionsSnapshot;
+    assert.ok(persisted);
+    assert.equal(persisted.find((s) => s.id === 'orphan-chat')?.scopeDangling, true);
+  } finally {
+    setLatestAISessionsSnapshot(previousSessions ?? []);
+    setLatestAIActiveSessionMapSnapshot(previousActiveSessionMap ?? {});
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
 test('serializeSessionsForStorage strips oldest ciphertext before dropping visible sessions', async () => {
   const { serializeSessionsForStorage } = await import('./aiStateSnapshots');
   const ciphertext = 'gAAAA'.repeat(50000); // ~250 KB of ciphertext per message
@@ -817,3 +925,65 @@ for (const [budget, expectedCalls] of [[128 * 1024, 160], [0, 161]]) {
     assert.equal(result.sessions.length, budget === 0 ? 1 : 4);
   });
 }
+test('successful store writes schedule a throttled disk backup mirror', async (t) => {
+  const { writeSessionsForStorage, flushBackupMirror, __resetBackupMirrorForTests } =
+    await import('./aiStateSnapshots');
+  __resetBackupMirrorForTests();
+  const backupWrites: string[] = [];
+  const previousWindow = globalThis.window;
+  Object.defineProperty(globalThis, 'window', {
+    configurable: true,
+    value: {
+      netcatty: {
+        aiSessionsBackupWrite: async (payload: { json: string }) => {
+          backupWrites.push(payload.json);
+          return { ok: true };
+        },
+      },
+    },
+  });
+  const sessions = freezeHistory(makePersistenceHistory(3, 10));
+  const writeString = t.mock.method(localStorageAdapter, 'writeString', () => true);
+  t.mock.method(localStorageAdapter, 'read', () => null);
+  try {
+    assert.equal(writeSessionsForStorage(sessions), true);
+    // Throttled: nothing has been written to disk yet.
+    assert.equal(backupWrites.length, 0);
+    flushBackupMirror();
+    assert.equal(backupWrites.length, 1);
+    // The mirror carries exactly the JSON that landed in localStorage.
+    assert.equal(backupWrites[0], writeString.mock.calls[0].arguments[1]);
+    // Failed store writes never schedule a mirror.
+    writeString.mock.mockImplementation(() => false);
+    assert.equal(writeSessionsForStorage(sessions), false);
+    flushBackupMirror();
+    assert.equal(backupWrites.length, 1);
+  } finally {
+    __resetBackupMirrorForTests();
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: previousWindow,
+    });
+  }
+});
+
+test('rebindActiveSessionMap drops stale pointers and sets the new scope', () => {
+  const cleaned = rebindActiveSessionMap(
+    {
+      'terminal:old-ws': 'chat-1',
+      'terminal:other': 'chat-2',
+      'workspace:keep': 'chat-1',
+    },
+    'chat-1',
+    'terminal:new-ws',
+  );
+  assert.deepEqual(cleaned, {
+    'terminal:other': 'chat-2',
+    'terminal:new-ws': 'chat-1',
+  });
+  // Idempotent when already bound to the target scope with no other pointers.
+  assert.deepEqual(
+    rebindActiveSessionMap({ 'terminal:new-ws': 'chat-1' }, 'chat-1', 'terminal:new-ws'),
+    { 'terminal:new-ws': 'chat-1' },
+  );
+});

application/state/aiStateSnapshots.ts

@@ -20,10 +20,11 @@ import {
 } from './aiDraftState';
 import {
   pruneInactiveScopedSessions,
-  pruneInactiveScopedTransientState,
+  pruneInactiveScopedState,
 } from './aiScopeCleanup';
 import { emitAIStateChanged } from './aiStateEvents';
 import { getAgentRuntime } from '../../infrastructure/ai/harness/globalAgentRuntime';
+import { DebouncedBackupMirror, readLiveSessionsArray } from './aiSessionsBackup';
 
 /** Typed accessor for the Electron IPC bridge exposed on `window.netcatty`. */
 export interface AIBridge {
@@ -35,6 +36,11 @@ export interface AIBridge {
   aiMcpSetCommandBlocklist?: (blocklist: string[]) => Promise<unknown> | unknown;
   aiMcpSetCommandTimeout?: (timeout: number) => Promise<unknown> | unknown;
   aiMcpSetMaxIterations?: (maxIterations: number) => Promise<unknown> | unknown;
+  /** Durability mirror: write one timestamped backup generation to disk. */
+  aiSessionsBackupWrite?: (payload: { json: string }) => Promise<{ ok: boolean }>;
+  aiSessionsBackupReadLatest?: () => Promise<{ ok: boolean; json?: string }>;
+  aiSessionsBackupExport?: (payload: { json: string }) => Promise<{ success: boolean; filePath?: string }>;
+  aiSessionsBackupImport?: () => Promise<{ success: boolean; json?: string }>;
 }
 
 export function getAIBridge() {
@@ -82,10 +88,13 @@ function isScopeKeyActive(scopeKey: string, activeTargetIds: Set<string>) {
   return activeTargetIds.has(targetId);
 }
 
+/** Last live terminal/workspace target ids observed by orphan cleanup. */
+export let latestAIActiveTargetIdsSnapshot: Set<string> = new Set();
+
 export function cleanupOrphanedAISessions(activeTargetIds: Set<string>) {
+  latestAIActiveTargetIdsSnapshot = activeTargetIds;
   const currentSessions = latestAISessionsSnapshot
-    ?? localStorageAdapter.read<AISession[]>(STORAGE_KEY_AI_SESSIONS)
-    ?? [];
+    ?? readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS));
 
   // Sessions shown by a still-live scope must be protected from cleanup
   // even when their own `scope.targetId` points at a closed terminal —
@@ -111,65 +120,62 @@ export function cleanupOrphanedAISessions(activeTargetIds: Set<string>) {
     cleanupSdkAgentSessions(nextSessionCleanup.orphanedSessionIds);
   }
 
-  if (nextSessionCleanup.sessions !== currentSessions) {
-    setLatestAISessionsSnapshot(nextSessionCleanup.sessions);
-    writeSessionsForStorage(nextSessionCleanup.sessions);
+  // Issue #4015 R2: a dropped chat is recoverable now, so mark it dangling
+  // instead of stripping its record or pointer. `/chats` lists dangling chats
+  // with a rebind affordance; the flag clears when the chat is rebound or its
+  // scope target becomes live again.
+  const orphanedIds = new Set(nextSessionCleanup.orphanedSessionIds);
+  let sessionsMarked = false;
+  const markedSessions = currentSessions.map((session) => {
+    if (orphanedIds.has(session.id)) {
+      if (session.scopeDangling) return session;
+      sessionsMarked = true;
+      return { ...session, scopeDangling: true };
+    }
+    if (
+      session.scopeDangling
+      && (!session.scope.targetId || activeTargetIds.has(session.scope.targetId))
+    ) {
+      sessionsMarked = true;
+      const { scopeDangling: _cleared, ...rest } = session;
+      return rest as AISession;
+    }
+    return session;
+  });
+
+  if (sessionsMarked) {
+    setLatestAISessionsSnapshot(markedSessions);
+    writeSessionsForStorage(markedSessions);
     emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
   }
 
-  const activeSessionIdMap = preCleanupActiveSessionMap;
-  let activeSessionMapChanged = false;
-  const nextActiveSessionIdMap = { ...activeSessionIdMap };
-
-  for (const scopeKey of Object.keys(activeSessionIdMap)) {
-    if (isScopeKeyActive(scopeKey, activeTargetIds)) continue;
-    delete nextActiveSessionIdMap[scopeKey];
-    activeSessionMapChanged = true;
-  }
-
-  if (activeSessionMapChanged) {
-    setLatestAIActiveSessionMapSnapshot(nextActiveSessionIdMap);
-    localStorageAdapter.write(STORAGE_KEY_AI_ACTIVE_SESSION_MAP, nextActiveSessionIdMap);
-    emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
-  }
-
-  const currentActiveSessionIdMap = activeSessionMapChanged
-    ? nextActiveSessionIdMap
-    : activeSessionIdMap;
+  // Issue #4015 R2: keep active-pointer entries for scopes whose target
+  // closed. Clearing them used to make dangling chats invisible (rank 0) and
+  // unrecoverable from the UI; the pointer is rewritten on rebind instead.
   const currentDraftsByScope = latestAIDraftsByScopeSnapshot ?? {};
   const currentPanelViewByScope = latestAIPanelViewByScopeSnapshot ?? {};
-  const prunedScopedTransientState = pruneInactiveScopedTransientState(
-    currentActiveSessionIdMap,
+  const prunedScopedState = pruneInactiveScopedState(
     currentDraftsByScope,
     currentPanelViewByScope,
     activeTargetIds,
   );
 
-  if (prunedScopedTransientState.activeSessionIdMap !== currentActiveSessionIdMap) {
-    setLatestAIActiveSessionMapSnapshot(prunedScopedTransientState.activeSessionIdMap);
-    localStorageAdapter.write(
-      STORAGE_KEY_AI_ACTIVE_SESSION_MAP,
-      prunedScopedTransientState.activeSessionIdMap,
-    );
-    emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
-  }
-
-  if (prunedScopedTransientState.draftsByScope !== currentDraftsByScope) {
+  if (prunedScopedState.draftsByScope !== currentDraftsByScope) {
     for (const scopeKey of Object.keys(currentDraftsByScope)) {
-      if (scopeKey in prunedScopedTransientState.draftsByScope) continue;
+      if (scopeKey in prunedScopedState.draftsByScope) continue;
       bumpDraftMutationVersion(scopeKey);
       bumpDraftUploadGeneration(scopeKey);
     }
-    setLatestAIDraftsByScopeSnapshot(prunedScopedTransientState.draftsByScope);
+    setLatestAIDraftsByScopeSnapshot(prunedScopedState.draftsByScope);
     emitAIStateChanged(AI_STATE_CHANGED_DRAFTS_BY_SCOPE);
   }
 
-  if (prunedScopedTransientState.panelViewByScope !== currentPanelViewByScope) {
+  if (prunedScopedState.panelViewByScope !== currentPanelViewByScope) {
     for (const scopeKey of Object.keys(currentPanelViewByScope)) {
-      if (scopeKey in prunedScopedTransientState.panelViewByScope) continue;
+      if (scopeKey in prunedScopedState.panelViewByScope) continue;
       bumpDraftMutationVersion(scopeKey);
     }
-    setLatestAIPanelViewByScopeSnapshot(prunedScopedTransientState.panelViewByScope);
+    setLatestAIPanelViewByScopeSnapshot(prunedScopedState.panelViewByScope);
     emitAIStateChanged(AI_STATE_CHANGED_PANEL_VIEW_BY_SCOPE);
   }
 }
@@ -349,6 +355,10 @@ export function pruneSessionsForStorage(sessions: AISession[]): AISession[] {
   });
 }
 
+export function prepareRestoredSessions(sessions: AISession[], syncEnabled: boolean): AISession[] {
+  return syncEnabled ? sessions : pruneSessionsForStorage(sessions);
+}
+
 /**
  * Serialize sessions for localStorage under a byte budget, escalating pruning
  * as needed. Returns the JSON to persist plus the (possibly) further-pruned
@@ -486,11 +496,47 @@ export function serializeSessionsForStorage(
  * Returns true when the write succeeded; a false result means the payload
  * could not be persisted even after escalation (it stays memory-only).
  */
+
+// Durability mirror (issue #4015 follow-up): every successful store write
+// also schedules a debounced disk backup so a wiped/recreated profile does
+// not take the chat history with it. The exact JSON that landed in
+// localStorage is mirrored (already byte-budgeted), throttled to at most one
+// write per mutation batch.
+const backupMirror = new DebouncedBackupMirror((json) => {
+  try {
+    void getAIBridge()?.aiSessionsBackupWrite?.({ json })?.catch(() => {});
+  } catch {
+    // Backup failures must never break chat persistence.
+  }
+});
+
+export function flushBackupMirror() {
+  try {
+    backupMirror.flushNow();
+  } catch {
+    // Unload and persistence must remain fail-safe.
+  }
+}
+
+export function __resetBackupMirrorForTests() {
+  backupMirror.reset();
+}
+
+export function scheduleBackupMirror(json: string) {
+  try {
+    backupMirror.schedule(json);
+  } catch {
+    // ignore
+  }
+}
+
 export function writeSessionsForStorage(sessions: AISession[]): boolean {
   // Synced records are authoritative after restart: silently evicting a
   // session or turn here would turn local retention into cloud deletion.
   if (localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled) {
-    return localStorageAdapter.write(STORAGE_KEY_AI_SESSIONS, sessions);
+    const syncedOk = localStorageAdapter.write(STORAGE_KEY_AI_SESSIONS, sessions);
+    if (syncedOk) scheduleBackupMirror(JSON.stringify(sessions));
+    return syncedOk;
   }
   let previousLength = Number.POSITIVE_INFINITY;
   for (const configuredBudget of [MAX_SESSIONS_JSON_BYTES, ...RETRY_SESSIONS_JSON_BYTES]) {
@@ -505,7 +551,10 @@ export function writeSessionsForStorage(sessions: AISession[]): boolean {
     if (budget < 2) break;
     const candidate = serializeSessionsForStorage(sessions, budget);
     if (candidate.json.length >= previousLength) continue;
-    if (localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, candidate.json)) return true;
+    if (localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, candidate.json)) {
+      scheduleBackupMirror(candidate.json);
+      return true;
+    }
     previousLength = candidate.json.length;
   }
   // Last resort: attempt the smallest representation this serializer can
@@ -516,6 +565,7 @@ export function writeSessionsForStorage(sessions: AISession[]): boolean {
     minimalCandidate.json.length < previousLength
     && localStorageAdapter.writeString(STORAGE_KEY_AI_SESSIONS, minimalCandidate.json)
   ) {
+    scheduleBackupMirror(minimalCandidate.json);
     return true;
   }
   console.warn(
@@ -531,6 +581,28 @@ export let latestAIPanelViewByScopeSnapshot: PanelViewByScope | null = null;
 let latestAIDraftMutationVersionByScopeSnapshot: Record<string, number> = {};
 let latestAIDraftUploadGenerationByScopeSnapshot: Record<string, number> = {};
 
+
+/**
+ * Issue #4015 R2: rewrite the active-session map when rebinding a dangling
+ * chat. Drops every pointer that still names `sessionId` under a different
+ * scope key, then sets the new scope as active. Callers must persist and
+ * publish the returned map (do not rebuild from a stale snapshot).
+ */
+export function rebindActiveSessionMap(
+  activeSessionIdMap: Record<string, string | null>,
+  sessionId: string,
+  scopeKey: string,
+): Record<string, string | null> {
+  let next = activeSessionIdMap;
+  for (const [key, id] of Object.entries(activeSessionIdMap)) {
+    if (id !== sessionId || key === scopeKey) continue;
+    if (next === activeSessionIdMap) next = { ...activeSessionIdMap };
+    delete next[key];
+  }
+  if (next[scopeKey] === sessionId) return next;
+  return { ...next, [scopeKey]: sessionId };
+}
+
 export function setLatestAISessionsSnapshot(sessions: AISession[]) {
   latestAISessionsSnapshot = sessions;
 }

application/state/settingsIpcSync.ts

@@ -49,6 +49,7 @@ import {
   STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN,
   STORAGE_KEY_LOCAL_SHELL_SIDE_PANEL_AUTO_OPEN_TAB,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_HTTP_NETWORK_PROXY,
   STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
@@ -99,6 +100,7 @@ interface UseSettingsIpcSyncParams {
   setIsHotkeyRecordingState: Dispatch<SetStateAction<boolean>>;
   setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
   setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
   setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
   setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
   setAutoLaunchEnabled: Dispatch<SetStateAction<boolean>>;
@@ -148,6 +150,7 @@ export function useSettingsIpcSync({
   setIsHotkeyRecordingState,
   setGlobalHotkeyEnabled,
   setWindowOpacity,
+  setWindowBackgroundBlur,
   setAppIconVariant,
   setAutoUpdateEnabled,
   setAutoLaunchEnabled,
@@ -279,6 +282,9 @@ export function useSettingsIpcSync({
       if (key === STORAGE_KEY_WINDOW_OPACITY) {
         setWindowOpacity(value);
       }
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && typeof value === 'boolean') {
+        setWindowBackgroundBlur((prev) => (prev === value ? prev : value));
+      }
       if (key === STORAGE_KEY_APP_ICON_VARIANT) {
         const nextVariant = resolveAppIconVariant(value);
         setAppIconVariant((prev) => (prev === nextVariant ? prev : nextVariant));
@@ -371,6 +377,7 @@ export function useSettingsIpcSync({
     setFollowAppTerminalThemeState,
     setGlobalHotkeyEnabled,
     setWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setHotkeyScheme,
     setIsHotkeyRecordingState,

application/state/settingsStorageSync.ts

@@ -53,6 +53,7 @@ import {
   STORAGE_KEY_UI_LANGUAGE,
   STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
 } from '../../infrastructure/config/storageKeys';
 import { resolveAppIconVariant, type AppIconVariant } from '../../domain/appIconVariant';
@@ -116,6 +117,7 @@ interface UseSettingsStorageSyncParams {
   globalHotkeyEnabled: boolean;
   autoUpdateEnabled: boolean;
   windowOpacity: number;
+  windowBackgroundBlur: boolean;
   appIconVariant: AppIconVariant;
   setTheme: Dispatch<SetStateAction<'dark' | 'light' | 'system'>>;
   setLightUiThemeId: Dispatch<SetStateAction<string>>;
@@ -166,6 +168,7 @@ interface UseSettingsStorageSyncParams {
   setExplorerContextMenuEnabledState: (enabled: boolean) => void;
   setGlobalHotkeyEnabled: Dispatch<SetStateAction<boolean>>;
   setWindowOpacity: (raw: unknown) => void;
+  setWindowBackgroundBlur: Dispatch<SetStateAction<boolean>>;
   setAppIconVariant: Dispatch<SetStateAction<AppIconVariant>>;
   setAutoUpdateEnabled: Dispatch<SetStateAction<boolean>>;
   setWorkspaceFocusStyleState: Dispatch<SetStateAction<'dim' | 'border'>>;
@@ -184,7 +187,7 @@ export function useSettingsStorageSync({
   sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
   showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
   editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+  globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode, applyIncomingCustomAccent,
   setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
   setTerminalThemeId, setTerminalThemeDarkId, setTerminalThemeLightId,
@@ -193,7 +196,7 @@ export function useSettingsStorageSync({
   setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
   setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
   setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState, setJmsDeepLinkEnabledState, setExplorerContextMenuEnabledState,
-  setGlobalHotkeyEnabled, setWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+  setGlobalHotkeyEnabled, setWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
   setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
   applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
 }: UseSettingsStorageSyncParams) {
@@ -208,7 +211,7 @@ export function useSettingsStorageSync({
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   });
   settingsSnapshotRef.current = {
     theme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentVersion,
@@ -218,7 +221,7 @@ export function useSettingsStorageSync({
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
   };
 
   // Listen for storage changes from other windows (cross-window sync)
@@ -523,6 +526,12 @@ export function useSettingsStorageSync({
       if (e.key === STORAGE_KEY_WINDOW_OPACITY && e.newValue !== null) {
         setWindowOpacity(e.newValue);
       }
+      if (e.key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR && e.newValue !== null) {
+        const newValue = e.newValue === 'true';
+        if (newValue !== s.windowBackgroundBlur) {
+          setWindowBackgroundBlur(newValue);
+        }
+      }
       if (e.key === STORAGE_KEY_APP_ICON_VARIANT && e.newValue !== null) {
         const newValue = resolveAppIconVariant(e.newValue);
         if (newValue !== s.appIconVariant) {
@@ -566,6 +575,7 @@ export function useSettingsStorageSync({
     setGlobalHotkeyEnabled,
     setHostClickBehaviorState,
     setWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setHotkeyScheme,
     setLightUiThemeId,

application/state/systemSettingsEffects.ts

@@ -7,6 +7,7 @@ import {
   STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
   STORAGE_KEY_TOGGLE_WINDOW_HOTKEY,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_HTTP_NETWORK_PROXY,
 } from '../../infrastructure/config/storageKeys';
@@ -17,6 +18,8 @@ import {
 } from '../../domain/httpNetworkProxy';
 import { localStorageAdapter } from '../../infrastructure/persistence/localStorageAdapter';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { isMacPlatform } from '../../lib/utils';
+import { isWindowBackgroundBlurActive } from '../../domain/windowBackgroundBlur';
 import {
   parseWindowOpacityRecord,
   serializeWindowOpacityRecord,
@@ -47,6 +50,7 @@ interface UseSystemSettingsEffectsParams {
   autoLaunchEnabled: boolean;
   windowOpacityRecord: WindowOpacityRecord;
   windowOpacityMutationSourceRef: MutableRefObject<WindowOpacityMutationSource>;
+  windowBackgroundBlur: boolean;
   appIconVariant: AppIconVariant;
   autoUpdateEnabled: boolean;
   httpNetworkProxy: HttpNetworkProxySettings;
@@ -68,6 +72,7 @@ export function useSystemSettingsEffects({
   autoLaunchEnabled,
   windowOpacityRecord,
   windowOpacityMutationSourceRef,
+  windowBackgroundBlur,
   appIconVariant,
   autoUpdateEnabled,
   httpNetworkProxy,
@@ -300,6 +305,49 @@ export function useSystemSettingsEffects({
     persistMountedRef,
   ]);
 
+  // Window chrome also applies in detached sessions, independently of the
+  // OS-level effects disabled there (tray, global shortcuts, autolaunch, ...).
+  // Only the windows that own settings persistence drive the shared native
+  // state; detached/editor windows consume it (see applySharedWindowSetting).
+  useEffect(() => {
+    if (!enabled) return;
+    localStorageAdapter.writeBoolean(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+    if (!persistMountedRef.current) return;
+    notifySettingsChanged(STORAGE_KEY_WINDOW_BACKGROUND_BLUR, windowBackgroundBlur);
+  }, [
+    enabled,
+    windowBackgroundBlur,
+    notifySettingsChanged,
+    persistMountedRef,
+  ]);
+
+  const windowBackgroundBlurActive = isMacPlatform() && isWindowBackgroundBlurActive(
+    windowBackgroundBlur,
+    windowOpacityRecord.opacity,
+  );
+
+  // Applies in every app-content window, including detached sessions: the
+  // transparent backing only looks right when the renderer class matches the
+  // native vibrancy the main process put on that window.
+  useEffect(() => {
+    if (typeof document === 'undefined') return;
+    document.documentElement.classList.toggle('window-background-blur', windowBackgroundBlurActive);
+    document.documentElement.style.setProperty('--window-content-opacity', String(windowOpacityRecord.opacity));
+    return () => {
+      document.documentElement.classList.remove('window-background-blur');
+      document.documentElement.style.removeProperty('--window-content-opacity');
+    };
+  }, [windowBackgroundBlurActive, windowOpacityRecord.opacity]);
+
+  // setWindowBackgroundBlur is a main-process handler that retargets every
+  // app-content window, so a single owner must drive it.
+  useEffect(() => {
+    if (!enabled) return;
+    netcattyBridge.get()?.setWindowBackgroundBlur?.(windowBackgroundBlur).catch((err) => {
+      console.warn('[WindowBackgroundBlur] Failed to apply macOS vibrancy:', err);
+    });
+  }, [enabled, windowBackgroundBlur]);
+
   // Persist and sync app icon variant
   useEffect(() => {
     if (!enabled) return;

application/state/systemSettingsEffects.windowBlur.test.ts

@@ -0,0 +1,139 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { JSDOM } from 'jsdom';
+
+import { STORAGE_KEY_WINDOW_BACKGROUND_BLUR } from '../../infrastructure/config/storageKeys';
+import { DEFAULT_HTTP_NETWORK_PROXY } from '../../domain/httpNetworkProxy';
+import { useSystemSettingsEffects } from './systemSettingsEffects';
+
+type Harness = {
+  dom: JSDOM;
+  params: Parameters<typeof useSystemSettingsEffects>[0];
+  bridgeRequests: boolean[];
+  blurNotifications: unknown[];
+  restore: () => void;
+};
+
+function setUp(enabled: boolean, windowBackgroundBlur: boolean): Harness {
+  const dom = new JSDOM('<html><body><div id="root"></div></body></html>', { url: 'http://localhost' });
+  Object.defineProperty(dom.window.navigator, 'platform', { value: 'MacIntel' });
+  const previousGlobals = new Map<string, PropertyDescriptor | undefined>();
+  const replacements = {
+    window: dom.window,
+    document: dom.window.document,
+    navigator: dom.window.navigator,
+    localStorage: dom.window.localStorage,
+    IS_REACT_ACT_ENVIRONMENT: true,
+  };
+  for (const [key, value] of Object.entries(replacements)) {
+    previousGlobals.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { value, configurable: true });
+  }
+  const bridgeRequests: boolean[] = [];
+  const blurNotifications: unknown[] = [];
+  Object.assign(dom.window, {
+    netcatty: {
+      setWindowBackgroundBlur: async (value: boolean) => { bridgeRequests.push(value); },
+    },
+  });
+  const noop = () => {};
+  const params: Parameters<typeof useSystemSettingsEffects>[0] = {
+    enabled,
+    toggleWindowHotkey: '',
+    globalHotkeyEnabled: false,
+    closeToTray: false,
+    showTrayIcon: false,
+    autoLaunchEnabled: false,
+    windowOpacityRecord: { opacity: 0.7, preferredOpacity: 0.7, version: 1 },
+    windowOpacityMutationSourceRef: { current: 'local' },
+    windowBackgroundBlur,
+    appIconVariant: 'original',
+    autoUpdateEnabled: false,
+    httpNetworkProxy: DEFAULT_HTTP_NETWORK_PROXY,
+    persistMountedRef: { current: true },
+    setHotkeyRegistrationError: noop,
+    setAutoUpdateEnabled: noop,
+    setAppIconVariant: noop,
+    setAutoLaunchEnabled: noop,
+    setAutoLaunchSupported: noop,
+    notifySettingsChanged: (key, value) => {
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) blurNotifications.push(value);
+    },
+  };
+  return {
+    dom,
+    params,
+    bridgeRequests,
+    blurNotifications,
+    restore: () => {
+      for (const [key, descriptor] of previousGlobals) {
+        if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+        else Reflect.deleteProperty(globalThis, key);
+      }
+      dom.window.close();
+    },
+  };
+}
+
+const Probe = (props: Parameters<typeof useSystemSettingsEffects>[0]) => {
+  useSystemSettingsEffects(props);
+  return null;
+};
+
+test('opacity changes and remounts preserve the chosen blur preference', async () => {
+  const harness = setUp(true, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    const opaqueParams = { ...params, windowOpacityRecord: { ...params.windowOpacityRecord, opacity: 1, version: 2 } };
+    await act(async () => { renderer!.update(React.createElement(Probe, opaqueParams)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    assert.deepEqual(bridgeRequests, [true]);
+    assert.deepEqual(blurNotifications, [true]);
+    await act(async () => { renderer!.unmount(); });
+    await act(async () => { renderer = create(React.createElement(Probe, opaqueParams)); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'true');
+    await act(async () => { renderer!.update(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    await act(async () => { renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false })); });
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), 'false');
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.deepEqual(bridgeRequests, [true, true, false]);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});
+
+test('detached session windows only apply the blur class, never own the setting', async () => {
+  // Peer session windows run with enableSystemEffects off. They must still
+  // paint the transparent backing, but persistence, cross-window broadcast and
+  // the (all-windows) native vibrancy IPC stay with the settings owners.
+  const harness = setUp(false, true);
+  const { dom, params, bridgeRequests, blurNotifications, restore } = harness;
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe, params)); });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), true);
+    assert.equal(document.documentElement.style.getPropertyValue('--window-content-opacity'), '0.7');
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+
+    await act(async () => {
+      renderer!.update(React.createElement(Probe, { ...params, windowBackgroundBlur: false }));
+    });
+    assert.equal(document.documentElement.classList.contains('window-background-blur'), false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_WINDOW_BACKGROUND_BLUR), null);
+    assert.deepEqual(bridgeRequests, []);
+    assert.deepEqual(blurNotifications, []);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    restore();
+  }
+});

application/state/useAIState.ts

@@ -20,6 +20,7 @@ import {
   STORAGE_KEY_AI_AGENT_THINKING_MAP,
   STORAGE_KEY_AI_WEB_SEARCH,
   STORAGE_KEY_AI_QUICK_MESSAGES,
+  STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS,
 } from '../../infrastructure/config/storageKeys';
 import type { AIQuickMessage } from '../../infrastructure/ai/quickMessages';
 import { sanitizeQuickMessages } from '../../infrastructure/ai/quickMessages';
@@ -63,12 +64,17 @@ import {
   bumpDraftUploadGeneration,
   cleanupDeletedAIChatSessions,
   cleanupOrphanedAISessions,
+  latestAIActiveTargetIdsSnapshot,
   getAIBridge,
+  flushBackupMirror,
   getDraftUploadGeneration,
   latestAIActiveSessionMapSnapshot,
   latestAIDraftsByScopeSnapshot,
   latestAIPanelViewByScopeSnapshot,
   latestAISessionsSnapshot,
+  prepareRestoredSessions,
+  scheduleBackupMirror,
+  rebindActiveSessionMap,
   writeSessionsForStorage,
   setLatestAIActiveSessionMapSnapshot,
   setLatestAIDraftsByScopeSnapshot,
@@ -77,6 +83,12 @@ import {
   type DraftsByScope,
   type PanelViewByScope,
 } from './aiStateSnapshots';
+import {
+  isMissingOrCorruptSessionsStore,
+  mergeImportedSessions,
+  parseBackupSessions,
+  readLiveSessionsArray,
+} from './aiSessionsBackup';
 import { AI_STATE_CHANGED_EVENT, emitAIStateChanged } from './aiStateEvents';
 import {
   persistCommandBlocklistSetting,
@@ -168,9 +180,76 @@ export function useAIState() {
   // ── Sessions ──
   const [sessions, setSessionsRaw] = useState<AISession[]>(() =>
     latestAISessionsSnapshot
-      ?? localStorageAdapter.read<AISession[]>(STORAGE_KEY_AI_SESSIONS)
-      ?? []
+      ?? readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))
   );
+  // An explicit empty array is authoritative, even if the backup is stale.
+  // Only a missing or corrupt store can be restored from disk.
+  useEffect(() => {
+    window.addEventListener('beforeunload', flushBackupMirror);
+    return () => window.removeEventListener('beforeunload', flushBackupMirror);
+  }, []);
+  useEffect(() => {
+    const liveRaw = localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS);
+    if (!isMissingOrCorruptSessionsStore(liveRaw)) {
+      if (readLiveSessionsArray(liveRaw).length > 0 && liveRaw != null) scheduleBackupMirror(liveRaw);
+      return;
+    }
+    if (latestAISessionsSnapshot && latestAISessionsSnapshot.length > 0) return;
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupReadLatest) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const liveRaw = localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS);
+        if (!isMissingOrCorruptSessionsStore(liveRaw)) return;
+        const backup = await bridge.aiSessionsBackupReadLatest?.();
+        if (cancelled || !backup?.ok) return;
+        // Re-check after the async gap: a session may have been created
+        // while the backup was being read; never restore over live state.
+        // Cover both persisted storage and in-memory snapshot/React state —
+        // createSession updates the snapshot before the debounced disk write.
+        if (!isMissingOrCorruptSessionsStore(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))) {
+          return;
+        }
+        if ((latestAISessionsSnapshot?.length ?? 0) > 0) return;
+        const syncEnabled = !!localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled;
+        const restored = prepareRestoredSessions(parseBackupSessions(backup.json) ?? [], syncEnabled);
+        if (restored.length === 0) return;
+        // Apply restore synchronously (not inside a setState updater). A
+        // deferred updater would leave didRestore false and skip dangling
+        // marking even when the records later land in React state.
+        if ((latestAISessionsSnapshot?.length ?? 0) > 0) return;
+        if (sessionsRef.current.length > 0) return;
+        if (!isMissingOrCorruptSessionsStore(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS))) {
+          return;
+        }
+        setLatestAISessionsSnapshot(restored);
+        writeSessionsForStorage(restored);
+        emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
+        // Restore does not change live terminals/workspaces, so the orphan-
+        // cleanup effect will not run. Reuse the last known live target set
+        // (empty is valid: nothing live) so chats bound to missing scopes
+        // become dangling and /chats can offer /rebind.
+        cleanupOrphanedAISessions(latestAIActiveTargetIdsSnapshot);
+        const nextSessions = latestAISessionsSnapshot ?? restored;
+        sessionsRef.current = nextSessions;
+        setSessionsRaw(nextSessions);
+        setActiveSessionIdMapRaw(
+          latestAIActiveSessionMapSnapshot
+            ?? localStorageAdapter.read<Record<string, string | null>>(STORAGE_KEY_AI_ACTIVE_SESSION_MAP)
+            ?? {},
+        );
+        console.info(
+          `[AIState] Restored ${restored.length} AI session(s) from the disk backup.`,
+        );
+      } catch {
+        // Backup restore must never break startup.
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
   // Ref that always holds the latest sessions for use inside debounced callbacks
   const sessionsRef = useRef(sessions);
   useEffect(() => {
@@ -866,6 +945,101 @@ export function useAIState() {
     });
   }, [persistSessions]);
 
+  // Issue #4015 R2: rebind a dangling chat to the panel's current scope.
+  // Rewrites `scope`, clears the dangling marker and makes the chat the
+  // active session of its new scope so it shows in the scoped history again.
+  const rebindSessionScope = useCallback((
+    sessionId: string,
+    scope: { type: 'terminal' | 'workspace'; targetId: string; hostIds?: string[] },
+  ) => {
+    const scopeKey = `${scope.type}:${scope.targetId}`;
+    setSessionsRaw(prev => {
+      const next = prev.map(s => {
+        if (s.id !== sessionId) return s;
+        const { scopeDangling: _cleared, ...rest } = s;
+        // Replace scope entirely (including hostIds) so history matching follows
+        // the destination terminal/workspace rather than the chat's old host.
+        const nextScope: AISession['scope'] = {
+          type: scope.type,
+          targetId: scope.targetId,
+        };
+        if (scope.hostIds && scope.hostIds.length > 0) {
+          nextScope.hostIds = [...scope.hostIds];
+        }
+        return {
+          ...rest,
+          scope: nextScope,
+          updatedAt: Date.now(),
+        } as AISession;
+      });
+      setLatestAISessionsSnapshot(next);
+      persistSessions(next);
+      return next;
+    });
+    // Drop stale pointers that still reference this chat under its previous
+    // scope key, then restore the active pointer for the new scope.
+    // Compute + persist inside the updater so a deferred React setState still
+    // writes the cleaned map (outer capture would stay null and skip persist).
+    setActiveSessionIdMapRaw(prev => {
+      const next = rebindActiveSessionMap(prev, sessionId, scopeKey);
+      setLatestAIActiveSessionMapSnapshot(next);
+      localStorageAdapter.write(STORAGE_KEY_AI_ACTIVE_SESSION_MAP, next);
+      emitAIStateChanged(STORAGE_KEY_AI_ACTIVE_SESSION_MAP);
+      return next;
+    });
+    // Open the rebound chat in this panel; active-map alone loses to an
+    // explicit draft/session panelView that still points elsewhere.
+    setPanelViewByScope((prev) => setSessionView(prev, scopeKey, sessionId));
+  }, [persistSessions, setPanelViewByScope]);
+
+  // Manual durability escape hatch (issue #4015 follow-up): export the
+  // current store to a user-chosen JSON file, or import one back in.
+  // Import is an explicit action, so it may overwrite the live store.
+  const exportSessionsBackup = useCallback(async (): Promise<string | null> => {
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupExport) return null;
+    const result = await bridge.aiSessionsBackupExport({
+      json: JSON.stringify(sessionsRef.current),
+    });
+    return result?.success ? (result.filePath ?? '') : null;
+  }, []);
+
+  const importSessionsBackup = useCallback(async (): Promise<number> => {
+    const bridge = getAIBridge();
+    if (!bridge?.aiSessionsBackupImport) return 0;
+    const result = await bridge.aiSessionsBackupImport();
+    if (!result?.success || !result.json) return 0;
+    const imported = parseBackupSessions(result.json);
+    if (!imported || imported.length === 0) return 0;
+    // Merge synchronously against the live ref so orphan cleanup sees the
+    // imported chats even if React would defer a setState updater.
+    const syncEnabled = !!localStorageAdapter.read<{ enabled?: boolean }>(STORAGE_KEY_CLOUD_SYNC_AI_SESSIONS)?.enabled;
+    const next = prepareRestoredSessions(mergeImportedSessions(sessionsRef.current, imported), syncEnabled);
+    if (!writeSessionsForStorage(next)) return 0;
+    const persisted = readLiveSessionsArray(localStorageAdapter.readString(STORAGE_KEY_AI_SESSIONS));
+    const importedIds = new Set(imported.map(session => session.id));
+    sessionsRef.current = persisted;
+    setLatestAISessionsSnapshot(persisted);
+    setSessionsRaw(persisted);
+    emitAIStateChanged(STORAGE_KEY_AI_SESSIONS);
+    // Import does not change live terminals/workspaces, so the orphan-cleanup
+    // effect will not run. Reuse the last known live target set (empty is
+    // valid: nothing live) to mark chats bound to missing scopes as dangling
+    // so /chats can offer /rebind.
+    cleanupOrphanedAISessions(latestAIActiveTargetIdsSnapshot);
+    const nextSessions =
+      latestAISessionsSnapshot
+      ?? persisted;
+    sessionsRef.current = nextSessions;
+    setSessionsRaw(nextSessions);
+    setActiveSessionIdMapRaw(
+      latestAIActiveSessionMapSnapshot
+        ?? localStorageAdapter.read<Record<string, string | null>>(STORAGE_KEY_AI_ACTIVE_SESSION_MAP)
+        ?? {},
+    );
+    return persisted.filter(session => importedIds.has(session.id)).length;
+  }, []);
+
   const updateSessionExternalSessionId = useCallback((sessionId: string, externalSessionId: string | undefined) => {
     setSessionsRaw(prev => {
       const next = prev.map(s => (
@@ -1370,6 +1544,9 @@ export function useAIState() {
     deleteSession,
     deleteSessionsByTarget,
     updateSessionTitle,
+    rebindSessionScope,
+    exportSessionsBackup,
+    importSessionsBackup,
     updateSessionExternalSessionId,
     addMessageToSession,
     updateLastMessage,
@@ -1432,6 +1609,9 @@ export function useAIState() {
     deleteSession,
     deleteSessionsByTarget,
     updateSessionTitle,
+    rebindSessionScope,
+    exportSessionsBackup,
+    importSessionsBackup,
     updateSessionExternalSessionId,
     addMessageToSession,
     updateLastMessage,

application/state/usePluginAgentHost.ts

@@ -0,0 +1,93 @@
+import { useEffect, useRef, useState } from 'react';
+import type { TerminalSession } from '../../domain/models';
+import type { PluginAgentHostTerminal } from '@netcatty/plugin-contract';
+import { createTrustedPluginAgentRuntime } from '../../infrastructure/ai/pluginAgent/trustedAgentRuntime';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+import { getAppAppLockRuntime } from './appRuntimeBridge';
+import { LOCAL_STORAGE_ADAPTER_CHANGED_EVENT } from '../../infrastructure/persistence/localStorageAdapter';
+import { STORAGE_KEY_AI_PROVIDERS, STORAGE_KEY_AI_ACTIVE_PROVIDER, STORAGE_KEY_AI_ACTIVE_MODEL, STORAGE_KEY_AI_AGENT_MODEL_MAP,
+  STORAGE_KEY_AI_AGENT_PROVIDER_MAP, STORAGE_KEY_AI_EXTERNAL_AGENTS } from '../../infrastructure/config/storageKeys';
+
+type Choice = { items: PluginAgentHostTerminal[]; confirm: (ids: string[]) => void; cancel: () => void };
+
+// All inventory remains in trusted application UI. Only confirmed metadata is
+// passed to the main-owned worker bindings; focus never determines a target.
+export function usePluginAgentHost(sessions: TerminalSession[]) {
+  const latest = useRef(sessions); latest.current = sessions;
+  const [choice, setChoice] = useState<Choice | null>(null);
+  useEffect(() => {
+    const api = netcattyBridge.get();
+    if (!api?.onPluginAgentHostRequest || !api.setPluginAgentHostReady || !api.respondPluginAgentHost) return;
+    const bridge = { subscribe: api.onPluginAgentHostRequest.bind(api), ready: api.setPluginAgentHostReady.bind(api), respond: api.respondPluginAgentHost.bind(api) };
+    let mounted = true;
+    let chooser: { runtimeId: string; cancel: () => void } | null = null;
+    const requests = new Map<string, { runtimeId: string; controller: AbortController }>();
+    const runtime = createTrustedPluginAgentRuntime({
+      isActive: () => mounted && document.visibilityState === 'visible' && getAppAppLockRuntime()?.locked === false,
+      chooseTargets: (signal, runtimeId) => new Promise((resolve, reject) => {
+        if (chooser) { reject(Error('A target selection is already pending')); return; }
+        const items = latest.current.filter((item) => item.status === 'connected').map((item) => ({
+          sessionId: item.id, hostId: item.hostId, hostname: (item.hostname || '').slice(0, 253),
+          label: (item.customName || item.hostLabel || item.id).slice(0, 160),
+          ...(item.protocol ? { protocol: item.protocol } : {}), ...(item.username ? { username: item.username.slice(0, 160) } : {}), connected: true,
+        }));
+        const finish = (ids: string[] | null) => {
+          if (chooser?.cancel !== cancel) return;
+          chooser = null; signal.removeEventListener('abort', cancel); setChoice(null);
+          if (ids === null || signal.aborted || ids.length > 32 || new Set(ids).size !== ids.length) { reject(Error('Target selection cancelled')); return; }
+          const selected = ids.map((id) => items.find((item) => item.sessionId === id));
+          if (selected.some((item) => !item || !latest.current.some((session) => session.id === item.sessionId && session.status === 'connected'))) {
+            reject(Error('Selected terminal is no longer connected')); return;
+          }
+          resolve(selected as PluginAgentHostTerminal[]);
+        };
+        const cancel = () => finish(null);
+        chooser = { runtimeId, cancel }; signal.addEventListener('abort', cancel, { once: true });
+        setChoice({ items, confirm: finish, cancel });
+        if (signal.aborted) cancel();
+      }),
+    });
+    const unsubscribe = bridge.subscribe((request) => {
+      if (request.kind === 'request.cancel') {
+        const pending = requests.get(request.payload.requestId);
+        if (pending?.runtimeId === request.runtimeId) pending.controller.abort();
+        runtime.cancelRequest(request.payload.requestId, request.runtimeId); return;
+      }
+      if (request.kind === 'runtime.release') {
+        for (const item of requests.values()) if (item.runtimeId === request.runtimeId) item.controller.abort();
+        if (chooser?.runtimeId === request.runtimeId) chooser.cancel();
+        runtime.releaseRuntime(request.runtimeId); return;
+      }
+      if (request.kind === 'agent.close') { runtime.releaseChat(request.payload.chatSessionId, request.runtimeId); return; }
+      if (requests.has(request.requestId) || requests.size >= 64) return;
+      const controller = new AbortController(); requests.set(request.requestId, { runtimeId: request.runtimeId, controller });
+      void runtime.handle(request, controller.signal).then(
+        (result) => bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, result }).catch(() =>
+          bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, error: true })),
+        () => bridge.respond({ requestId: request.requestId, actionToken: request.actionToken, error: true }),
+      ).catch(() => {}).finally(() => requests.delete(request.requestId));
+    });
+    const pageHide = () => { runtime.shutdown(); for (const item of requests.values()) item.controller.abort(); };
+    const configurationKeys = new Set([STORAGE_KEY_AI_PROVIDERS, STORAGE_KEY_AI_ACTIVE_PROVIDER, STORAGE_KEY_AI_ACTIVE_MODEL,
+      STORAGE_KEY_AI_AGENT_MODEL_MAP, STORAGE_KEY_AI_AGENT_PROVIDER_MAP, STORAGE_KEY_AI_EXTERNAL_AGENTS]);
+    const configurationChanged = (event: Event) => {
+      const key = event.type === 'storage' ? (event as StorageEvent).key : (event as CustomEvent<{ key: string }>).detail?.key;
+      if (key === null || (key && configurationKeys.has(key))) {
+        runtime.invalidateConfiguration();
+        // Invalidate main-owned backend leases too, even with no event read in
+        // flight. Re-advertising availability does not renew existing handles.
+        void bridge.ready(false).then(() => { if (mounted) return bridge.ready(true); }).catch(() => {});
+      }
+    };
+    window.addEventListener('pagehide', pageHide);
+    window.addEventListener('storage', configurationChanged); window.addEventListener(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, configurationChanged);
+    void bridge.ready(true).catch(() => {});
+    return () => {
+      mounted = false; chooser?.cancel(); unsubscribe(); window.removeEventListener('pagehide', pageHide);
+      window.removeEventListener('storage', configurationChanged); window.removeEventListener(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, configurationChanged);
+      for (const item of requests.values()) item.controller.abort(); requests.clear(); runtime.shutdown();
+      void bridge.ready(false).catch(() => {});
+    };
+  }, []);
+  return { choice };
+}

application/state/usePluginAuthorIdentity.ts

@@ -0,0 +1,59 @@
+import { useEffect, useMemo, useState, useSyncExternalStore } from 'react';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+// All visible rows share one IPC subscription. No catalog fetch or polling here.
+const generations = new Map<string, number>();
+const listeners = new Set<() => void>();
+let unsubscribe: (() => void) | undefined;
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  if (listeners.size === 1) unsubscribe = netcattyBridge.get()?.onPluginCatalogChanged?.(({ sourceId }) => {
+    generations.set(sourceId, (generations.get(sourceId) ?? 0) + 1);
+    for (const notify of listeners) notify();
+  });
+  return () => {
+    listeners.delete(listener);
+    if (!listeners.size) { unsubscribe?.(); unsubscribe = undefined; generations.clear(); }
+  };
+}
+
+export function usePluginAuthorIdentity({ entry, plugin, sourceId = 'official' }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const [element, setElement] = useState<HTMLElement | null>(null);
+  const [loaded, setLoaded] = useState<{ key: string; value: NetcattyPluginAuthorPresentation } | null>(null);
+  const pluginId = plugin?.id;
+  const entryId = entry?.id;
+  const selectionToken = entry?.selectionToken;
+  const request = useMemo<NetcattyPluginAuthorRequest | null>(() => pluginId
+    ? { kind: 'installed', pluginId }
+    : entryId && selectionToken ? { kind: 'catalog', pluginId: entryId, selectionToken, sourceId } : null,
+  [pluginId, entryId, selectionToken, sourceId]);
+  const identitySource = plugin?.source?.id ?? sourceId;
+  const generation = useSyncExternalStore(subscribe, () => generations.get(identitySource) ?? 0, () => 0);
+  const key = JSON.stringify([request, plugin?.activeVersion, plugin?.archiveSha256, plugin?.source?.id, plugin?.runtime?.quarantinedAt, generation]);
+  const installed = Boolean(plugin);
+  const version = plugin?.activeVersion;
+  const archiveSha256 = plugin?.archiveSha256 ?? null;
+  const installedSourceId = plugin?.source?.id ?? 'local';
+  useEffect(() => {
+    if (!element || !request) return;
+    let active = true;
+    let started = false;
+    const load = () => {
+      if (started) return;
+      started = true;
+      void netcattyBridge.get()?.getPluginAuthorPresentation?.(request).then((value) => {
+        if (!active || !value) return;
+        if (installed && (value.version !== version || value.archiveSha256 !== archiveSha256 || value.sourceId !== installedSourceId)) return;
+        setLoaded({ key, value });
+      }).catch(() => { /* The visible author placeholder remains usable offline. */ });
+    };
+    const observer = typeof IntersectionObserver === 'undefined' ? null : new IntersectionObserver((entries) => {
+      if (entries.some((entry) => entry.isIntersecting)) { load(); observer?.disconnect(); }
+    }, { rootMargin: '64px' });
+    if (observer) observer.observe(element); else load();
+    return () => { active = false; observer?.disconnect(); };
+  }, [element, request, key, installed, version, archiveSha256, installedSourceId]);
+  return { ref: setElement, identity: loaded?.key === key ? loaded.value : null };
+}

application/state/useSessionState.ts

@@ -24,6 +24,7 @@ reorderWorkspaceFocusSessionOrder,
 SplitDirection,
 SplitHint,
 updateWorkspaceSplitSizes,
+  invertSplitPosition,
 } from '../../domain/workspace';
 import { clearSessionFontSizeOverride as clearSessionFontSizeOverrideFields } from '../../domain/terminalAppearance';
 import {
@@ -795,12 +796,68 @@ export const useSessionState = ({
     return workspace.id;
   }, [setActiveTabId]);
 
+  const addSessionToWorkspace = useCallback((
+    workspaceId: string,
+    sessionId: string,
+    hint: SplitHint
+  ) => {
+    if (!hint) return;
+    
+	    setSessions(prevSessions => {
+      const session = prevSessions.find(s => s.id === sessionId);
+      if (!session || session.workspaceId) return prevSessions;
+      
+      setWorkspaces(prevWorkspaces => {
+        const targetWorkspace = prevWorkspaces.find(w => w.id === workspaceId);
+        if (!targetWorkspace) return prevWorkspaces;
+        
+        return insertWorkspacePaneIfMissing(prevWorkspaces, workspaceId, sessionId, hint);
+      });
+      
+      setActiveTabId(workspaceId);
+      return prevSessions.map(s => s.id === sessionId ? { ...s, workspaceId } : s);
+	    });
+	  }, [setActiveTabId]);
+
+  // Merge two tabs into one workspace. When one of them already belongs to a
+  // workspace, that workspace (and its id) is reused instead of dissolving
+  // and recreating: the id is what workspace-scoped AI chats bind to, so
+  // regenerating it used to strand every conversation anchored to it
+  // (issue #4015 R3). Only two genuinely standalone tabs create a new id.
   const createWorkspaceFromSessions = useCallback((
     baseSessionId: string,
     joiningSessionId: string,
     hint: SplitHint
   ) => {
     if (!hint || baseSessionId === joiningSessionId) return;
+    const baseSession = sessionsRef.current.find((s) => s.id === baseSessionId);
+    const joiningSession = sessionsRef.current.find((s) => s.id === joiningSessionId);
+    const anchorWorkspaceId = baseSession?.workspaceId ?? joiningSession?.workspaceId;
+    if (anchorWorkspaceId) {
+      const anchorSessionId = baseSession?.workspaceId ? baseSessionId : joiningSessionId;
+      const orphanSessionId = anchorSessionId === baseSessionId ? joiningSessionId : baseSessionId;
+      const orphanSession = sessionsRef.current.find((s) => s.id === orphanSessionId);
+      if (!orphanSession || orphanSession.workspaceId) return;
+      // Split next to the anchor's existing pane: the raw drop hint targets
+      // the orphan's pane, which is not part of this workspace tree yet.
+      // When the dragged (joining) pane already owns the workspace, the orphan
+      // is what gets inserted — invert the drop position so the previewed
+      // side still matches (hint describes where the dragged pane should sit).
+      const joinOwnsWorkspace = Boolean(joiningSession?.workspaceId) && !baseSession?.workspaceId;
+      const insertHint = {
+        ...hint,
+        targetSessionId: anchorSessionId,
+        position: joinOwnsWorkspace ? invertSplitPosition(hint.position) : hint.position,
+      };
+      addSessionToWorkspace(
+        anchorWorkspaceId,
+        orphanSessionId,
+        insertHint,
+      );
+      // The orphan's standalone tab slot is replaced by the workspace tab.
+      setTabOrder((prevTabOrder) => prevTabOrder.filter((id) => id !== orphanSessionId));
+      return;
+    }
     // Name the merged workspace after both tabs' connection labels (e.g.
     // "01/02") so the window title and the rename dialog show the merged
     // identity instead of the generic "Workspace". Falls back to the default
@@ -855,30 +912,7 @@ export const useSessionState = ({
         return s;
       });
     });
-  }, [setActiveTabId]);
-
-  const addSessionToWorkspace = useCallback((
-    workspaceId: string,
-    sessionId: string,
-    hint: SplitHint
-  ) => {
-    if (!hint) return;
-    
-	    setSessions(prevSessions => {
-      const session = prevSessions.find(s => s.id === sessionId);
-      if (!session || session.workspaceId) return prevSessions;
-      
-      setWorkspaces(prevWorkspaces => {
-        const targetWorkspace = prevWorkspaces.find(w => w.id === workspaceId);
-        if (!targetWorkspace) return prevWorkspaces;
-        
-        return insertWorkspacePaneIfMissing(prevWorkspaces, workspaceId, sessionId, hint);
-      });
-      
-      setActiveTabId(workspaceId);
-      return prevSessions.map(s => s.id === sessionId ? { ...s, workspaceId } : s);
-	    });
-	  }, [setActiveTabId]);
+  }, [addSessionToWorkspace, setActiveTabId]);
 
   // Add a host into an existing workspace by creating a new session for
   // that host and appending it as the last pane at the workspace root.

application/state/useSessionStateWorkspaceIdReuse.test.ts

@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import React from "react";
+import { act, create, type ReactTestRenderer } from "react-test-renderer";
+
+import { collectSessionIds } from "../../domain/workspace.ts";
+import { useSessionState } from "./useSessionState.ts";
+
+type SessionState = ReturnType<typeof useSessionState>;
+
+test("merging a workspace tab with a standalone tab reuses the workspace id (issue #4015 R3)", async (t) => {
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  const eventTarget = new EventTarget() as EventTarget & Record<string, unknown>;
+  Object.assign(eventTarget, {
+    setTimeout,
+    clearTimeout,
+  });
+  Object.defineProperty(globalThis, "window", {
+    configurable: true,
+    value: eventTarget,
+  });
+  t.after(() => {
+    if (previousWindow) Object.defineProperty(globalThis, "window", previousWindow);
+    else Reflect.deleteProperty(globalThis, "window");
+  });
+
+  const actEnvironment = globalThis as typeof globalThis & {
+    IS_REACT_ACT_ENVIRONMENT?: boolean;
+  };
+  const previousActEnvironment = actEnvironment.IS_REACT_ACT_ENVIRONMENT;
+  actEnvironment.IS_REACT_ACT_ENVIRONMENT = true;
+  t.after(() => {
+    actEnvironment.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
+  });
+
+  let state: SessionState | null = null;
+  let renderer: ReactTestRenderer | null = null;
+  const current = (): SessionState => {
+    assert.ok(state);
+    return state;
+  };
+  function Probe() {
+    state = useSessionState({ persistSessionRestore: false });
+    return null;
+  }
+
+  await act(async () => {
+    renderer = create(React.createElement(Probe));
+  });
+
+  let baseId = "";
+  let memberId = "";
+  let standaloneId = "";
+  await act(async () => {
+    baseId = current().createLocalTerminal({ shellName: "01" });
+    memberId = current().createLocalTerminal({ shellName: "02" });
+    standaloneId = current().createLocalTerminal({ shellName: "03" });
+  });
+
+  await act(async () => {
+    current().createWorkspaceFromSessions(baseId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: baseId,
+    });
+  });
+  const workspaceId = current().workspaces[0]?.id;
+  assert.ok(workspaceId);
+  assert.equal(current().sessions.find((s) => s.id === standaloneId)?.workspaceId ?? "", "");
+
+  // Dropping the standalone tab onto a member of the workspace must join the
+  // existing workspace — regenerating the id would strand AI chats bound to it.
+  await act(async () => {
+    current().createWorkspaceFromSessions(standaloneId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: standaloneId,
+    });
+  });
+
+  assert.equal(current().workspaces.length, 1);
+  assert.equal(current().workspaces[0]?.id, workspaceId);
+  assert.equal(
+    current().sessions.find((s) => s.id === standaloneId)?.workspaceId,
+    workspaceId,
+  );
+  const memberIds = collectSessionIds(current().workspaces[0]!.root);
+  assert.ok(memberIds.includes(standaloneId));
+  assert.ok(memberIds.includes(memberId));
+  // The standalone tab slot is replaced by the workspace tab.
+  assert.ok(!current().orderedTabs.includes(standaloneId));
+
+
+  // Dropping a workspace member onto a standalone tab must insert the
+  // standalone on the opposite side of the drop hint (hint describes where
+  // the dragged member should appear relative to the standalone).
+  let orientationStandaloneId = "";
+  let orientationMemberId = "";
+  await act(async () => {
+    orientationStandaloneId = current().createLocalTerminal({ shellName: "orient-standalone" });
+  });
+  // memberId is already in workspaceId; drop member onto the new standalone with position "right"
+  // (preview: member to the right of standalone ⇒ standalone should end up LEFT of member).
+  await act(async () => {
+    current().createWorkspaceFromSessions(orientationStandaloneId, memberId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: orientationStandaloneId,
+    });
+  });
+  {
+    const root = current().workspaces.find((ws) => ws.id === workspaceId)?.root;
+    assert.ok(root);
+    const ordered = collectSessionIds(root!);
+    const standaloneIdx = ordered.indexOf(orientationStandaloneId);
+    const memberIdx = ordered.indexOf(memberId);
+    assert.ok(standaloneIdx >= 0 && memberIdx >= 0);
+    assert.ok(
+      standaloneIdx < memberIdx,
+      `expected standalone left of member after inverted right-drop, got order ${ordered.join(",")}`,
+    );
+  }
+
+  // Two genuinely standalone tabs still create a fresh workspace.
+  let firstStandaloneId = "";
+  let secondStandaloneId = "";
+  await act(async () => {
+    firstStandaloneId = current().createLocalTerminal({ shellName: "04" });
+    secondStandaloneId = current().createLocalTerminal({ shellName: "05" });
+  });
+  await act(async () => {
+    current().createWorkspaceFromSessions(firstStandaloneId, secondStandaloneId, {
+      direction: "vertical",
+      position: "right",
+      targetSessionId: firstStandaloneId,
+    });
+  });
+
+  assert.equal(current().workspaces.length, 2);
+  const freshWorkspace = current().workspaces.find((candidate) => candidate.id !== workspaceId);
+  assert.ok(freshWorkspace);
+  assert.notEqual(freshWorkspace.id, workspaceId);
+
+  await act(async () => {
+    renderer?.unmount();
+  });
+});

application/state/useSettingsState.ts

@@ -74,6 +74,7 @@ import {
   STORAGE_KEY_GLOBAL_DEFAULT_PROXY_PROFILE,
   STORAGE_KEY_GLOBAL_HOTKEY_ENABLED,
   STORAGE_KEY_WINDOW_OPACITY,
+  STORAGE_KEY_WINDOW_BACKGROUND_BLUR,
   STORAGE_KEY_APP_ICON_VARIANT,
   STORAGE_KEY_AUTO_UPDATE_ENABLED,
   STORAGE_KEY_WORKSPACE_FOCUS_STYLE,
@@ -645,6 +646,9 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     windowOpacityMutationSourceRef.current = 'local';
     setWindowOpacityRecord(toggleWindowOpacityRecord);
   }, []);
+  const [windowBackgroundBlur, setWindowBackgroundBlur] = useState<boolean>(() => {
+    return readStoredString(STORAGE_KEY_WINDOW_BACKGROUND_BLUR) === 'true';
+  });
   const [appIconVariant, setAppIconVariantState] = useState<AppIconVariant>(() => {
     const stored = readStoredString(STORAGE_KEY_APP_ICON_VARIANT);
     return resolveAppIconVariant(stored ?? DEFAULT_APP_ICON_VARIANT);
@@ -1276,6 +1280,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setIsHotkeyRecordingState,
     setGlobalHotkeyEnabled,
     setWindowOpacity: applyIncomingWindowOpacity,
+    setWindowBackgroundBlur,
     setAppIconVariant,
     setAutoUpdateEnabled,
     setAutoLaunchEnabled,
@@ -1298,12 +1303,18 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setSshTransportIdleTtlMsState,
   });
 
-  // Detached sessions share opacity and the shortcut configuration needed to
-  // operate it. Keep general settings listeners and OS effects disabled there.
+  // Detached sessions share window chrome (opacity, background blur) and the
+  // shortcut configuration needed to operate it. Keep general settings
+  // listeners and OS effects disabled there.
   useEffect(() => {
     if (enableSettingsSync) return;
     const applySharedWindowSetting = (key: string, value: unknown) => {
       if (key === STORAGE_KEY_WINDOW_OPACITY) applyIncomingWindowOpacity(value);
+      if (key === STORAGE_KEY_WINDOW_BACKGROUND_BLUR) {
+        // Storage events deliver the raw string; IPC delivers a boolean.
+        const incoming = typeof value === 'boolean' ? value : value === 'true';
+        setWindowBackgroundBlur(incoming);
+      }
       if (key === STORAGE_KEY_HOTKEY_SCHEME && (value === 'disabled' || value === 'mac' || value === 'pc')) {
         setHotkeyScheme(value);
       }
@@ -1377,7 +1388,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     sftpUseCompressedUpload, sftpSkipUnchanged, sftpAutoOpenSidebar, sftpFollowTerminalCwd, sftpDefaultViewMode,
     showRecentHosts, hostClickBehavior, showOnlyUngroupedHostsInRoot, showSftpTab, showHostTreeSidebar, terminalSidePanelAutoOpen, terminalSidePanelAutoOpenTab, localShellSidePanelAutoOpen, localShellSidePanelAutoOpenTab, shellOnlyTabNumberShortcuts, showTabNumberBadges, disableTerminalFontZoom, restorePreviousSession, restoreTerminalCwd, startupLanding,
     editorWordWrap, sessionLogsEnabled, sessionLogsDir, sessionLogsFormat, sessionLogsTimestampsEnabled, sshDebugLogsEnabled, sshDeepLinkEnabled, jmsDeepLinkEnabled, explorerContextMenuEnabled,
-    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, appIconVariant,
+    globalHotkeyEnabled, autoUpdateEnabled, windowOpacity, windowBackgroundBlur, appIconVariant,
     setTheme, setLightUiThemeId, setDarkUiThemeId, setAccentMode,
     applyIncomingCustomAccent,
     setCustomCSS, setUiFontFamilyId, setHotkeyScheme, setUiLanguage,
@@ -1387,7 +1398,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     setSftpUseCompressedUpload, setSftpSkipUnchanged, setSftpAutoOpenSidebar, setSftpFollowTerminalCwd, setSftpDefaultViewMode,
     setShowRecentHostsState, setHostClickBehaviorState, setShowOnlyUngroupedHostsInRootState, setShowSftpTabState, setShowHostTreeSidebarState, setTerminalSidePanelAutoOpenState, setTerminalSidePanelAutoOpenTabState, setLocalShellSidePanelAutoOpenState, setLocalShellSidePanelAutoOpenTabState, setShellOnlyTabNumberShortcutsState, setShowTabNumberBadgesState, setDisableTerminalFontZoomState, setRestorePreviousSessionState, setRestoreTerminalCwdState, setStartupLandingState,
     setEditorWordWrapState, setSessionLogsEnabled, setSessionLogsDir, setSessionLogsFormat, setSessionLogsTimestampsEnabled, setSshDebugLogsEnabled, setSshDeepLinkEnabledState: applyIncomingSshDeepLinkEnabled, setJmsDeepLinkEnabledState: applyIncomingJmsDeepLinkEnabled, setExplorerContextMenuEnabledState: applyIncomingExplorerContextMenuEnabled,
-    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
+    setGlobalHotkeyEnabled, setWindowOpacity: applyIncomingWindowOpacity, setWindowBackgroundBlur, setAppIconVariant, setAutoUpdateEnabled, setWorkspaceFocusStyleState,
     setSftpTransferConcurrencyState, setSshTransportIdleTtlMsState,
     applyIncomingCustomKeyBindings, mergeIncomingTerminalSettings,
   });
@@ -1896,6 +1907,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     autoLaunchEnabled,
     windowOpacityRecord,
     windowOpacityMutationSourceRef,
+    windowBackgroundBlur,
     appIconVariant,
     autoUpdateEnabled,
     httpNetworkProxy,
@@ -2276,6 +2288,8 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
     windowOpacity,
     setWindowOpacity,
     toggleWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
     appIconVariant,
     setAppIconVariant,
     rehydrateAllFromStorage,

application/state/useToolAccessGuidanceState.test.tsx

@@ -0,0 +1,81 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { useToolAccessGuidanceState, type ToolAccessGuidanceState } from './useToolAccessGuidanceState';
+import { AI_STATE_CHANGED_EVENT } from './aiStateEvents';
+import { STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } from '../../infrastructure/config/storageKeys';
+import type { AIToolIntegrationMode } from '../../infrastructure/ai/types';
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => { resolve = done; });
+  return { promise, resolve };
+}
+async function harness() {
+  const requests: ReturnType<typeof deferred<unknown>>[] = [];
+  const events = new EventTarget();
+  const values = new Map([[STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED, 'true']]);
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const globals = {
+    IS_REACT_ACT_ENVIRONMENT: true,
+    localStorage: { getItem: (key: string) => values.get(key) ?? null, setItem: (key: string, value: string) => values.set(key, value) },
+    window: {
+      netcatty: {
+        externalMcpGetStatus: () => { const request = deferred<unknown>(); requests.push(request); return request.promise; },
+        aiSkillsCliGetInvocation: async () => ({ ok: true, skillPath: '/fixture/skills/SKILL.md', commandPrefix: 'fixture-cli' }),
+      },
+      addEventListener: events.addEventListener.bind(events), removeEventListener: events.removeEventListener.bind(events),
+      dispatchEvent: events.dispatchEvent.bind(events), setTimeout, clearTimeout,
+    },
+  };
+  for (const [key, value] of Object.entries(globals)) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { value, configurable: true, writable: true });
+  }
+  let result!: ToolAccessGuidanceState;
+  function Harness({ mode }: { mode: AIToolIntegrationMode }) { result = useToolAccessGuidanceState(mode); return null; }
+  let renderer!: ReactTestRenderer;
+  await act(async () => { renderer = create(<Harness mode="mcp" />); });
+  return {
+    requests, events, values, result: () => result,
+    skills: async () => { await act(async () => renderer.update(<Harness mode="skills" />)); },
+    close: async () => {
+      await act(async () => renderer.unmount());
+      for (const [key, value] of previous) { if (value) Object.defineProperty(globalThis, key, value); else Reflect.deleteProperty(globalThis, key); }
+    },
+  };
+}
+const status = (path: string) => ({ ok: true, enabled: true, state: 'running', launcherPath: path, discoveryPath: `${path}.json` });
+
+test('older MCP guidance response cannot overwrite a newer enable-state refresh', async () => {
+  const h = await harness();
+  try {
+    assert.equal(h.requests.length, 1);
+    await act(async () => { h.events.dispatchEvent(new CustomEvent(AI_STATE_CHANGED_EVENT, { detail: { key: STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } })); });
+    assert.equal(h.requests.length, 2);
+    await act(async () => h.requests[1].resolve(status('/fixture/new')));
+    assert.equal(h.result().mcpLauncherPath, '/fixture/new');
+    await act(async () => h.requests[0].resolve(status('/fixture/old')));
+    assert.equal(h.result().mcpLauncherPath, '/fixture/new');
+  } finally { await h.close(); }
+});
+
+test('switching to Skills ignores pending MCP results and preserves resolved Skills guidance', async () => {
+  const h = await harness();
+  try {
+    await h.skills();
+    await act(async () => h.requests[0].resolve(status('/fixture/stale')));
+    assert.equal(h.result().mcpLauncherPath, null);
+    assert.equal(h.result().skillPath, '/fixture/skills/SKILL.md');
+    assert.equal(h.result().commandPrefix, 'fixture-cli');
+  } finally { await h.close(); }
+});
+
+test('MCP guidance completion after unmount has no visible state or retry work', async () => {
+  const h = await harness();
+  const initial = h.result();
+  await h.close();
+  await act(async () => h.requests[0].resolve(status('/fixture/stale')));
+  assert.equal(h.result(), initial);
+});

application/state/useToolAccessGuidanceState.ts

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 import type { AIToolIntegrationMode } from '../../infrastructure/ai/types';
 import { STORAGE_KEY_AI_EXTERNAL_MCP_ENABLED } from '../../infrastructure/config/storageKeys';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
@@ -38,14 +38,15 @@ export type ToolAccessGuidanceState = {
  * runtime is still starting or after an idle shutdown).
  */
 export function useToolAccessGuidanceState(mode: AIToolIntegrationMode): ToolAccessGuidanceState {
+  const requestGeneration = useRef(0);
   const [skillPath, setSkillPath] = useState<string | null>(null);
   const [commandPrefix, setCommandPrefix] = useState('');
   const [mcpLauncherPath, setMcpLauncherPath] = useState<string | null>(null);
   const [mcpDiscoveryPath, setMcpDiscoveryPath] = useState<string | null>(null);
 
-  const refreshMcpStatus = useCallback(async (): Promise<string | null | undefined> => {
+  const refreshMcpStatus = useCallback(async (isCurrent: () => boolean): Promise<string | null | undefined> => {
     const status = await netcattyBridge.get()?.externalMcpGetStatus?.();
-    if (!status?.ok) return undefined;
+    if (!isCurrent() || !status?.ok) return undefined;
     // Do not trust `enabled` alone: the main process flips `enabled` before
     // host credentials are resolved and the discovery file is written, and it
     // keeps reporting the configured discovery/launcher paths while starting.
@@ -93,9 +94,11 @@ export function useToolAccessGuidanceState(mode: AIToolIntegrationMode): ToolAcc
 
     const refetch = async () => {
       if (cancelled) return;
+      const generation = ++requestGeneration.current;
+      const isCurrent = () => !cancelled && generation === requestGeneration.current;
       const storedEnabled = readExternalMcpStoredEnabled();
-      const readyLauncherPath = await refreshMcpStatus().catch(() => undefined);
-      if (cancelled) return;
+      const readyLauncherPath = await refreshMcpStatus(isCurrent).catch(() => undefined);
+      if (!isCurrent()) return;
       // The persisted switch is off but the status check failed: drop any
       // cached launcher/discovery paths. The stored credentials were revoked
       // by the disable, and falling through to the comparison below would see

application/state/useVaultState.shellHistory.test.ts

@@ -0,0 +1,63 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import React from "react";
+import { act, create, type ReactTestRenderer } from "react-test-renderer";
+import { JSDOM } from "jsdom";
+import { installBrowserLockFixture } from "../testSupport/browserLockFixture";
+import { STORAGE_KEY_SHELL_HISTORY } from "../../infrastructure/config/storageKeys";
+
+test("shell history append yields the input turn and persists merged entries", async () => {
+  const dom = new JSDOM("", { url: "http://localhost" });
+  const globals = ["window", "localStorage", "CustomEvent", "IS_REACT_ACT_ENVIRONMENT", "navigator"];
+  const previous = new Map(globals.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]));
+  Object.defineProperties(globalThis, {
+    window: { value: dom.window, configurable: true },
+    localStorage: { value: dom.window.localStorage, configurable: true },
+    CustomEvent: { value: dom.window.CustomEvent, configurable: true },
+    IS_REACT_ACT_ENVIRONMENT: { value: true, configurable: true },
+  });
+  installBrowserLockFixture();
+  const { useVaultState } = await import("./useVaultState");
+  let state: ReturnType<typeof useVaultState>;
+  let renderer: ReactTestRenderer | undefined;
+  const Probe = () => { state = useVaultState({ syncConnectionLogTerminalData: false }); return null; };
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    for (let attempt = 0; !state!.isInitialized && attempt < 50; attempt++) {
+      await act(async () => { await new Promise(resolve => setTimeout(resolve, 10)); });
+    }
+    assert.equal(state!.isInitialized, true);
+    const entry = { command: " echo hello ", hostId: "local", hostLabel: "Local", sessionId: "one" };
+    act(() => {
+      state!.addShellHistoryEntry(entry);
+      state!.addShellHistoryEntry({ ...entry, sessionId: "two" });
+      assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY), null);
+      assert.equal(state!.shellHistory.length, 0);
+    });
+    await act(async () => { await new Promise(resolve => setTimeout(resolve, 20)); });
+    const saved = JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY)!);
+    assert.equal(saved.length, 1);
+    assert.equal(saved[0].command, "echo hello");
+    assert.equal(saved[0].sessionId, "two");
+    assert.deepEqual(state!.shellHistory, saved);
+
+    for (const clear of [() => state!.clearShellHistory(), () => state!.clearAllCommandHistory()]) {
+      act(() => {
+        state!.addShellHistoryEntry(entry);
+        state!.addShellHistoryEntry({ ...entry, command: "another command" });
+        clear();
+      });
+      await act(async () => { await new Promise(resolve => setTimeout(resolve, 20)); });
+      assert.deepEqual(state!.shellHistory, []);
+      assert.deepEqual(JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_SHELL_HISTORY)!), []);
+    }
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    dom.window.close();
+    for (const key of globals) {
+      const descriptor = previous.get(key);
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

application/state/useVaultState.ts

@@ -317,6 +317,7 @@ export const useVaultState = (options?: UseVaultStateOptions) => {
   const [noteGroups, setNoteGroups] = useState<string[]>([]);
   const [knownHosts, setKnownHosts] = useState<KnownHost[]>([]);
   const [shellHistory, setShellHistory] = useState<ShellHistoryEntry[]>([]);
+  const shellHistoryGenerationRef = useRef(0);
   const [connectionLogs, setConnectionLogs] = useState<ConnectionLog[]>([]);
   const [managedSources, setManagedSources] = useState<ManagedSource[]>([]);
   const [groupConfigs, setGroupConfigs] = useState<GroupConfig[]>([]);
@@ -1445,19 +1446,25 @@ export const useVaultState = (options?: UseVaultStateOptions) => {
 
   const addShellHistoryEntry = useCallback(
     (entry: Omit<ShellHistoryEntry, "id" | "timestamp">) => {
-      setShellHistory((prev) => {
-        const updated = mergeGlobalHistoryOnAppend(prev, entry);
-        if (updated === prev) return prev;
-        // Persist immediately so crash between commit and layout effect cannot drop history.
-        // Store republish is also done in useLayoutEffect for load/storage-event paths.
-        localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, updated);
-        return updated;
-      });
+      const generation = shellHistoryGenerationRef.current;
+      // Yield the input turn before history rendering and synchronous storage work.
+      // Persist in the next task to keep the crash-loss window small.
+      setTimeout(() => {
+        if (generation !== shellHistoryGenerationRef.current) return;
+        setShellHistory((prev) => {
+          if (generation !== shellHistoryGenerationRef.current) return prev;
+          const updated = mergeGlobalHistoryOnAppend(prev, entry);
+          if (updated === prev) return prev;
+          localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, updated);
+          return updated;
+        });
+      }, 0);
     },
     [],
   );
 
   const clearShellHistory = useCallback(() => {
+    shellHistoryGenerationRef.current += 1;
     setShellHistory([]);
     localStorageAdapter.write(STORAGE_KEY_SHELL_HISTORY, []);
     publishShellHistorySnapshot([]);

components/AIChatPanelContent.test.ts

@@ -40,3 +40,35 @@ test('terminal side panel tools share one primary toolbar height', () => {
     assert.match(source, /TERMINAL_SIDE_PANEL_INNER_HEADER_CLASS/);
   }
 });
+
+test('/rename and /chats panel commands stay out of the agent message path', () => {
+  const sidePanel = preparingSource;
+  // Panel implements the commands with updateSessionTitle + a note state —
+  // never addMessageToSession, so the commands cannot leak into chat history.
+  assert.match(sidePanel, /handleRenameSession = useCallback/);
+  assert.match(sidePanel, /handleListChats = useCallback/);
+  assert.match(sidePanel, /updateSessionTitle\(sessionId, title\)/);
+  assert.match(sidePanel, /setPanelCommandNote\(formatAiChatsListingNote\(entries, t\)\)/);
+  const renameHandler = sidePanel.slice(
+    sidePanel.indexOf('handleRenameSession = useCallback'),
+    sidePanel.indexOf('const handleRenameSlashCommand'),
+  );
+  assert.doesNotMatch(renameHandler, /addMessageToSession/);
+  const chatsHandler = sidePanel.slice(
+    sidePanel.indexOf('handleListChats = useCallback'),
+    sidePanel.indexOf('const handleSend'),
+  );
+  assert.doesNotMatch(chatsHandler, /addMessageToSession/);
+  // Wiring reaches AIChatPanelContent.
+  assert.match(sidePanel, /onRenameActiveChat=\{handleRenameSlashCommand\}/);
+  assert.match(sidePanel, /onListChats=\{handleListChats\}/);
+});
+
+test('AIChatPanelContent renders the panel command note and wires rename/list props', () => {
+  assert.match(panelSource, /panelCommandNote \? \(/);
+  assert.match(panelSource, /role="status"/);
+  assert.match(panelSource, /onDismissPanelCommandNote/);
+  assert.match(panelSource, /onRenameSession=\{onRenameActiveChat\}/);
+  assert.match(panelSource, /onListChats=\{onListChats\}/);
+  assert.match(panelSource, /onRename=\{onRenameSession\}/);
+});

components/AIChatPanelContent.tsx

@@ -57,6 +57,20 @@ interface AIChatPanelContentProps {
   setInputValue: (value: string) => void;
   handleSend: () => void;
   handleCompact: () => void;
+  /** Rename a chat by id (history drawer edit affordance). Panel action, never agent content. */
+  onRenameSession?: (sessionId: string, title: string) => void;
+  /** `/rename <title>` for the current chat. Panel action, never agent content. */
+  onRenameActiveChat?: (title: string) => void;
+  /** `/chats`: list the chats visible to this panel. Panel action, never agent content. */
+  onListChats?: () => void;
+  /** `/rebind <n>`: rebind a dangling chat to this panel's scope. Panel action, never agent content. */
+  onRebindChat?: (arg: string) => void;
+  /** `/chats` listing output, rendered as a system-style note above the composer. */
+  panelCommandNote?: string | null;
+  onDismissPanelCommandNote?: () => void;
+  /** Manual durability escape hatch: export/import the whole session store. */
+  onExportSessions?: () => void;
+  onImportSessions?: () => void;
   /** Undo last turn is offered at a safe boundary (never mid-tool / mid-compaction). */
   canUndoLastTurn?: boolean;
   handleUndoLastTurn?: () => void;
@@ -142,6 +156,14 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
   setInputValue,
   handleSend,
   handleCompact,
+  onRenameSession,
+  onRenameActiveChat,
+  onListChats,
+  onRebindChat,
+  panelCommandNote,
+  onDismissPanelCommandNote,
+  onExportSessions,
+  onImportSessions,
   canUndoLastTurn = false,
   handleUndoLastTurn,
   canCompact = false,
@@ -309,6 +331,9 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
             activeSessionId={activeSessionId}
             onSelect={sending ? () => undefined : handleSelectSession}
             onDelete={handleDeleteSession}
+            onRename={onRenameSession}
+            onExportSessions={onExportSessions}
+            onImportSessions={onImportSessions}
             onClose={() => setShowHistory(false)}
           />
         </React.Profiler>
@@ -369,6 +394,21 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
           {!hideInput && (
             <React.Profiler {...getAIPanelProfilerProps('AIChatPanel.Input')}>
               <div>
+                {panelCommandNote ? (
+                  <div role="status" className="mx-3 mb-1.5 rounded-md border border-border/50 bg-muted/30 px-2.5 py-1.5 text-[11px] leading-4 text-muted-foreground">
+                    <span className="block max-h-48 overflow-y-auto whitespace-pre-wrap break-words">{panelCommandNote}</span>
+                    {onDismissPanelCommandNote && (
+                      <button
+                        type="button"
+                        aria-label={t('common.close')}
+                        onClick={onDismissPanelCommandNote}
+                        className="mt-1 text-[11px] text-muted-foreground/60 underline-offset-2 transition-colors hover:text-foreground hover:underline cursor-pointer"
+                      >
+                        {t('common.close')}
+                      </button>
+                    )}
+                  </div>
+                ) : null}
                 {steerWarning ? (
                   <div role="status" className="mx-3 mb-1.5 rounded-md border border-amber-500/25 bg-amber-500/10 px-2.5 py-1.5 text-[11px] leading-4 text-amber-600 dark:text-amber-400">
                     {steerWarning}
@@ -396,6 +436,9 @@ export const AIChatPanelContent: React.FC<AIChatPanelContentProps> = ({
                   onChange={setInputValue}
                   onSend={handleSend}
                   onCompact={handleCompact}
+                  onRenameSession={onRenameActiveChat}
+                  onListChats={onListChats}
+                  onRebindChat={onRebindChat}
                   canCompact={canCompact}
                   onSteer={handleSteer}
                   onStop={handleStop}

components/AIChatSessionHistoryDrawer.tsx

@@ -1,5 +1,5 @@
 import React, { useEffect, useId, useRef, useState } from 'react';
-import { Search, Trash2, X } from 'lucide-react';
+import { Download, Pencil, Search, Trash2, Upload, X } from 'lucide-react';
 import type { AISession } from '../infrastructure/ai/types';
 import { useI18n } from '../application/i18n/I18nProvider';
 import { cn } from '../lib/utils';
@@ -19,6 +19,12 @@ interface SessionHistoryDrawerProps {
   activeSessionId: string | null;
   onSelect: (sessionId: string) => void;
   onDelete: (e: React.MouseEvent, sessionId: string) => void;
+  /** Rename a chat inline (issue #4015 R5). Empty titles are ignored. */
+  onRename?: (sessionId: string, title: string) => void;
+  /** Manual durability escape hatch: export the whole store to a JSON file. */
+  onExportSessions?: () => void;
+  /** Import sessions from a JSON export; merges by id, newer wins. */
+  onImportSessions?: () => void;
   onClose: () => void;
 }
 
@@ -30,11 +36,17 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
   activeSessionId,
   onSelect,
   onDelete,
+  onRename,
+  onExportSessions,
+  onImportSessions,
   onClose,
 }) => {
   const { t } = useI18n();
   const [renderCount, setRenderCount] = useState(SESSION_RENDER_BATCH);
   const [searchQuery, setSearchQuery] = useState('');
+  const [renamingSessionId, setRenamingSessionId] = useState<string | null>(null);
+  const [renameDraft, setRenameDraft] = useState('');
+  const renameInputRef = useRef<HTMLInputElement>(null);
   const searchHintId = useId();
   const searchInputRef = useRef<HTMLInputElement>(null);
   const { filteredSessions, isSearching } = useSessionHistorySearch(
@@ -52,16 +64,69 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
   const displayedSessions = filteredSessions.slice(0, renderCount);
   const hiddenSessionCount = Math.max(0, filteredSessions.length - renderCount);
 
+  useEffect(() => {
+    if (renamingSessionId) renameInputRef.current?.focus();
+  }, [renamingSessionId]);
+
+  const beginRename = (sessionId: string, currentTitle: string) => {
+    setRenamingSessionId(sessionId);
+    setRenameDraft(currentTitle);
+  };
+
+  const commitRename = () => {
+    if (renamingSessionId && renameDraft.trim()) {
+      onRename?.(renamingSessionId, renameDraft.trim());
+    }
+    setRenamingSessionId(null);
+    setRenameDraft('');
+  };
+
   return (
     <div className="flex-1 flex flex-col min-h-0">
       <div className="px-4 py-2.5 flex items-center justify-between shrink-0 border-b border-border/30">
         <span className="text-[13px] font-medium text-foreground/80">{t('ai.chat.allSessions')}</span>
-        <button
-          onClick={onClose}
-          className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
-        >
-          <X size={14} />
-        </button>
+        <div className="flex items-center gap-2">
+          {onImportSessions && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onImportSessions();
+                  }}
+                  className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+                  aria-label={t('ai.chat.importSessions')}
+                >
+                  <Upload size={14} />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent>{t('ai.chat.importSessions')}</TooltipContent>
+            </Tooltip>
+          )}
+          {onExportSessions && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onExportSessions();
+                  }}
+                  className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+                  aria-label={t('ai.chat.exportSessions')}
+                >
+                  <Download size={14} />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent>{t('ai.chat.exportSessions')}</TooltipContent>
+            </Tooltip>
+          )}
+          <button
+            onClick={onClose}
+            className="text-[12px] text-muted-foreground/60 hover:text-muted-foreground transition-colors cursor-pointer"
+          >
+            <X size={14} />
+          </button>
+        </div>
       </div>
       <div className="px-3 py-2 shrink-0 border-b border-border/30">
         <div className="relative">
@@ -146,12 +211,52 @@ export const SessionHistoryDrawer: React.FC<SessionHistoryDrawerProps> = ({
                   )}
                 >
                   <span className={SESSION_HISTORY_ROW_CLASSNAMES.title}>
-                    {session.title || t('ai.chat.untitled')}
+                    {renamingSessionId === session.id ? (
+                      <Input
+                        ref={renameInputRef}
+                        type="text"
+                        value={renameDraft}
+                        aria-label={t('ai.chat.renameChat')}
+                        onClick={(e) => e.stopPropagation()}
+                        onKeyDown={(e) => {
+                          e.stopPropagation();
+                          if (e.key === 'Enter') {
+                            e.preventDefault();
+                            commitRename();
+                          } else if (e.key === 'Escape') {
+                            e.preventDefault();
+                            setRenamingSessionId(null);
+                            setRenameDraft('');
+                          }
+                        }}
+                        onChange={(e) => setRenameDraft(e.target.value)}
+                        onBlur={commitRename}
+                        className="h-6 text-[12px]"
+                      />
+                    ) : (
+                      session.title || t('ai.chat.untitled')
+                    )}
                   </span>
                   <div className={SESSION_HISTORY_ROW_CLASSNAMES.meta}>
                     <span className={SESSION_HISTORY_ROW_CLASSNAMES.time}>
                       {timeStr}
                     </span>
+                    {onRename && renamingSessionId !== session.id && (
+                      <Tooltip>
+                        <TooltipTrigger asChild>
+                          <button
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              beginRename(session.id, session.title || '');
+                            }}
+                            className={SESSION_HISTORY_ROW_CLASSNAMES.deleteButton}
+                          >
+                            <Pencil size={12} />
+                          </button>
+                        </TooltipTrigger>
+                        <TooltipContent>{t('ai.chat.renameChat')}</TooltipContent>
+                      </Tooltip>
+                    )}
                     <Tooltip>
                       <TooltipTrigger asChild>
                         <button

components/AIChatSidePanel.tsx

@@ -64,6 +64,7 @@ import {
   type DefaultTargetSessionHint,
 } from '../application/state/useAIChatStreaming';
 import { getScopedHistorySessions } from './ai/scopedHistorySessions';
+import { buildAiChatsListingEntries, canRebindChat, formatAiChatsListingNote, resolveRebindTargetFromArg, type AiChatsListingEntry } from './ai/aiChatsListing';
 import { resolveInheritedAIActiveSessionId } from '../domain/aiWorkspaceScopeInherit';
 import { resolveUndoLastTurnBoundary } from '../domain/aiUndoLastTurn';
 import { aiSessionIdSetEqual, exactScopeAISessionsEqual } from '../domain/aiSessionsForScope';
@@ -279,6 +280,9 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   undoLastTurnInSession,
   deleteSession,
   updateSessionTitle,
+  rebindSessionScope,
+  exportSessionsBackup,
+  importSessionsBackup,
   updateSessionExternalSessionId,
   addMessageToSession,
   updateLastMessage,
@@ -312,7 +316,9 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   scopeHostIds,
   scopeLabel,
   focusedSessionId,
+  workspaces = [],
   terminalSessions = [],
+  liveScopeTargetIds,
   resolveExecutorContext,
   isVisible = true,
   notes = [],
@@ -327,6 +333,11 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   const scopeKey = `${scopeType}:${scopeTargetId ?? ''}`;
 
   const [showHistory, setShowHistory] = useState(false);
+  // Inline system-style note above the composer (e.g. `/chats` listing).
+  // Panel-command output, never agent content.
+  const [panelCommandNote, setPanelCommandNote] = useState<string | null>(null);
+  // Entries of the last `/chats` listing; `/rebind <n>` resolves against them.
+  const lastChatsListingRef = useRef<AiChatsListingEntry[]>([]);
   const [isSending, setIsSending] = useState(false);
   // Undo-last-turn is still
   // running. Unlike the send flow this is not reflected in `isSending`, so it
@@ -484,6 +495,119 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
   const activeSessionRef = useRef(activeSession);
   activeSessionRef.current = activeSession;
 
+  /** Rename a chat (slash command + history drawer affordance). Panel action: nothing is sent to the agent. */
+  const handleRenameSession = useCallback((sessionId: string, rawTitle: string) => {
+    const title = rawTitle.trim();
+    if (!title) {
+      toast.warning(t('ai.chat.renameUsage'));
+      return;
+    }
+    if (!sessionId) {
+      toast.warning(t('ai.chat.renameNoActive'));
+      return;
+    }
+    updateSessionTitle(sessionId, title);
+    toast.success(t('ai.chat.renameDone').replace('{title}', title));
+  }, [t, updateSessionTitle]);
+
+  const handleRenameSlashCommand = useCallback((title: string) => {
+    handleRenameSession(activeSessionRef.current?.id ?? null, title);
+  }, [handleRenameSession]);
+
+  const handleListChats = useCallback(() => {
+    // Prefer the app-wide live target set so chats bound to other still-open
+    // terminals are not mislabelled dangling / offered for /rebind.
+    const liveTerminalIds = liveScopeTargetIds
+      ?? (scopeType === 'workspace' && workspaceMemberTerminalIds
+        ? workspaceMemberTerminalIds
+        : new Set(scopeTargetId ? [scopeTargetId] : []));
+    // Dangling chats no longer match any live scope (rank 0), so they must be
+    // appended explicitly for the listing — that is where they become visible
+    // and rebindable again (issue #4015 R2).
+    const listedSessionIds = new Set(historySessions.map((session) => session.id));
+    const danglingSessions = sessions.filter((session) => session.scopeDangling && !listedSessionIds.has(session.id));
+    const entries = buildAiChatsListingEntries({
+      sessions: [...historySessions, ...danglingSessions],
+      activeSessionId,
+      externalAgents,
+      workspaces,
+      liveTerminalIds,
+      currentScopeLabel: scopeLabel,
+      scopeTargetId,
+      t,
+    });
+    lastChatsListingRef.current = entries;
+    setPanelCommandNote(formatAiChatsListingNote(entries, t));
+  }, [activeSessionId, externalAgents, historySessions, liveScopeTargetIds, scopeLabel, scopeTargetId, scopeType, sessions, t, workspaces, workspaceMemberTerminalIds]);
+
+  // `/rebind <n>`: rebind the nth dangling chat from the last /chats listing
+  // to this panel's current scope. Panel action — no agent round-trip.
+  const handleRebindChat = useCallback((arg: string) => {
+    if (!scopeTargetId) {
+      toast.warning(t('ai.chat.rebindUnavailable'));
+      return;
+    }
+    const target = resolveRebindTargetFromArg(arg, lastChatsListingRef.current);
+    if (!target) {
+      toast.warning(t('ai.chat.rebindUsage'));
+      return;
+    }
+    const session = sessions.find((item) => item.id === target.sessionId);
+    const liveTargets = new Set(liveScopeTargetIds ?? workspaceMemberTerminalIds ?? []);
+    for (const workspace of workspaces) liveTargets.add(workspace.id);
+    liveTargets.add(scopeTargetId);
+    if (canRebindChat(session, liveTargets)) {
+      rebindSessionScope?.(target.sessionId, { type: scopeType, targetId: scopeTargetId, hostIds: scopeHostIds });
+      toast.success(t('ai.chat.rebindDone').replace('{title}', target.title));
+    } else {
+      toast.warning(t('ai.chat.rebindUsage'));
+    }
+    // Do not rebuild /chats from this render's stale sessions (still dangling).
+    // Drop the resolved entry from the stored listing so a repeat /rebind <n>
+    // cannot target it; the next explicit /chats refreshes from live state.
+    const remaining = lastChatsListingRef.current.filter(
+      (entry) => entry.sessionId !== target.sessionId,
+    );
+    let danglingCounter = 0;
+    for (const entry of remaining) {
+      if (!entry.isDangling) {
+        entry.rebindNumber = undefined;
+        continue;
+      }
+      danglingCounter += 1;
+      entry.rebindNumber = danglingCounter;
+    }
+    lastChatsListingRef.current = remaining;
+    setPanelCommandNote(formatAiChatsListingNote(remaining, t));
+  }, [liveScopeTargetIds, rebindSessionScope, scopeHostIds, scopeTargetId, scopeType, sessions, t, workspaces, workspaceMemberTerminalIds]);
+
+  // Manual durability actions (history drawer header). Export writes the
+  // whole store to a user-chosen JSON file; import merges by id.
+  const handleExportSessions = useCallback(() => {
+    void exportSessionsBackup?.().then((filePath) => {
+      if (filePath == null) {
+        toast.warning(t('ai.chat.exportUnavailable'));
+        return;
+      }
+      toast.success(
+        filePath
+          ? t('ai.chat.exportDone').replace('{path}', filePath)
+          : t('ai.chat.exportDoneNoPath'),
+      );
+    });
+  }, [exportSessionsBackup, t]);
+
+  const handleImportSessions = useCallback(() => {
+    void importSessionsBackup?.().then((count) => {
+      if (count <= 0) {
+        toast.warning(t('ai.chat.importNone'));
+        return;
+      }
+      toast.success(t('ai.chat.importDone').replace('{n}', String(count)));
+    });
+  }, [importSessionsBackup, t]);
+
+
   const defaultTargetSession = useMemo<DefaultTargetSessionHint | undefined>(() => {
     const connectedSessions = terminalSessions.filter((session) => session.connected !== false);
 
@@ -2065,6 +2189,14 @@ const AIChatSidePanelActive: React.FC<AIChatSidePanelProps> = ({
         setInputValue={setInputValue}
         handleSend={handleSend}
         handleCompact={handleCompact}
+        onRenameSession={handleRenameSession}
+        onRenameActiveChat={handleRenameSlashCommand}
+        onListChats={handleListChats}
+        onRebindChat={handleRebindChat}
+        panelCommandNote={panelCommandNote}
+        onDismissPanelCommandNote={() => setPanelCommandNote(null)}
+        onExportSessions={handleExportSessions}
+        onImportSessions={handleImportSessions}
         canUndoLastTurn={canUndoLastTurn}
         handleUndoLastTurn={undoLastTurnInSession ? handleUndoLastTurn : undefined}
         handleSteer={handleSteer}
@@ -2143,6 +2275,9 @@ const AI_CHAT_SIDE_PANEL_AI_STATE_KEYS = [
   'createSession',
   'deleteSession',
   'updateSessionTitle',
+  'rebindSessionScope',
+  'exportSessionsBackup',
+  'importSessionsBackup',
   'updateSessionExternalSessionId',
   'addMessageToSession',
   'updateLastMessage',
@@ -2193,6 +2328,8 @@ export function aiChatSidePanelPropsAreEqual(
   if ((prev.isVisible ?? true) !== (next.isVisible ?? true)) return false;
   if (prev.scopeHostIds !== next.scopeHostIds) return false;
   if (prev.terminalSessions !== next.terminalSessions) return false;
+  if (prev.liveScopeTargetIds !== next.liveScopeTargetIds) return false;
+  if (prev.workspaces !== next.workspaces) return false;
   if (prev.resolveExecutorContext !== next.resolveExecutorContext) return false;
   if (prev.notes !== next.notes) return false;
   if (prev.hosts !== next.hosts) return false;

components/AIChatSidePanel.types.ts

@@ -44,6 +44,12 @@ export interface AIChatSidePanelProps {
   ) => Promise<{ sessionId: string; restored: { text: string; attachments: import('../infrastructure/ai/types').UploadedFile[]; selectedUserSkillSlugs: string[] } } | null>;
   deleteSession: (sessionId: string, scopeKey?: string) => void;
   updateSessionTitle: (sessionId: string, title: string) => void;
+  /** Issue #4015 R2: rebind a dangling chat to this panel's scope (panel action, never agent content). */
+  rebindSessionScope?: (sessionId: string, scope: { type: 'terminal' | 'workspace'; targetId: string; hostIds?: string[] }) => void;
+  /** Manual durability escape hatch: export the store to a JSON file (returns the path, '' when fixed-path). */
+  exportSessionsBackup?: () => Promise<string | null>;
+  /** Import sessions from a JSON export; merges by id. Returns the imported count. */
+  importSessionsBackup?: () => Promise<number>;
   updateSessionExternalSessionId: (sessionId: string, externalSessionId: string | undefined) => void;
   addMessageToSession: (sessionId: string, message: ChatMessage) => void;
   updateLastMessage: (
@@ -103,6 +109,10 @@ export interface AIChatSidePanelProps {
   scopeLabel?: string;
   /** Workspace focused pane; preferred when inheriting AI chat after merge. */
   focusedSessionId?: string;
+  /** Live workspaces, used to resolve workspace titles for `/chats`. */
+  workspaces?: Array<{ id: string; title: string }>;
+  /** All currently live terminal (and workspace) scope target ids. */
+  liveScopeTargetIds?: Set<string>;
 
   // Terminal session context (from parent)
   terminalSessions?: Array<{

components/PluginAIContextHost.test.tsx

@@ -207,7 +207,9 @@ test('cold plugin host reaches the local fixture through the actual main provide
     assert.deepEqual(sdkErrorNames, []);
   } finally {
     console.error = originalConsoleError;
-    panel?.window.close();
+    // JSDOM.close does not deliver the browser pagehide lifecycle. Invalidate
+    // the sample's pending callbacks before teardown closes its document.
+    if (panel) { panel.window.dispatchEvent(new panel.window.Event('pagehide')); panel.window.close(); }
     await act(async () => root.unmount());
     await service?.manager.shutdown(); aiBridge.cleanup();
     publishNotesSnapshot(oldNotes); registerAppAppLockRuntime(oldLock);

components/PluginGlobalAgentHost.test.tsx

@@ -0,0 +1,193 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JSDOM } from 'jsdom';
+import { createRequire } from 'node:module';
+import { EventEmitter, once } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+test('installed global Chat UI reuses actual Catty runtime, configured HTTP transport and selected worker dispatch', { timeout: 30_000 }, async () => {
+  // This Node/JSDOM harness proves installed app wiring, not a native sandbox or
+  // real model/Claude acceptance. No real shell, remote host or credentials.
+  const rootPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'netcatty-global-agent-ui-'));
+  const oldTmp = process.env.TMPDIR; process.env.TMPDIR = directory;
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => { previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value }); };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'HTMLSelectElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'DocumentFragment']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('localStorage', dom.window.localStorage); install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window)); install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window)); install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react'); const { createRoot } = await import('react-dom/client');
+  const { PluginAgentHost } = await import('./plugins/PluginAgentHost');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { registerAppAppLockRuntime, getAppAppLockRuntime } = await import('../application/state/appRuntimeBridge');
+  const keys = await import('../infrastructure/config/storageKeys');
+  const { createGlobalAgentProviderFixture } = await import('../scripts/plugin-global-agent-provider-fixture.mjs');
+  const { createPluginHostService } = require('../electron/plugins/hostService.cjs');
+  const { inProcessBrowserRuntime } = require('../electron/plugins/fixtures/inProcessBrowserRuntime.cjs');
+  const { createPreloadApi } = require('../electron/preload/api.cjs');
+  const { registerProviderHandlers } = require('../electron/bridges/aiBridge/providerHandlers.cjs');
+  const { registerCattyExecHandlers } = require('../electron/bridges/aiBridge/cattyExecHandlers.cjs');
+  const { registerAgentProcessHandlers } = require('../electron/bridges/aiBridge/agentProcessHandlers.cjs');
+  const { registerPrivacyHandlers } = require('../electron/bridges/aiBridge/privacyHandlers.cjs');
+  const aiBridge = require('../electron/bridges/aiBridge.cjs'); const mcp = require('../electron/bridges/mcpServerBridge.cjs');
+  const privacy = require('../electron/shared/aiPrivacyService.cjs');
+  const { server, counts } = createGlobalAgentProviderFixture({ delayMs: 30 });
+  const oldLock = getAppAppLockRuntime(); const root = createRoot(document.getElementById('root')!);
+  let service: ReturnType<typeof createPluginHostService> | undefined; let panel: JSDOM | undefined;
+  const errors: string[] = []; const originalError = console.error;
+  let phase = 'setup';
+  // Flush the known Node sqlite import warning before observing safe categories.
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  console.error = (value: unknown) => { errors.push(`${phase}:${typeof value === 'string' && value === '[Plugin Agent] Turn unavailable' ? 'DELEGATED_TURN_UNAVAILABLE' : typeof value === 'string' && /not wrapped in act/.test(value) ? 'REACT_ACT_WARNING' : 'SDK_OR_RENDERER_ERROR'}`); };
+  try {
+    privacy.configure({ enabled: false }); server.listen(0, '127.0.0.1'); await once(server, 'listening');
+    const address = server.address(); assert.ok(address && typeof address !== 'string'); const endpoint = `http://127.0.0.1:${address.port}/v1`;
+    const handlers = new Map<string, (...args: unknown[]) => unknown>();
+    const ipcMain = { handle: (name: string, handler: (...args: unknown[]) => unknown) => handlers.set(name, handler), removeHandler: (name: string) => handlers.delete(name) };
+    const ipcRenderer = new EventEmitter() as EventEmitter & { invoke: (channel: string, payload: unknown) => Promise<unknown> };
+    const trustedReplies: unknown[] = []; const pluginReplies: unknown[] = []; const workerCalls: string[] = [];
+    const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false, send: (channel: string, payload: unknown) => ipcRenderer.emit(channel, {}, structuredClone(payload)) });
+    const mainWindow = Object.assign(new EventEmitter(), { webContents: sender, isDestroyed: () => false, isVisible: () => true, isFocused: () => true });
+    const owner = (id: string) => id === 'synthetic-a' ? 7 : id === 'synthetic-b' ? 8 : null;
+    const worker = { getSessionOwnerWebContentsId: owner, getPluginSessionBinding: (id: string, actual: number) => actual === owner(id) ? { epoch: 'fixture-worker', generation: id === 'synthetic-a' ? 1 : 2 } : null,
+      send: () => {}, request: async (method: string, payload: { sessionId: string }, options?: { beforeExecute?: () => void }) => {
+        options?.beforeExecute?.(); if (method === 'netcatty:ai:exec') { workerCalls.push(payload.sessionId); return { ok: true, stdout: 'Synthetic worker output', stderr: '', exitCode: 0 }; } return [];
+      } };
+    mcp.init({ sessions: new Map(), terminalWorkerManager: worker, cliDiscoveryFilePath: path.join(directory, 'discovery.json') }); mcp.setPermissionMode('observer');
+    const common = { ipcMain, validateSender: (event: { sender: unknown }) => event.sender === sender,
+      validateSenderOrSettings: (event: { sender: unknown }) => event.sender === sender, mcpServerBridge: mcp, aiPrivacyService: privacy };
+    const providerContext = { ...common, require: createRequire(path.join(rootPath, 'electron/bridges/aiBridge.cjs')),
+      providerConfigs: [] as Array<{ id: string; baseURL?: string; apiKey?: string }>, webSearchApiHost: null,
+      injectApiKeyIntoRequest: (url: string, headers: Record<string, string>, providerId: string) => {
+        const provider = providerContext.providerConfigs.find((entry) => entry.id === providerId);
+        return { url, headers: Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, value.replace('__IPC_SECURED__', provider?.apiKey ?? '')])) };
+      }, shouldSkipTLSVerify: () => false, streamRequest: aiBridge._streamRequestForTests,
+      // The production stream function owns this map. Turn release below uses
+      // its actual main lease; direct SDK abort still calls the ordinary route.
+      activeStreams: new Map() };
+    registerProviderHandlers(providerContext); registerCattyExecHandlers(common); registerAgentProcessHandlers(common); registerPrivacyHandlers(common);
+    ipcRenderer.invoke = async (channel, payload) => {
+      if (channel === 'netcatty:ai:chat:stream') {
+        const request = payload as { requestId: string; url: string }; assert.equal(new URL(request.url).origin, new URL(endpoint).origin);
+        assert.match(request.requestId, /^agent-model_/);
+      }
+      const handler = handlers.get(channel); assert.ok(handler, `Unexpected trusted IPC: ${channel}`);
+      const result = await handler({ sender }, structuredClone(payload));
+      if (channel === 'netcatty:plugins:agent-host-response') trustedReplies.push(payload);
+      return result;
+    };
+    const api = createPreloadApi({ ipcRenderer, webUtils: {} }); Object.defineProperty(dom.window, 'netcatty', { value: api });
+    registerAppAppLockRuntime({ locked: false } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_PROVIDERS, JSON.stringify([{ id: 'fixture-provider', name: 'Synthetic fixture', providerId: 'custom', enabled: true,
+      baseURL: endpoint, defaultModel: 'global-agent-fixture', apiKey: 'FIXTURE_ONLY_API_MARKER' }]));
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_ACTIVE_PROVIDER, 'fixture-provider');
+    service = createPluginHostService({ app: { getAppPath: () => rootPath, getPath: () => directory, getVersion: () => '0.0.0' }, env: {},
+      electron: { ipcMain }, getInteractionWindow: () => mainWindow, isAppLocked: () => false, getTerminalWorkerManager: () => worker });
+    service.runtimeSupervisor.runtimeFactories.browser = inProcessBrowserRuntime; await service.manager.initialize();
+    const sample = path.join(rootPath, 'examples/plugins/global-agent'); const staging = path.join(directory, 'package'); fs.mkdirSync(path.join(staging, 'dist'), { recursive: true });
+    for (const file of ['netcatty.plugin.json', 'panel.html', 'panel.css', 'panel.js', 'README.md']) fs.copyFileSync(path.join(sample, file), path.join(staging, file));
+    fs.copyFileSync(path.join(sample, 'src/index.js'), path.join(staging, 'dist/index.js'));
+    const { buildPluginPackage } = await import('@netcatty/plugin-cli'); const archive = path.join(directory, 'global-agent.ncpkg'); await buildPluginPackage(staging, archive);
+    await service.manager.install(archive, { enable: true });
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAgentHost sessions={[
+      { id: 'synthetic-a', hostId: 'host-a', hostLabel: 'Workspace A fixture', hostname: 'a.invalid', username: 'fixture', status: 'connected' },
+      { id: 'synthetic-b', hostId: 'host-b', hostLabel: 'Workspace B fixture', hostname: 'b.invalid', username: 'fixture', status: 'connected' },
+    ]} /></I18nProvider>));
+    const waitFor = async (condition: () => boolean) => { const until = Date.now() + 8_000; while (!condition()) {
+      if (Date.now() >= until) throw Error(`Global Agent UI fixture timed out; accepted=${counts.requests}, rejected=${counts.rejected}, effects=${workerCalls.length}, status=${panel?.window.document.getElementById('status')?.textContent}`);
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 5)); });
+    } };
+    let viewOpen = true;
+    const mountPanel = async () => {
+      panel = new JSDOM(fs.readFileSync(path.join(sample, 'panel.html'), 'utf8'), { runScripts: 'outside-only' });
+      Object.defineProperty(panel.window, 'netcattyView', { value: { executeCommand: async (name: string, params: unknown) => {
+        // PluginViewHost.close removes sender authority before WebContents
+        // closes. A pagehide RPC cannot be relied on to reach this relay.
+        if (!viewOpen) throw Error('Untrusted plugin view sender');
+        const result = structuredClone(await service!.contributionService.executeCommand(name, structuredClone(params))); pluginReplies.push(result); return result;
+      }, onDidReceiveMessage: () => ({ dispose() {} }), onDidChangeEnvironment: () => ({ dispose() {} }) } });
+      await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
+    };
+    await mountPanel();
+    const element = (id: string) => panel!.window.document.getElementById(id)!;
+    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { for (const checkbox of document.querySelectorAll<HTMLInputElement>('input[type="checkbox"]')) checkbox.click(); });
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click()); await waitFor(() => element('status').textContent!.startsWith('Ready'));
+    let prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic selected-target task';
+    const send = () => element('compose').dispatchEvent(new panel!.window.Event('submit', { cancelable: true }));
+    phase = 'complete'; await act(async () => { send(); }); await waitFor(() => element('status').textContent === 'Complete');
+    assert.deepEqual(workerCalls, ['synthetic-b']); assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
+    assert.equal(mcp.getPermissionMode(), 'observer'); assert.equal(counts.requests, 2); assert.equal(counts.rejected, 0);
+    assert.match(element('usage').textContent!, /input tokens/);
+    phase = 'stop'; prompt.value = 'fixture:wait'; await act(async () => { send(); });
+    await waitFor(() => element('transcript').textContent!.includes('Synthetic waiting output'));
+    await act(async () => element('stop').click()); await waitFor(() => element('status').textContent === 'Stopped' && counts.aborted === 1);
+    const stopped = element('transcript').textContent; await new Promise((resolve) => setTimeout(resolve, 75)); assert.equal(element('transcript').textContent, stopped);
+    phase = 'modal-reopen-history';
+    const reference = pluginReplies.find((value) => value && typeof value === 'object' && 'conversationRef' in value && 'chatHandle' in value) as { conversationRef: string };
+    const beforeReopen = counts.requests;
+    viewOpen = false;
+    panel!.window.dispatchEvent(new panel!.window.Event('pagehide')); panel!.window.close();
+    viewOpen = true; await mountPanel();
+    await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    (element('conversation') as HTMLSelectElement).value = reference.conversationRef;
+    await act(async () => element('conversation').dispatchEvent(new panel!.window.Event('change')));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click());
+    await waitFor(() => /^(Ready|Conversation unavailable)/.test(element('status').textContent!));
+    assert.match(element('status').textContent!, /^Ready/, 'ordinary modal reopen must release the prior exact chat even if pagehide cleanup never reaches the plugin');
+    assert.match(element('transcript').textContent!, /Synthetic global Agent result/);
+    assert.equal(service.agentService.chats.size, 1); assert.equal(counts.requests, beforeReopen, 'history reopen does not invoke a model');
+    prompt = element('prompt') as HTMLTextAreaElement; prompt.value = 'Synthetic continuation';
+    phase = 'deny'; const before = counts.requests; const plugin = service.database.getActivePlugin('com.netcatty.globalagent');
+    service.permissionEngine.setMode(plugin, 'ai.agent.actions', 'deny', service.permissionEngine.getPolicyRevision(plugin));
+    await act(async () => { send(); }); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
+    assert.equal(counts.requests, before); assert.deepEqual(workerCalls, ['synthetic-b']);
+    phase = 'restart-history';
+    await service.manager.setEnabled('com.netcatty.globalagent', false);
+    await service.manager.setEnabled('com.netcatty.globalagent', true);
+    await act(async () => element('refresh').click()); await waitFor(() => element('status').textContent!.startsWith('Choose terminals'));
+    const conversation = element('conversation') as HTMLSelectElement; conversation.value = reference.conversationRef;
+    await act(async () => conversation.dispatchEvent(new panel!.window.Event('change')));
+    await act(async () => element('targets').click()); await waitFor(() => document.querySelectorAll('input[type="checkbox"]').length === 2);
+    await act(async () => { [...document.querySelectorAll('button')].find((button) => button.textContent === 'Use selected terminals')!.click(); });
+    await waitFor(() => element('status').textContent!.startsWith('Targets selected'));
+    await act(async () => element('open').click()); await waitFor(() => element('status').textContent!.startsWith('Ready'));
+    assert.match(element('transcript').textContent!, /Synthetic global Agent result/, 'owned core history survives runtime restart');
+    prompt.value = 'Synthetic model-only continuation'; await act(async () => { send(); });
+    await waitFor(() => element('status').textContent === 'Complete');
+    assert.equal(counts.requests, before + 1, 'Actions Deny allows a tool-free configured model turn after reopening');
+    assert.deepEqual(workerCalls, ['synthetic-b']);
+    phase = 'backend-revision';
+    const latestChat = [...pluginReplies].reverse().find((value) => value && typeof value === 'object' && 'chatHandle' in value) as { chatHandle: string };
+    const generation = service.agentService.host.generation; const requestsBeforeChange = counts.requests;
+    const { LOCAL_STORAGE_ADAPTER_CHANGED_EVENT } = await import('../infrastructure/persistence/localStorageAdapter');
+    dom.window.localStorage.setItem(keys.STORAGE_KEY_AI_ACTIVE_MODEL, 'changed-synthetic-model');
+    await act(async () => window.dispatchEvent(new CustomEvent(LOCAL_STORAGE_ADAPTER_CHANGED_EVENT, { detail: { key: keys.STORAGE_KEY_AI_ACTIVE_MODEL } })));
+    await waitFor(() => service!.agentService.host.generation > generation && service!.agentService.chats.size === 0);
+    await assert.rejects(service.contributionService.executeCommand('com.netcatty.globalagent.history', { chatHandle: latestChat.chatHandle }));
+    assert.equal(counts.requests, requestsBeforeChange, 'configuration invalidation never retries model inference');
+    assert.doesNotMatch(JSON.stringify(pluginReplies), /FIXTURE_ONLY_API_MARKER|apiKey|externalSessionId|plugin-agent:|opaque-owner|mcpServers|permissionMode/);
+    assert.doesNotMatch(JSON.stringify(trustedReplies), /FIXTURE_ONLY_API_MARKER|apiKey/);
+    assert.deepEqual(errors, []);
+  } finally {
+    console.error = originalError;
+    if (panel) { panel.window.dispatchEvent(new panel.window.Event('pagehide')); panel.window.close(); }
+    await act(async () => root.unmount()); await service?.manager.shutdown();
+    mcp.setPermissionMode('confirm'); mcp.cleanup(); aiBridge.cleanup(); privacy.configure({ enabled: false }); registerAppAppLockRuntime(oldLock);
+    server.closeAllConnections(); await new Promise<void>((resolve) => server.close(() => resolve())); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+    if (oldTmp === undefined) delete process.env.TMPDIR; else process.env.TMPDIR = oldTmp;
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});

components/PluginPermissionHost.test.tsx

@@ -100,6 +100,21 @@ test('registered Ask uses one in-app dialog; policy controls apply Allow and Den
     await act(async () => { button('Deny').click(); await displayed; await settle(); });
     await new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
     assert.equal(nativeVisibility.at(-1), true, 'dismissing Ask restores the existing view without closing it');
+    for (const selections of [[], [{ title: 'Synthetic terminal B', scope: 'session', version: 'opaque-worker-revision' }]]) {
+      await act(async () => {
+        displayed = host.request({ requestId: 'agent-empty-args', pluginId: plugin.id, permission: 'ai.agent.actions', resources: ['*'],
+          displayContext: { modelLabel: 'Synthetic configured Catty', action: { capabilityId: 'session.environment', text: '{}', label: 'PLUGIN_SUPPLIED_OPERATION_NAME' }, selections },
+        }); await settle();
+      });
+      const dialog = document.querySelector('[role="dialog"]')!;
+      assert.match(dialog.textContent!, /Operation:.*get_environment/);
+      assert.match(dialog.textContent!, /session\.environment/);
+      assert.equal(dialog.querySelector('pre')!.textContent, '{}');
+      if (selections.length) assert.match(dialog.textContent!, /Targets:.*Synthetic terminal B/);
+      else assert.match(dialog.textContent!, /Targets:.*No targets selected/);
+      assert.doesNotMatch(dialog.textContent!, /opaque-worker-revision|PLUGIN_SUPPLIED_OPERATION_NAME/);
+      await act(async () => { button('Deny').click(); await displayed; await settle(); });
+    }
   } finally {
     await act(async () => root.unmount()); stopVisibility(); host.shutdown(); engine.shutdown(); dom.window.close();
     for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }

components/SettingsPage.tsx

@@ -576,6 +576,8 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
                                 setShowHostTreeSidebar={settings.setShowHostTreeSidebar}
                                 windowOpacity={settings.windowOpacity}
                                 setWindowOpacity={settings.setWindowOpacity}
+                                windowBackgroundBlur={settings.windowBackgroundBlur}
+                                setWindowBackgroundBlur={settings.setWindowBackgroundBlur}
                                 appIconVariant={settings.appIconVariant}
                                 setAppIconVariant={settings.setAppIconVariant}
                             />

components/TextEditorModal.tsx

@@ -64,6 +64,8 @@ interface TextEditorModalProps {
   onClose: () => void;
   fileName: string;
   initialContent: string;
+  /** Full path for language detection; the title still uses fileName. */
+  filePath?: string;
   onSave: (content: string) => Promise<void>;
   editorWordWrap: boolean;
   onToggleWordWrap: () => void;
@@ -79,6 +81,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
   open,
   onClose,
   fileName,
+  filePath,
   initialContent,
   onSave,
   editorWordWrap,
@@ -94,7 +97,7 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
   const [baselineContent, setBaselineContent] = useState(initialContent);
   const [saving, setSaving] = useState(false);
   const [saveError, setSaveError] = useState<string | null>(null);
-  const [languageId, setLanguageId] = useState(() => getLanguageId(fileName));
+  const [languageId, setLanguageId] = useState(() => getLanguageId(filePath ?? fileName));
   const contentRef = useRef(initialContent);
   const baselineContentRef = useRef(initialContent);
   const savingRef = useRef(false);
@@ -149,13 +152,13 @@ const TextEditorModal: React.FC<TextEditorModalProps> = ({
     setBaselineContent(initialContent);
     setSaveError(null);
     setSaving(false);
-    setLanguageId(getLanguageId(fileName));
+    setLanguageId(getLanguageId(filePath ?? fileName));
     contentRef.current = initialContent;
     baselineContentRef.current = initialContent;
     savingRef.current = false;
     closePromptRef.current = null;
     viewStateRef.current = null;
-  }, [initialContent, fileName]);
+  }, [initialContent, fileName, filePath]);
 
   const saveContent = useCallback(async (contentToSave = contentRef.current): Promise<boolean> => {
     return saveCoordinatorRef.current?.save(contentToSave) ?? false;

components/ai/ChatInput.test.tsx

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import React from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
 
-import ChatInput from './ChatInput';
+import ChatInput, { replaceSlashQueryWithCommand, replaceSlashQueryWithRename } from './ChatInput';
 import {
   CHAT_INPUT_MAX_HEIGHT,
   CHAT_INPUT_MIN_HEIGHT,
@@ -217,9 +217,46 @@ test('renders the Catty context usage ring after the model chip', () => {
   assert.match(html, /aria-valuenow="50"/);
 });
 
+test('selecting rename completes a partial slash query without sending', () => {
+  assert.equal(replaceSlashQueryWithRename('/ren', { start: 0, end: 4 }), '/rename ');
+  assert.equal(replaceSlashQueryWithRename('/', { start: 0, end: 1 }), '/rename ');
+  assert.equal(replaceSlashQueryWithRename('before /ren after', { start: 7, end: 11 }), 'before /rename  after');
+  assert.equal(replaceSlashQueryWithRename('old text', null), '/rename ');
+
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  const branch = source.slice(source.indexOf("if (command === 'rename')"), source.indexOf("commitComposerText('');", source.indexOf("if (command === 'rename')")));
+  assert.match(branch, /commitComposerText\(replaceSlashQueryWithRename\(readComposerText\(\), slashRange\)\)/);
+  assert.match(branch, /closeAllMenus\(\);[\s\S]*?return;/);
+  assert.doesNotMatch(branch, /onSend/);
+});
+
+test('selecting rebind completes a partial slash query without sending', () => {
+  assert.equal(replaceSlashQueryWithCommand('/re', { start: 0, end: 3 }, 'rebind'), '/rebind ');
+  assert.equal(replaceSlashQueryWithCommand('/', { start: 0, end: 1 }, 'rebind'), '/rebind ');
+  assert.equal(replaceSlashQueryWithCommand('before /re after', { start: 7, end: 10 }, 'rebind'), 'before /rebind  after');
+  assert.equal(replaceSlashQueryWithCommand('old text', null, 'rebind'), '/rebind ');
+
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  const branch = source.slice(source.indexOf("if (command === 'rebind')"), source.indexOf("if (command === 'rename')"));
+  assert.match(branch, /commitComposerText\(replaceSlashQueryWithCommand\(readComposerText\(\), slashRange, 'rebind'\)\)/);
+  assert.match(branch, /closeAllMenus\(\);[\s\S]*?return;/);
+  assert.doesNotMatch(branch, /onSend/);
+});
+
 test('slash picker system commands clear the local composer', () => {
   const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
-  assert.match(source, /if \(command === 'stop'\) onStop\?\.\(\);\s*commitComposerText\(''\);/s);
+  // /stop falls through to the shared clear; /rename, /chats and /rebind have
+  // their own branches above it (rename/rebind keep the composer so the user
+  // can type an argument).
+  assert.match(source, /if \(command === 'stop'\) onStop\?\.\(\);[\s\S]*?commitComposerText\(''\);/);
+  assert.match(source, /if \(command === 'chats'\) onListChats\?\.\(\);/);
+  assert.match(source, /if \(command === 'rename'\) \{[\s\S]*?closeAllMenus\(\);[\s\S]*?return;/);
+  assert.match(source, /if \(command === 'rebind'\) \{[\s\S]*?closeAllMenus\(\);[\s\S]*?return;/);
+});
+
+test('/rebind routes its argument to onRebindChat as a panel action', () => {
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  assert.match(source, /if \(systemCommand === 'rebind'\) \{[\s\S]*?onRebindChat\?\.\(getRebindSlashCommandArg\(submittedText\)\);/);
 });
 
 test('keeps thinking on a separate chip instead of mixing it into the model list', () => {
@@ -333,6 +370,25 @@ test('ChatInput wires /compact through getSystemSlashCommand and canCompact', ()
   assert.match(source, /command\.slug !== 'compact' \|\| canCompact/);
 });
 
+test('ChatInput intercepts /rename and /chats as panel actions before onSend', () => {
+  const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
+  // The interception happens in handleSubmit's system-command branch, which
+  // returns before onSend() — the commands never reach the agent.
+  assert.match(source, /systemCommand === 'rename'/);
+  assert.match(source, /systemCommand === 'chats'/);
+  assert.match(source, /onRenameSession\?\.\(getRenameSlashCommandTitle\(submittedText\)\)/);
+  assert.match(source, /onListChats\?\.\(\)/);
+  // Both commands clear the composer instead of falling through to onSend.
+  const renameBranchStart = source.indexOf("systemCommand === 'rename'");
+  const renameBranchEnd = source.indexOf('if (isStreaming && canSteer)', renameBranchStart);
+  const renameBranch = source.slice(renameBranchStart, renameBranchEnd);
+  assert.match(renameBranch, /commitComposerText\(''\)/);
+  assert.doesNotMatch(renameBranch, /onSend\(\)/);
+  // The slash picker registers the built-ins and keeps /rename text editable.
+  assert.match(source, /command === 'rename'/);
+  assert.match(source, /command === 'chats'/);
+});
+
 test('renders a Mention Note picker entry with a searchable note list', () => {
   const source = readFileSync(new URL('./ChatInput.tsx', import.meta.url), 'utf8');
 

components/ai/ChatInput.tsx

@@ -33,6 +33,8 @@ import {
   filterQuickMessages,
   filterSystemSlashCommands,
   filterUserSkillsForSlash,
+  getRebindSlashCommandArg,
+  getRenameSlashCommandTitle,
   getSlashCommandItemKey,
   getSystemSlashCommand,
   SYSTEM_BUILTIN_SLASH_COMMANDS,
@@ -80,6 +82,19 @@ const MENU_VIEWPORT_GUTTER = 8;
 const CONTEXT_USAGE_RING_RADIUS = 10;
 const CONTEXT_USAGE_RING_CIRCUMFERENCE = 2 * Math.PI * CONTEXT_USAGE_RING_RADIUS;
 
+export function replaceSlashQueryWithCommand(
+  text: string,
+  range: { start: number; end: number } | null,
+  command: string,
+): string {
+  const replacement = `/${command} `;
+  return range ? `${text.slice(0, range.start)}${replacement}${text.slice(range.end)}` : replacement;
+}
+
+export function replaceSlashQueryWithRename(text: string, range: { start: number; end: number } | null): string {
+  return replaceSlashQueryWithCommand(text, range, 'rename');
+}
+
 function formatContextTokens(tokens: number): string {
   if (tokens >= 1_000_000) return `${(tokens / 1_000_000).toFixed(1)}M`;
   if (tokens >= 1_000) return `${(tokens / 1_000).toFixed(tokens >= 100_000 ? 0 : 1)}K`;
@@ -266,6 +281,12 @@ interface ChatInputProps {
   onThinkingLevelChange?: (level: string) => void;
   /** Hidden retained panels must not leave body-portaled menus open. */
   parked?: boolean;
+  /** `/rename <title>`: rename the current chat (panel action, never sent to the agent). */
+  onRenameSession?: (title: string) => void;
+  /** `/chats`: list the chats visible to this panel (panel action, never sent to the agent). */
+  onListChats?: () => void;
+  /** `/rebind <n>`: rebind a dangling chat to this panel's scope (panel action, never sent to the agent). */
+  onRebindChat?: (arg: string) => void;
 }
 
 const ChatInput: React.FC<ChatInputProps> = ({
@@ -313,6 +334,9 @@ const ChatInput: React.FC<ChatInputProps> = ({
   thinkingLevel,
   onThinkingLevelChange,
   parked = false,
+  onRenameSession,
+  onListChats,
+  onRebindChat,
 }) => {
   const { t } = useI18n();
   const hasTerminalSelectionAttachment = files.some((file) => file.terminalSelection || file.vaultNoteId);
@@ -750,6 +774,20 @@ const ChatInput: React.FC<ChatInputProps> = ({
         onCompact?.();
       }
       if (command === 'stop') onStop?.();
+      if (command === 'chats') onListChats?.();
+      if (command === 'rebind') {
+        // Replace a partial slash query (e.g. `/re`) with `/rebind ` so the
+        // user can finish the dangling-chat number; never leave `/re 1` to
+        // be sent to the agent.
+        commitComposerText(replaceSlashQueryWithCommand(readComposerText(), slashRange, 'rebind'));
+        closeAllMenus();
+        return;
+      }
+      if (command === 'rename') {
+        commitComposerText(replaceSlashQueryWithRename(readComposerText(), slashRange));
+        closeAllMenus();
+        return;
+      }
       commitComposerText('');
       closeAllMenus();
       return;
@@ -759,7 +797,7 @@ const ChatInput: React.FC<ChatInputProps> = ({
       return;
     }
     insertUserSkillToken(item.skill);
-  }, [canCompact, closeAllMenus, commitComposerText, insertQuickMessage, insertUserSkillToken, onCompact, onStop]);
+  }, [canCompact, closeAllMenus, commitComposerText, insertQuickMessage, insertUserSkillToken, onCompact, onListChats, onStop, readComposerText, slashRange]);
 
   // Reset active highlight when a menu opens or when the *identity* of the
   // visible items changes. Watching only `.length` misses cases where the
@@ -962,6 +1000,21 @@ const ChatInput: React.FC<ChatInputProps> = ({
           commitComposerText('');
           return;
         }
+        if (systemCommand === 'rename') {
+          onRenameSession?.(getRenameSlashCommandTitle(submittedText));
+          commitComposerText('');
+          return;
+        }
+        if (systemCommand === 'chats') {
+          onListChats?.();
+          commitComposerText('');
+          return;
+        }
+        if (systemCommand === 'rebind') {
+          onRebindChat?.(getRebindSlashCommandArg(submittedText));
+          commitComposerText('');
+          return;
+        }
         return;
       }
       if (isStreaming && canSteer) {
@@ -972,7 +1025,7 @@ const ChatInput: React.FC<ChatInputProps> = ({
       // abort; the parent clears value only after the user message is accepted.
       onSend();
     },
-    [canCompact, canSteer, commitComposerText, isStreaming, onCompact, onSend, onSteer, onStop, readComposerText],
+    [canCompact, canSteer, commitComposerText, isStreaming, onCompact, onListChats, onRebindChat, onRenameSession, onSend, onSteer, onStop, readComposerText],
   );
 
   const status: PromptInputStatus = isStreaming ? 'streaming' : 'idle';

components/ai/aiChatsListing.test.ts

@@ -0,0 +1,186 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import type { AISession, ExternalAgentConfig } from '../../infrastructure/ai/types.ts';
+import {
+  buildAiChatsListingEntries,
+  canRebindChat,
+  formatAiChatsListingNote,
+  resolveChatAgentLabel,
+  resolveRebindTargetFromArg,
+  truncateChatTitle,
+} from './aiChatsListing.ts';
+
+test('rebind revalidates cached entries against current sessions and live targets', () => {
+  const liveTargets = new Set(['ws-live', 'term-live']);
+  assert.equal(canRebindChat(undefined, liveTargets), false);
+  assert.equal(canRebindChat(createSession('restored', { scope: { type: 'workspace', targetId: 'ws-live' } }), liveTargets), false);
+  assert.equal(canRebindChat(createSession('restored-terminal', { scope: { type: 'terminal', targetId: 'term-live' } }), liveTargets), false);
+  assert.equal(canRebindChat(createSession('dangling', { scopeDangling: true, scope: { type: 'workspace', targetId: 'ws-old' } }), liveTargets), true);
+  assert.equal(canRebindChat(createSession('unbound', { scope: { type: 'terminal', targetId: 'term-old' } }), liveTargets), true);
+});
+
+function createSession(
+  id: string,
+  overrides: Partial<AISession> = {},
+): AISession {
+  return {
+    id,
+    title: id,
+    agentId: 'catty',
+    scope: { type: 'workspace', targetId: 'ws-1' },
+    messages: [],
+    createdAt: 1_000,
+    updatedAt: 1_000,
+    ...overrides,
+  };
+}
+
+const t = (key: string) => key;
+const externalAgents: ExternalAgentConfig[] = [
+  { id: 'claude', name: 'Claude Code' } as ExternalAgentConfig,
+];
+
+function buildEntries(sessions: AISession[], activeSessionId: string | null = 's-live') {
+  return buildAiChatsListingEntries({
+    sessions,
+    activeSessionId,
+    externalAgents,
+    workspaces: [{ id: 'ws-1', title: 'Web farm' }],
+    liveTerminalIds: new Set(['term-1']),
+    scopeTargetId: 'ws-1',
+    t,
+  });
+}
+
+test('/chats listing marks the live workspace chat, terminal chat and dangling chat', () => {
+  const now = Date.now();
+  const sessions = [
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' }, updatedAt: now }),
+    createSession('s-term', { scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude', updatedAt: now }),
+    createSession('s-dangling', { scope: { type: 'workspace', targetId: 'ws-gone' }, updatedAt: now }),
+  ];
+
+  const entries = buildEntries(sessions);
+  assert.equal(entries.length, 3);
+
+  assert.equal(entries[0].isCurrent, true);
+  assert.equal(entries[0].agentLabel, 'Catty Agent');
+  assert.equal(entries[0].scopeLabel, 'ai.chat.chatsScopeWorkspace: Web farm');
+  assert.equal(entries[0].isDangling, false);
+
+  assert.equal(entries[1].isCurrent, false);
+  assert.equal(entries[1].agentLabel, 'Claude Code');
+  assert.equal(entries[1].scopeLabel, 'ai.chat.chatsScopeTerminal');
+  assert.equal(entries[1].isDangling, false);
+
+  assert.equal(entries[2].isDangling, true);
+  assert.equal(entries[2].scopeLabel, 'ai.chat.chatsScopeDangling');
+});
+
+test('/chats listing numbers dangling entries for /rebind and leaves live ones unnumbered', () => {
+  const sessions = [
+    createSession('s-dangling-a', { scope: { type: 'workspace', targetId: 'ws-gone-a' } }),
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' } }),
+    createSession('s-dangling-b', { scope: { type: 'terminal', targetId: 'term-gone' } }),
+    createSession('s-dangling-c', { scope: { type: 'workspace', targetId: 'ws-gone-b' } }),
+  ];
+
+  const entries = buildEntries(sessions, null);
+  assert.deepEqual(
+    entries.map((entry) => entry.rebindNumber ?? 0),
+    [1, 0, 2, 3],
+  );
+});
+
+test('/chats listing falls back to the panel scope label for the current workspace', () => {
+  const sessions = [
+    createSession('s-live', { scope: { type: 'workspace', targetId: 'ws-1' } }),
+  ];
+  const entries = buildAiChatsListingEntries({
+    sessions,
+    activeSessionId: 's-live',
+    externalAgents,
+    workspaces: [],
+    liveTerminalIds: new Set<string>(),
+    currentScopeLabel: 'Web farm',
+    scopeTargetId: 'ws-1',
+    t,
+  });
+  assert.equal(entries[0].isDangling, false);
+  assert.equal(entries[0].scopeLabel, 'ai.chat.chatsScopeWorkspace: Web farm');
+});
+
+test('/chats note renders header, current marker and one line per chat', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-term', { title: 'Logs', scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude' }),
+    createSession('s-dangling', { title: 'Old', scope: { type: 'workspace', targetId: 'ws-gone' } }),
+  ];
+  const entries = buildEntries(sessions);
+  const note = formatAiChatsListingNote(entries, t);
+  const lines = note.split('\n');
+  assert.equal(lines[0], 'ai.chat.chatsHeader');
+  // Three chat lines plus the dangling rebind hint.
+  assert.equal(lines.length, 5);
+  assert.match(lines[1], /^• Fix deploy — Catty Agent · /);
+  assert.match(lines[2], /^ {2}Logs — Claude Code · /);
+  assert.match(lines[3], /ai\.chat\.chatsScopeDangling/);
+  assert.ok(!lines[3].startsWith('•'));
+  // The dangling line carries an inline rebind affordance, and the note
+  // explains it.
+  assert.match(lines[3], /\/rebind 1/);
+  assert.equal(lines[4], 'ai.chat.chatsRebindHint');
+});
+
+test('/chats note omits the rebind hint when nothing is dangling', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-term', { title: 'Logs', scope: { type: 'terminal', targetId: 'term-1' }, agentId: 'claude' }),
+  ];
+  const entries = buildEntries(sessions);
+  const note = formatAiChatsListingNote(entries, t);
+  assert.ok(!note.includes('rebind'));
+});
+
+test('resolveRebindTargetFromArg picks only dangling entries by their number', () => {
+  const sessions = [
+    createSession('s-live', { title: 'Fix deploy' }),
+    createSession('s-dangling', { title: 'Old', scope: { type: 'workspace', targetId: 'ws-gone' } }),
+    createSession('s-dangling-2', { title: 'Older', scope: { type: 'terminal', targetId: 'term-gone' } }),
+  ];
+  const entries = buildEntries(sessions);
+  const dangling = entries.find((entry) => entry.isDangling);
+  assert.ok(dangling);
+
+  assert.equal(resolveRebindTargetFromArg('1', entries)?.sessionId, 's-dangling');
+  assert.equal(resolveRebindTargetFromArg(' 2 ', entries)?.sessionId, entries.filter((entry) => entry.isDangling)[1].sessionId);
+  assert.equal(resolveRebindTargetFromArg('3', entries), null);
+  assert.equal(resolveRebindTargetFromArg('1foo', entries), null);
+  assert.equal(resolveRebindTargetFromArg('1.5', entries), null);
+  assert.equal(resolveRebindTargetFromArg('0', entries), null);
+  assert.equal(resolveRebindTargetFromArg('-1', entries), null);
+  assert.equal(resolveRebindTargetFromArg('', entries), null);
+  assert.equal(resolveRebindTargetFromArg('abc', entries), null);
+  // A live entry is not rebindable even if its position would match.
+  assert.equal(resolveRebindTargetFromArg('1', [entries[0]]), null);
+});
+
+test('/chats note reports an empty panel', () => {
+  assert.equal(formatAiChatsListingNote([], t), 'ai.chat.chatsEmpty');
+});
+
+test('truncateChatTitle clamps long titles and keeps short ones intact', () => {
+  assert.equal(truncateChatTitle('short'), 'short');
+  assert.equal(truncateChatTitle('  '), '');
+  const long = 'x'.repeat(80);
+  const truncated = truncateChatTitle(long);
+  assert.equal(truncated.length, 42);
+  assert.ok(truncated.endsWith('…'));
+});
+
+test('resolveChatAgentLabel resolves external agents and falls back to the raw id', () => {
+  assert.equal(resolveChatAgentLabel('catty', externalAgents), 'Catty Agent');
+  assert.equal(resolveChatAgentLabel('claude', externalAgents), 'Claude Code');
+  assert.equal(resolveChatAgentLabel('mystery', externalAgents), 'mystery');
+});

components/ai/aiChatsListing.ts

@@ -0,0 +1,161 @@
+import type { AISession, ExternalAgentConfig } from '../../infrastructure/ai/types';
+import { formatRelativeTime } from '../AIChatSessionHistoryDrawer';
+
+/**
+ * Pure builder for the `/chats` panel note. Kept separate from the component
+ * so a future rebind action (issue #4015 R2) can attach per-entry actions
+ * without reworking the text rendering.
+ */
+
+export interface AiChatsListingInput {
+  /** Rank-sorted sessions visible to the current panel scope. */
+  sessions: AISession[];
+  activeSessionId: string | null;
+  externalAgents: ExternalAgentConfig[];
+  /** Live workspaces, used to resolve workspace scope titles. */
+  workspaces: Array<{ id: string; title: string }>;
+  /** Live terminal session ids visible to this panel. */
+  liveTerminalIds: Iterable<string>;
+  /** Fallback scope label for the panel's own scope (e.g. current workspace title). */
+  currentScopeLabel?: string;
+  scopeTargetId?: string;
+  t: (key: string) => string;
+}
+
+export interface AiChatsListingEntry {
+  sessionId: string;
+  title: string;
+  agentLabel: string;
+  scopeLabel: string;
+  /** Scope target no longer resolves to a live workspace/terminal. */
+  isDangling: boolean;
+  /** 1-based number among dangling entries, used by `/rebind <n>`. */
+  rebindNumber?: number;
+  isCurrent: boolean;
+  relativeTime: string;
+}
+
+const TITLE_TRUNCATE = 42;
+
+export function truncateChatTitle(title: string): string {
+  const trimmed = title.trim() || '';
+  if (trimmed.length <= TITLE_TRUNCATE) return trimmed;
+  return `${trimmed.slice(0, TITLE_TRUNCATE - 1)}…`;
+}
+
+export function resolveChatAgentLabel(
+  agentId: string,
+  externalAgents: ExternalAgentConfig[],
+): string {
+  if (agentId === 'catty') return 'Catty Agent';
+  return externalAgents.find((agent) => agent.id === agentId)?.name ?? agentId;
+}
+
+export function buildAiChatsListingEntries(input: AiChatsListingInput): AiChatsListingEntry[] {
+  const {
+    sessions,
+    activeSessionId,
+    externalAgents,
+    workspaces,
+    liveTerminalIds,
+    scopeTargetId,
+    t,
+  } = input;
+  const workspaceTitles = new Map(workspaces.map((workspace) => [workspace.id, workspace.title]));
+  const liveTerminals = new Set(liveTerminalIds);
+
+  const entries: AiChatsListingEntry[] = sessions.map((session) => {
+    const isCurrent = session.id === activeSessionId;
+    let scopeLabel = '';
+    let isDangling = false;
+    if (session.scope.type === 'workspace') {
+      const title = workspaceTitles.get(session.scope.targetId ?? '');
+      if (title != null) {
+        scopeLabel = `${t('ai.chat.chatsScopeWorkspace')}: ${title}`;
+      } else {
+        // The panel's own scope may be labelled by the parent even when the
+        // workspace store has not been threaded through; treat the active
+        // scope target as live.
+        if (isCurrent && session.scope.targetId === scopeTargetId && input.currentScopeLabel) {
+          scopeLabel = `${t('ai.chat.chatsScopeWorkspace')}: ${input.currentScopeLabel}`;
+        } else {
+          isDangling = true;
+          scopeLabel = t('ai.chat.chatsScopeDangling');
+        }
+      }
+    } else if (session.scope.type === 'terminal') {
+      if (liveTerminals.has(session.scope.targetId ?? '')) {
+        scopeLabel = t('ai.chat.chatsScopeTerminal');
+      } else {
+        isDangling = true;
+        scopeLabel = t('ai.chat.chatsScopeDangling');
+      }
+    } else {
+      scopeLabel = t('ai.chat.chatsScopeGlobal');
+    }
+
+    return {
+      sessionId: session.id,
+      title: truncateChatTitle(session.title || t('ai.chat.untitled')),
+      agentLabel: resolveChatAgentLabel(session.agentId, externalAgents),
+      scopeLabel,
+      isDangling,
+      isCurrent,
+      relativeTime: formatRelativeTime(new Date(session.updatedAt), t),
+    };
+  });
+
+  // Number the dangling entries so the note can advertise `/rebind <n>`.
+  let danglingCounter = 0;
+  for (const entry of entries) {
+    if (!entry.isDangling) continue;
+    danglingCounter += 1;
+    entry.rebindNumber = danglingCounter;
+  }
+
+  return entries;
+}
+
+/**
+ * Resolve a `/rebind <n>` argument against a `/chats` listing. Only dangling
+ * entries are rebindable; a non-dangling target (or a bad index) yields null.
+ */
+export function resolveRebindTargetFromArg(
+  arg: string,
+  entries: AiChatsListingEntry[],
+): AiChatsListingEntry | null {
+  const trimmed = arg.trim();
+  if (!/^\d+$/.test(trimmed)) return null;
+  const index = Number.parseInt(trimmed, 10);
+  if (!Number.isInteger(index) || index < 1) return null;
+  const dangling = entries.filter((entry) => entry.isDangling);
+  return dangling[index - 1] ?? null;
+}
+
+/** Revalidate a cached listing entry against the current session and live scopes. */
+export function canRebindChat(session: AISession | undefined, liveScopeTargetIds: ReadonlySet<string>): boolean {
+  if (!session) return false;
+  return !!session.scopeDangling || !session.scope.targetId || !liveScopeTargetIds.has(session.scope.targetId);
+}
+
+export function formatAiChatsListingNote(
+  entries: AiChatsListingEntry[],
+  t: (key: string) => string,
+): string {
+  if (entries.length === 0) {
+    return t('ai.chat.chatsEmpty');
+  }
+  let hasDangling = false;
+  const lines = entries.map((entry) => {
+    const marker = entry.isCurrent ? '•' : ' ';
+    const rebindHint = entry.isDangling && entry.rebindNumber != null
+      ? ` · /rebind ${entry.rebindNumber}`
+      : '';
+    if (entry.isDangling) hasDangling = true;
+    return `${marker} ${entry.title} — ${entry.agentLabel} · ${entry.scopeLabel} · ${entry.relativeTime}${rebindHint}`;
+  });
+  if (hasDangling) {
+    lines.push(t('ai.chat.chatsRebindHint'));
+  }
+  return [t('ai.chat.chatsHeader'), ...lines].join('\n');
+}

components/editor/TextEditorPane.test.tsx

@@ -8,6 +8,7 @@ import {
   getTextEditorContentStats,
   isTextEditorCommandWEnabled,
   isTextEditorReadOnly,
+  languageIdToMonaco,
   TextEditorPromoteButton,
 } from "./TextEditorPane.tsx";
 import { TooltipProvider } from "../ui/tooltip.tsx";
@@ -16,6 +17,11 @@ import { DEFAULT_KEY_BINDINGS } from "../../domain/models/keyBindings.ts";
 const wrap = (child: React.ReactElement) =>
   React.createElement(TooltipProvider, null, child);
 
+test("maps manual Nginx selection to the registered language", () => {
+  assert.equal(languageIdToMonaco('nginx'), 'nginx');
+  assert.equal(languageIdToMonaco('ini'), 'ini');
+});
+
 test("disables promoting a modal editor to a tab while a save is running", () => {
   assert.equal(canPromoteTextEditor({ saving: true }), false);
   assert.equal(canPromoteTextEditor({ saving: false }), true);

components/editor/TextEditorPane.tsx

@@ -30,6 +30,7 @@ import { useClipboardBackend } from '../../application/state/useClipboardBackend
 import { isPrimaryModifierWBinding } from '../../application/state/windowCommandClose';
 import { HotkeyScheme, KeyBinding, matchesKeyBinding } from '../../domain/models';
 import { pasteForMonacoEditorCommand } from '../../infrastructure/monaco/monacoClipboardPaste';
+import { registerNginxLanguage } from '../../infrastructure/monaco/nginxLanguage';
 import { useNetcattyMonacoTheme } from '../../infrastructure/monaco/useNetcattyMonacoTheme';
 import { getLanguageName, getSupportedLanguages } from '../../lib/sftpFileUtils';
 import { Button } from '../ui/button';
@@ -37,7 +38,7 @@ import { Combobox } from '../ui/combobox';
 import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip';
 
 // Map our language IDs to Monaco language IDs
-const languageIdToMonaco = (langId: string): string => {
+export const languageIdToMonaco = (langId: string): string => {
   const mapping: Record<string, string> = {
     'javascript': 'javascript',
     'typescript': 'typescript',
@@ -73,6 +74,7 @@ const languageIdToMonaco = (langId: string): string => {
     'yaml': 'yaml',
     'toml': 'ini',
     'ini': 'ini',
+    'nginx': 'nginx',
     'sql': 'sql',
     'graphql': 'graphql',
     'markdown': 'markdown',
@@ -512,6 +514,7 @@ const TextEditorPaneInner: React.FC<TextEditorPaneProps> = ({
           language={monacoLanguage}
           value={content}
           onChange={handleEditorChange}
+          beforeMount={registerNginxLanguage}
           onMount={handleEditorMount}
           theme={customThemeName}
           loading={

components/plugins/PluginAgentHost.tsx

@@ -0,0 +1,26 @@
+import React, { useState } from 'react';
+import type { TerminalSession } from '../../domain/models';
+import { usePluginAgentHost } from '../../application/state/usePluginAgentHost';
+import { Button } from '../ui/button';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
+
+export function PluginAgentHost({ sessions }: { sessions: TerminalSession[] }) {
+  const { choice } = usePluginAgentHost(sessions);
+  const [selected, setSelected] = useState<string[]>([]);
+  return <Dialog open={choice !== null} onOpenChange={(open) => { if (!open) choice?.cancel(); }}>
+    <DialogContent data-host-security-surface="" onOpenAutoFocus={() => setSelected([])}>
+      <DialogHeader><DialogTitle>Choose terminals for this Agent conversation</DialogTitle>
+        <DialogDescription>The conversation is independent of the active tab or workspace. Only the terminals selected here are eligible targets. Tool actions follow this plugin's Allow / Ask / Deny setting.</DialogDescription></DialogHeader>
+      <div className="max-h-72 space-y-2 overflow-y-auto">
+        {choice?.items.map((item) => <label key={item.sessionId} className="flex gap-2 text-sm">
+          <input type="checkbox" checked={selected.includes(item.sessionId)} disabled={selected.length >= 32 && !selected.includes(item.sessionId)}
+            onChange={(event) => setSelected((ids) => event.target.checked ? [...ids, item.sessionId] : ids.filter((id) => id !== item.sessionId))} />
+          <span>{item.label} <span className="text-muted-foreground">{item.hostname}</span></span>
+        </label>)}
+        {choice?.items.length === 0 && <p className="text-sm text-muted-foreground">No connected terminals. You can continue without targets.</p>}
+      </div>
+      <DialogFooter><Button variant="outline" onClick={() => choice?.cancel()}>Cancel</Button>
+        <Button onClick={() => choice?.confirm(selected)}>Use selected terminals</Button></DialogFooter>
+    </DialogContent>
+  </Dialog>;
+}

components/plugins/PluginAuthorRow.tsx

@@ -0,0 +1,26 @@
+import React, { useState } from 'react';
+import { UserRound } from 'lucide-react';
+import { usePluginAuthorIdentity } from '../../application/state/usePluginAuthorIdentity';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { Badge } from '../ui/badge';
+
+export function PluginAuthorRow({ entry, plugin, sourceId }: {
+  entry?: NetcattyPluginCatalogEntry; plugin?: NetcattyInstalledPlugin; sourceId?: string;
+}) {
+  const { t } = useI18n();
+  const { ref, identity } = usePluginAuthorIdentity({ entry, plugin, sourceId });
+  const [failed, setFailed] = useState<string | null>(null);
+  const author = identity?.author ?? entry?.author ?? plugin?.manifest?.publisher ?? '';
+  const imageKey = JSON.stringify([entry?.id, entry?.selectionToken, plugin?.id, plugin?.activeVersion, plugin?.archiveSha256, sourceId, identity?.avatar]);
+  const avatar = identity?.avatar;
+  const showImage = avatar && avatar.length <= 700_000 && /^data:image\/png;base64,[A-Za-z0-9+/]+={0,2}$/.test(avatar) && failed !== imageKey;
+  return <div ref={ref} className="flex min-w-0 items-center gap-2 text-xs text-muted-foreground" data-plugin-author-row>
+    <span className="inline-flex h-5 w-5 shrink-0 items-center justify-center overflow-hidden rounded-full bg-muted/60" aria-hidden="true">
+      {showImage ? <img src={avatar} alt="" width={20} height={20} className="h-full w-full object-cover" onError={() => setFailed(imageKey)} />
+        : <UserRound size={13} data-plugin-author-placeholder />}
+    </span>
+    <span className="min-w-0 truncate" title={author}>{author}</span>
+    {identity?.officialMaintained === true && <Badge className="shrink-0 whitespace-nowrap border-0 bg-amber-500/15 px-2 py-0.5 text-[10px] font-medium text-amber-800 hover:bg-amber-500/15 dark:bg-amber-400/15 dark:text-amber-300 dark:hover:bg-amber-400/15"
+      title={t('settings.plugins.author.officialMeaning')} data-plugin-official-maintainer>{t('settings.plugins.author.official')}</Badge>}
+  </div>;
+}

components/plugins/PluginPermissionHost.tsx

@@ -3,6 +3,7 @@ import { useI18n } from '../../application/i18n/I18nProvider';
 import { describePluginPermission } from '@/domain/pluginPermissionDescriptions.cjs';
 import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
 import { Button } from '../ui/button';
+import globalAgentToolSpecs from '../../infrastructure/ai/harness/generated/globalAgentToolSpecs.json';
 
 /** Rendered only by the trusted app, never inside a plugin view. */
 export function PluginPermissionHost() {
@@ -12,6 +13,9 @@ export function PluginPermissionHost() {
   if (!prompt) return null;
   const description = describePluginPermission(prompt.permission, resolvedLocale);
   const resources = prompt.resources.filter((resource) => resource !== '*' && !resource.startsWith('selected:'));
+  const action = prompt.displayContext?.action;
+  const operation = action && (globalAgentToolSpecs.find((tool) => tool.capabilityId === action.capabilityId)?.toolName ?? action.capabilityId);
+  const selections = prompt.displayContext?.selections ?? [];
   return <Dialog open onOpenChange={(open) => { if (!open) void respond('cancel'); }}>
     <DialogContent data-host-security-surface="" className="max-h-[85vh] overflow-y-auto sm:max-w-[480px]">
       <DialogHeader>
@@ -20,9 +24,17 @@ export function PluginPermissionHost() {
       </DialogHeader>
       <p className="text-sm">{description.description}</p>
       {prompt.displayContext?.modelLabel && <p className="text-sm break-words">{zh ? '模型' : 'Model'}: {prompt.displayContext.modelLabel}</p>}
-      {(prompt.displayContext?.selections ?? []).map((item, index) => <p key={index} className="text-sm break-words">
-        {item.title} <span className="text-xs text-muted-foreground">· {item.scope}</span>
-      </p>)}
+      {action && <div className="space-y-1">
+        <p className="text-sm break-words">{zh ? '操作' : 'Operation'}: <code>{operation}</code>{operation !== action.capabilityId && <> ({action.capabilityId})</>}</p>
+        <p className="text-sm">{zh ? '请求内容（控制字符以转义形式显示）' : 'Requested action (control characters shown as escapes)'}</p>
+        <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words rounded border border-border p-2 text-xs">{action.text}</pre>
+      </div>}
+      {(selections.length > 0 || prompt.permission === 'ai.agent.actions') && <div className="space-y-1">
+        <p className="text-sm">{zh ? '目标' : 'Targets'}:{selections.length === 0 && (zh ? ' 未选择目标' : ' No targets selected')}</p>
+        {selections.map((item, index) => <p key={index} className="text-sm break-words">
+          {item.title} <span className="text-xs text-muted-foreground">· {item.scope}</span>
+        </p>)}
+      </div>}
       {(prompt.relatedPermissions ?? []).filter((item, index, items) => items.findIndex((other) => other.permission === item.permission) === index).map((item, index) => <div key={index} className="space-y-1 text-sm">
         <p>{describePluginPermission(item.permission, resolvedLocale).description}</p>
         <p className="text-xs text-muted-foreground break-all">{item.resources.filter((resource) => !resource.startsWith('selected:')).join(', ')}</p>

components/settings/settings-ui.tsx

@@ -203,6 +203,7 @@ export const SettingCard: React.FC<SettingCardProps> = ({
 interface SettingRowProps {
   leading?: React.ReactNode;
   label?: React.ReactNode;
+  className?: string;
   description?: React.ReactNode;
   children: React.ReactNode;
   align?: "center" | "start";
@@ -213,6 +214,7 @@ interface SettingRowProps {
 export const SettingRow: React.FC<SettingRowProps> = ({
   leading,
   label,
+  className,
   description,
   children,
   align = "center",
@@ -225,6 +227,7 @@ export const SettingRow: React.FC<SettingRowProps> = ({
       // Keep square corners: rounded rows bend divide-y separators at both ends.
       "flex justify-between py-3 gap-4",
       align === "start" ? "items-start" : "items-center",
+      className,
     )}
   >
     {leading && <div className="shrink-0">{leading}</div>}

components/settings/tabs/PluginAuthorIdentityRefresh.test.tsx

@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { JSDOM } from 'jsdom';
+import { EventEmitter } from 'node:events';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+import { usePluginAuthorIdentity } from '../../../application/state/usePluginAuthorIdentity';
+import { checkPluginUpdates } from '../../../infrastructure/services/pluginUpdateCheck';
+
+const require = createRequire(import.meta.url);
+const { PluginDatabase } = require('../../../electron/plugins/database.cjs');
+const { MarketSourcesService } = require('../../../electron/plugins/marketSourcesService.cjs');
+const { OFFICIAL_SOURCE } = require('../../../electron/plugins/sourceIdentity.cjs');
+const { registerPluginBridge, CHANNELS } = require('../../../electron/plugins/pluginBridge.cjs');
+const { createPreloadApi } = require('../../../electron/preload/api.cjs');
+const { catalog, delivery, makeFiles, read, digest } = require('../../../electron/plugins/fixtures/staticDistributionFixture.cjs');
+
+test('mounted installed authors follow actual catalog/update/source entrypoints without changing package identity', async () => {
+  const rootPath = mkdtempSync(join(tmpdir(), 'netcatty-author-refresh-'));
+  const database = new PluginDatabase(join(rootPath, 'plugins.sqlite'));
+  const dom = new JSDOM('<!doctype html><div id="root"></div>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const [key, value] of Object.entries({ window: dom.window, document: dom.window.document,
+    navigator: dom.window.navigator, HTMLElement: dom.window.HTMLElement, Element: dom.window.Element,
+    Node: dom.window.Node, IntersectionObserver: undefined, IS_REACT_ACT_ENVIRONMENT: true })) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  }
+  const entry = structuredClone(catalog[0]);
+  entry.artifact = { sha256: 'a'.repeat(64), url: `${OFFICIAL_SOURCE.origin}/assets/${'a'.repeat(64)}.ncpkg` };
+  const bytes = read(delivery.plugins[0].iconLight.path.slice(1));
+  const avatar = { path: `/assets/${digest(bytes)}.png`, sha256: digest(bytes), size: bytes.length };
+  const filesFor = (entries = [entry], image = true) => {
+    const files = makeFiles(entries, (index: { plugins: Array<{ id: string; versions: Array<{ distribution: string }> }> }, sidecar: { schemaVersion: number; plugins: Array<{ id: string; avatar: typeof avatar | null; artifact: { path: string; sha256: string; size: number } }> }) => {
+      sidecar.schemaVersion = 2;
+      for (const item of sidecar.plugins) {
+        item.avatar = image ? avatar : null;
+        item.artifact = { path: `/assets/${entry.artifact.sha256}.ncpkg`, sha256: entry.artifact.sha256, size: 1 };
+        index.plugins.find((plugin) => plugin.id === item.id).versions[0].distribution = 'release';
+      }
+    });
+    files.set(avatar.path, bytes); return files;
+  };
+  let files = filesFor();
+  database.installVersion({ pluginId: entry.id, version: entry.version, runtimeKind: "browser", apiVersion: "0.1.0-internal.1", manifest: entry.manifest, archiveSha256: entry.artifact.sha256,
+    packageRelativePath: 'packages/synthetic', source: OFFICIAL_SOURCE }, { enable: true });
+  const manager = { initialize: async () => {}, list: async () => database.listPlugins(),
+    changeMarketSource: async (change: () => unknown) => change() };
+  let avatarReads = 0;
+  const service = new MarketSourcesService({ database, manager,
+    fetch: async (url: string) => { assert.equal(new URL(url).origin, OFFICIAL_SOURCE.origin); assert.ok(!new URL(url).pathname.endsWith('.ncpkg'), 'rejected selection never downloads a package'); return new Response(files.get(new URL(url).pathname)); },
+    createSourceFetch: (origin: string) => async (url: string) => { assert.equal(new URL(url).origin, origin); return new Response(files.get(new URL(url).pathname)); },
+    resolveAvatar: async () => { avatarReads++; return 'data:image/png;base64,eA=='; } });
+  const ipcMain = { handlers: new Map(), handle(channel: string, handler: unknown) { this.handlers.set(channel, handler); }, on() {} };
+  const events = new EventEmitter();
+  registerPluginBridge(ipcMain, { manager, catalogService: service, isTrustedSender: () => true,
+    broadcast: (channel: string, payload: unknown) => events.emit(channel, {}, payload) });
+  const api = createPreloadApi({ ipcRenderer: { on: events.on.bind(events), removeListener: events.removeListener.bind(events),
+    invoke: (channel: string, payload: unknown) => ipcMain.handlers.get(channel)({}, payload) } });
+  let authorCalls = 0;
+  const original = api.getPluginAuthorPresentation;
+  api.getPluginAuthorPresentation = (request: NetcattyPluginAuthorRequest) => { authorCalls++; return original(request); };
+  Object.assign(window, { netcatty: api });
+  let plugin = database.getActivePlugin(entry.id) as NetcattyInstalledPlugin;
+  function Row() {
+    const { ref, identity } = usePluginAuthorIdentity({ plugin });
+    return <div ref={ref} data-author={identity?.author} data-avatar={identity?.avatar} data-official={identity?.officialMaintained ?? false} />;
+  }
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const row = () => document.querySelector<HTMLElement>('[data-official]')!;
+  try {
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(avatarReads, 0, 'opening installed rows never fetches a catalog/avatar');
+    await act(async () => { await checkPluginUpdates(api); });
+    assert.equal(row().dataset.author, entry.author); assert.equal(row().dataset.official, 'true');
+    assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 1, 'rows share one preload subscription');
+    const count = authorCalls;
+    await act(async () => { await api.listPluginCatalog('official'); root.render(<><Row /><Row /></>); });
+    assert.equal(authorCalls, count, 'equivalent catalog and installation retain request dedupe');
+    files = filesFor([{ ...entry, author: 'Updated project name' }], false);
+    await act(async () => { await api.listPluginCatalog('official'); });
+    assert.equal(row().dataset.author, 'Updated project name'); assert.equal(row().dataset.avatar, undefined);
+    const beforeWithdrawal = (await api.listPluginCatalog('official')).entries[0];
+    files = filesFor([]);
+    await act(async () => {
+      await assert.rejects(api.installCatalogPlugin(entry.id, beforeWithdrawal.selectionToken, 'official'), /not in the curated catalog|changed/);
+    });
+    assert.equal(row().dataset.author, entry.manifest.publisher); assert.equal(row().dataset.official, 'false');
+    assert.equal(row().dataset.avatar, undefined, 'rejected install refresh removes withdrawn enrichment without another list or remount');
+
+    const source = await api.addPluginSource({ name: 'Community', address: 'https://community.example.com' });
+    const community = structuredClone(entry);
+    community.id = community.manifest.id = 'com.community.identity';
+    community.artifact.url = `${source.origin}/assets/${community.artifact.sha256}.ncpkg`;
+    files = filesFor([community]);
+    database.installVersion({ pluginId: community.id, version: community.version, manifest: community.manifest,
+      archiveSha256: community.artifact.sha256, packageRelativePath: 'packages/community', source }, { enable: true });
+    await act(async () => { await api.listPluginCatalog(source.id); });
+    assert.equal(authorCalls, count + 4, 'unrelated source changes do not reload official rows');
+    plugin = database.getActivePlugin(community.id);
+    await act(async () => root.render(<><Row /><Row /></>));
+    assert.equal(row().dataset.author, community.author); assert.match(row().dataset.avatar!, /^data:image\/png/);
+    assert.equal(row().dataset.official, 'false', 'copied catalog never gains official maintenance authority');
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: false }); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => { await api.updatePluginSource({ id: source.id, name: 'Renamed', enabled: true }); });
+    assert.equal(row().dataset.author, community.author);
+    await act(async () => { await api.removePluginSource(source.id, false); });
+    assert.equal(row().dataset.author, community.manifest.publisher); assert.equal(row().dataset.avatar, undefined);
+    await act(async () => root.unmount());
+    assert.equal(events.listenerCount(CHANNELS.catalogChanged), 0, 'last row releases the shared IPC listener');
+  } finally {
+    database.close(); dom.window.close(); rmSync(rootPath, { recursive: true, force: true });
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginAuthorRow.test.tsx

@@ -0,0 +1,116 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { JSDOM } from 'jsdom';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
+import { I18nProvider } from '../../../application/i18n/I18nProvider';
+
+const entry = { id: 'com.netcatty.starter', name: 'Starter', author: 'Netcatty', version: '0.1.2',
+  repository: 'binaricat/Netcatty', commit: 'a'.repeat(40), selectionToken: 'b'.repeat(64),
+  manifest: { publisher: 'netcatty' } } as NetcattyPluginCatalogEntry;
+const identity = { author: 'Netcatty', avatar: 'data:image/png;base64,eA==', officialMaintained: true,
+  sourceId: 'official', version: entry.version, archiveSha256: null };
+
+test('untrusted entry strings and absent imagery produce a compact placeholder without an official badge', () => {
+  const claimed = { ...entry, author: '<img src="https://avatars.githubusercontent.com/u/1">',
+    officialMaintained: true, avatar: 'https://avatars.githubusercontent.com/u/1' };
+  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginAuthorRow entry={claimed} /></I18nProvider>);
+  assert.match(html, /data-plugin-author-placeholder/);
+  assert.doesNotMatch(html, /<img|data-plugin-official-maintainer/);
+  assert.match(html, /&lt;img/);
+  assert.match(html, /items-center/);
+});
+
+test('mounted author rows load only when visible, retain fallbacks, cancel stale results and show a borderless themed maintainer pill', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  const observers: Array<{ target: Element | null; callback: IntersectionObserverCallback }> = [];
+  class VisibilityObserver {
+    record: typeof observers[number];
+    constructor(callback: IntersectionObserverCallback) { this.record = { callback, target: null }; observers.push(this.record); }
+    observe(target: Element) { this.record.target = target; }
+    disconnect() { this.record.target = null; }
+  }
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('IntersectionObserver', VisibilityObserver);
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const root = createRoot(document.getElementById('root')!);
+  const calls: NetcattyPluginAuthorRequest[] = [];
+  const pending: Array<(value: NetcattyPluginAuthorPresentation | null) => void> = [];
+  Object.assign(window, { netcatty: { getPluginAuthorPresentation: (request: NetcattyPluginAuthorRequest) => {
+    calls.push(request); return new Promise((resolve) => pending.push(resolve));
+  } } });
+  const render = async (value = entry, sourceId = 'official') => {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow entry={value} sourceId={sourceId} /></I18nProvider>));
+  };
+  const visible = async () => {
+    await act(async () => {
+      for (const observer of [...observers]) if (observer.target) observer.callback([{ target: observer.target, isIntersecting: true } as IntersectionObserverEntry], {} as IntersectionObserver);
+    });
+  };
+  try {
+    await render(); assert.equal(calls.length, 0); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    await visible(); assert.deepEqual(calls[0], { kind: 'catalog', pluginId: entry.id, selectionToken: entry.selectionToken, sourceId: 'official' });
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'), 'loading uses the default placeholder');
+    await act(async () => pending.shift()!(identity));
+    const image = document.querySelector('img')!;
+    assert.equal(image.getAttribute('src'), identity.avatar); assert.equal(image.width, 20); assert.equal(image.height, 20);
+    const badge = document.querySelector<HTMLElement>('[data-plugin-official-maintainer]')!;
+    assert.equal(badge.textContent, 'Official maintainer'); assert.match(badge.title, /not a safety certification/);
+    assert.ok(badge.classList.contains('border-0'));
+    assert.ok(badge.classList.contains('bg-amber-500/15')); assert.ok(badge.classList.contains('dark:bg-amber-400/15'));
+    assert.ok(badge.classList.contains('text-amber-800')); assert.ok(badge.classList.contains('dark:text-amber-300'));
+    document.documentElement.classList.add('dark');
+    assert.ok(document.querySelector('[data-plugin-author-row]')?.classList.contains('items-center'));
+    await act(async () => image.dispatchEvent(new Event('error')));
+    assert.equal(document.querySelector('img'), null); assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    assert.ok(document.querySelector('[data-plugin-official-maintainer]'), 'image failure does not alter maintenance identity');
+
+    const next = { ...entry, selectionToken: 'c'.repeat(64) };
+    await render(next); assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    await visible(); const stale = pending.shift()!;
+    const copied = { ...entry, author: 'Community author', selectionToken: 'd'.repeat(64) };
+    await render(copied, 'third-party:copy'); await visible();
+    await act(async () => stale(identity));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+    assert.match(document.querySelector('[data-plugin-author-row]')!.textContent!, /Community author/);
+    await act(async () => pending.shift()!({ ...identity, author: copied.author, sourceId: 'third-party:copy', officialMaintained: false, avatar: 'https://avatars.githubusercontent.com/u/1' }));
+    assert.equal(document.querySelector('img'), null, 'renderer never uses a remote avatar URL');
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null);
+
+    await render({ ...entry, selectionToken: 'f'.repeat(64) }); await visible();
+    await act(async () => pending.shift()!({ ...identity, avatar: null, officialMaintained: false }));
+    assert.ok(document.querySelector('[data-plugin-author-placeholder]'));
+    const installed = { id: entry.id, activeVersion: entry.version, archiveSha256: 'a'.repeat(64),
+      source: { id: 'official', kind: 'official', origin: 'https://plugins.netcatty.app', name: 'Official' },
+      manifest: entry.manifest, runtime: {} } as NetcattyInstalledPlugin;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={installed} /></I18nProvider>));
+    await visible(); assert.deepEqual(calls.at(-1), { kind: 'installed', pluginId: installed.id });
+    await act(async () => pending.shift()!({ ...identity, version: '9.0.0', archiveSha256: installed.archiveSha256! }));
+    assert.equal(document.querySelector('[data-plugin-official-maintainer]'), null, 'a stale installed version cannot gain a badge');
+    const count = calls.length;
+    await act(async () => root.render(<I18nProvider locale="en"><PluginAuthorRow plugin={{ ...installed }} /></I18nProvider>));
+    await visible(); assert.equal(calls.length, count, 'unchanged installed identity does not reload on a new object reference');
+
+    await render({ ...entry, selectionToken: 'e'.repeat(64) }); await visible();
+    const late = pending.shift()!;
+    await act(async () => root.unmount());
+    await act(async () => late(identity));
+    assert.equal(document.querySelector('[data-plugin-author-row]'), null);
+    assert.ok(observers.every((observer) => observer.target === null));
+  } finally {
+    dom.window.close();
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginInstalledGrid.test.tsx

@@ -32,7 +32,9 @@ test('installed grid filters, opens one detail and restores search, scroll and c
     assert.equal(cards().length, 2);
     const alphaCard = renderer.root.findAllByType('article')[0];
     assert.match(JSON.stringify(renderer.toJSON()), /Alpha safely formats synthetic greetings/);
-    assert.ok(alphaCard.findAllByType('p').some((node) => node.children.includes('Example')), 'author has its own line');
+    const authorRow = alphaCard.findByProps({ 'data-plugin-author-row': true });
+    assert.ok(authorRow.findAllByType('span').some((node) => node.children.includes('Example')), 'author has its own compact row');
+    assert.ok(authorRow.findByProps({ 'data-plugin-author-placeholder': true }), 'an unverified installed publisher has a default avatar');
     assert.ok(alphaCard.findAllByType('p').some((node) => node.props.className?.includes('line-clamp-3')), 'card description is bounded');
     assert.match(JSON.stringify(renderer.toJSON()), /MIT/);
     assert.match(JSON.stringify(renderer.toJSON()), /Incompatible version/);

components/settings/tabs/PluginManagementDialog.interaction.test.tsx

@@ -68,6 +68,11 @@ test('plugin manager is single-instance, closes with Escape, restores focus and
     })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
     await click(trigger);
     await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
+    // Radix schedules close-focus cleanup after the React close commit. The
+    // settle inside click's act() can precede that commit; observe the actual
+    // handoff instead of assuming the cleanup timer already ran.
+    const handoffDeadline = Date.now() + 2_000;
+    while (!handedOff && Date.now() < handoffDeadline) await act(async () => { await settle(); });
     assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
     function ControlledEntry() {
       const [open, setOpen] = useState(false);

components/settings/tabs/PluginMarketplace.tsx

@@ -4,6 +4,7 @@ import { Dialog, DialogContent, DialogDescription, DialogTitle } from '../../ui/
 import { PluginInfo } from './PluginInfo';
 import React, { useRef, useState } from 'react';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { useI18n } from '../../../application/i18n/I18nProvider';
 import { usePluginCatalog } from '../../../application/state/usePluginCatalog';
@@ -82,7 +83,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
           return <button key={item.id} type="button" data-plugin-id={item.id} aria-current={selected === item.id ? 'true' : undefined} onClick={() => choose(item.id)}
             className="plugin-card min-w-0 flex min-h-[200px] flex-col gap-3 rounded-lg bg-card p-4 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring">
             <div className="flex items-center gap-3"><span className="flex h-8 w-8 shrink-0 items-center justify-center"><PluginBrandIcon entry={item} size={32} className="text-muted-foreground" /></span><span className="min-w-0 break-words text-sm font-semibold leading-5">{item.name}</span></div>
-            <p className="break-words text-xs text-muted-foreground">{item.author}</p>
+            <PluginAuthorRow entry={item} sourceId={sourceId} />
             <p className="line-clamp-3 break-words text-sm leading-5 text-muted-foreground">{item.description}</p>
             <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1 text-xs text-muted-foreground"><span>{item.version} · {item.license}</span><span className="text-foreground">{t('settings.plugins.manager.details')}</span></div>
             <div className="flex flex-wrap gap-2 text-xs text-muted-foreground">{isInstalled && <span className="rounded bg-muted px-2 py-0.5 text-foreground">{t('settings.plugins.market.installed')}</span>}{!item.artifact && <span className="rounded bg-muted/40 px-2 py-0.5">{t('settings.plugins.market.sourceBadge')}</span>}</div>
@@ -91,7 +92,7 @@ export function PluginMarketplaceContent({ catalog, installed, selected, onSelec
       </div>}
       {entry && <article key={entry.id} aria-label={entry.name} className="plugin-marketplace-detail mx-auto w-full max-w-[920px] min-w-0 space-y-6 focus:outline-none">
         <Button variant="ghost" size="sm" onClick={back}><ArrowLeft size={14} className="mr-2" />{t('settings.plugins.market.back')}</Button>
-        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><p className="text-xs text-muted-foreground">{entry.author} · {entry.version} · {entry.license}</p>
+        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><PluginAuthorRow entry={entry} sourceId={sourceId} /><p className="text-xs text-muted-foreground">{entry.version} · {entry.license}</p>
           {installedEntry && <p className="text-xs text-muted-foreground">{t('settings.plugins.market.installed')} · {installedEntry.activeVersion} · {t(installedEntry.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}</p>}
         </div>
         {installedEntry?.runtime?.lastError && <p role="status" className="break-words text-xs text-destructive">{t('settings.plugins.manager.lastError')}: {installedEntry.runtime.lastError}</p>}

components/settings/tabs/PluginPackageManager.tsx

@@ -3,6 +3,7 @@ import { describePluginRuntime } from '@/domain/pluginRuntimePolicy.cjs';
 import React, { useRef, useState } from 'react';
 import { PluginPermissionPanel } from './PluginPermissionPanel';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { ArrowLeft } from 'lucide-react';
 import { usePluginManager } from '../../../application/state/usePluginManager';
 import { useI18n } from '../../../application/i18n/I18nProvider';
@@ -103,7 +104,7 @@ export function PluginPackageManager({ manager, onSelectionChange, initialSelect
         </Button>
       </div>
       <p className="break-all text-xs text-muted-foreground">{t('settings.plugins.sources.source')}: {t(plugin.source?.kind === 'official' ? 'settings.plugins.sources.official' : plugin.source?.kind === 'third-party' ? 'settings.plugins.sources.thirdparty' : 'settings.plugins.sources.local')}{plugin.source?.origin ? ` · ${plugin.source.origin}` : ''}</p>
-      {plugin.manifest?.publisher && <p className="break-words text-xs text-muted-foreground">{plugin.manifest.publisher}</p>}
+      {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
       <p className={`break-words text-sm leading-5 text-muted-foreground ${selectedPlugin ? 'whitespace-pre-wrap' : 'line-clamp-3'}`}>{descriptionOf(plugin) || t('settings.plugins.manager.noDescription')}</p>
       {!selectedPlugin ? <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1">
         <p className="break-words text-xs text-muted-foreground">{plugin.activeVersion}{plugin.manifest?.license ? ` · ${plugin.manifest.license}` : ''}</p>

components/settings/tabs/PluginSettingsLanding.tsx

@@ -6,6 +6,7 @@ import type { usePluginManager } from '../../../application/state/usePluginManag
 import { Button } from '../../ui/button';
 import { Input } from '../../ui/input';
 import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
+import { PluginAuthorRow } from '../../plugins/PluginAuthorRow';
 import { SettingCard, SettingRow, SettingsSection, Toggle } from '../settings-ui';
 import { PluginLogSettings } from './PluginLogSettings';
 
@@ -72,7 +73,8 @@ export function PluginSettingsLanding({ manager, settingsAvailable, settingsErro
               <span className="truncate" title={name}>{name}</span>
               {plugin.activeVersion && <span className="shrink-0 text-xs font-normal text-muted-foreground">{plugin.activeVersion}</span>}
             </span>} description={<>
-              <span className="block break-words">{[plugin.manifest?.publisher, sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
+              {plugin.manifest?.publisher && <PluginAuthorRow plugin={plugin} />}
+              <span className="block break-words">{[sourceOf(plugin), statusOf(plugin)].filter(Boolean).join(' · ')}</span>
               {availableUpdate && <span className="block text-primary">{t('settings.plugins.landing.updateAvailable').replace('{version}', availableUpdate.availableVersion)}</span>}
               {description && <span className="line-clamp-2 break-words">{description}</span>}
             </>}>

components/settings/tabs/SettingsAITab.tsx

@@ -1260,6 +1260,34 @@ const SettingsAITab: React.FC<SettingsAITabProps> = ({
         </TabsContent>
 
         <TabsContent value="tools" className="m-0 space-y-6">
+
+
+          <SettingsSection
+            anchorId="ai-tool-access-mode"
+            title={t('ai.toolAccess.title')}
+          >
+            <SettingCard>
+              <SettingRow className="flex-col items-start md:flex-row md:items-center" description={t('ai.toolAccess.description')}>
+                <div className="flex flex-wrap justify-end gap-2">
+                <Select
+                  value={toolIntegrationMode}
+                  options={[
+                    { value: 'mcp', label: t('ai.toolAccess.mode.mcp') },
+                    { value: 'skills', label: t('ai.toolAccess.mode.skills') },
+                  ]}
+                  onChange={(value) => setToolIntegrationMode(value as AIToolIntegrationMode)}
+                  className="w-48"
+                />
+                <ToolAccessGuidance mode={toolIntegrationMode} />
+                </div>
+              </SettingRow>
+            </SettingCard>
+          </SettingsSection>
+
+          <ExternalMcpCard />
+
+          <AIPrivacySection />
+
           <SettingsSection title={t('ai.chatShortcuts.title')}>
             <SettingCard divided>
               <SettingRow
@@ -1276,34 +1304,6 @@ const SettingsAITab: React.FC<SettingsAITabProps> = ({
             </SettingCard>
           </SettingsSection>
 
-          <SettingsSection
-            anchorId="ai-tool-access-mode"
-            title={t('ai.toolAccess.title')}
-          >
-            <SettingCard>
-              <SettingRow description={t('ai.toolAccess.description')}>
-                <Select
-                  value={toolIntegrationMode}
-                  options={[
-                    { value: 'mcp', label: t('ai.toolAccess.mode.mcp') },
-                    { value: 'skills', label: t('ai.toolAccess.mode.skills') },
-                  ]}
-                  onChange={(value) => setToolIntegrationMode(value as AIToolIntegrationMode)}
-                  className="w-48"
-                />
-              </SettingRow>
-              <div className="pb-4">
-                <ToolAccessGuidance mode={toolIntegrationMode} />
-              </div>
-            </SettingCard>
-          </SettingsSection>
-
-          <AIPrivacySection />
-
-          <SettingsSection anchorId="ai-external-mcp" title={t('ai.externalMcp.title')}>
-            <ExternalMcpCard />
-          </SettingsSection>
-
           <SettingsSection
             anchorId="ai-user-skills"
             title={t('ai.userSkills.title')}

components/settings/tabs/SettingsAppearanceTab.tsx

@@ -23,7 +23,7 @@ import {
 import { resolveAppIconVariant, type AppIconVariant } from "../../../domain/appIconVariant";
 import { resolveNoteFontSelectionFamily, resolveNoteFontSelectionId } from "../../../domain/noteFonts";
 import { DEFAULT_AUTO_IMPORT_SYSTEM_KNOWN_HOSTS } from "../../../domain/systemKnownHostsAutoImport";
-import { cn } from "../../../lib/utils";
+import { cn, isMacPlatform } from "../../../lib/utils";
 import { SectionHeader, SettingsAnchor, SettingsTabContent, SettingRow, Toggle, Select } from "../settings-ui";
 import { FontSelect } from "../FontSelect";
 import { TerminalFontSelect } from "../TerminalFontSelect";
@@ -69,6 +69,8 @@ function SettingsAppearanceTab(props: {
   setShowHostTreeSidebar: (enabled: boolean) => void;
   windowOpacity: number;
   setWindowOpacity: (opacity: number) => void;
+  windowBackgroundBlur: boolean;
+  setWindowBackgroundBlur: (enabled: boolean) => void;
   appIconVariant: AppIconVariant;
   setAppIconVariant: (variant: AppIconVariant) => void;
 }) {
@@ -140,10 +142,13 @@ function SettingsAppearanceTab(props: {
     setShowHostTreeSidebar,
     windowOpacity,
     setWindowOpacity,
+    windowBackgroundBlur,
+    setWindowBackgroundBlur,
     appIconVariant,
     setAppIconVariant,
   } = props;
   const resolvedAppIconVariant = resolveAppIconVariant(appIconVariant);
+  const isMac = isMacPlatform();
 
   const WINDOW_OPACITY_PRESETS = [
     { label: '100%', value: 1 },
@@ -315,6 +320,19 @@ function SettingsAppearanceTab(props: {
             </div>
           </div>
         </SettingRow>
+        {isMac && (
+          <SettingRow
+            anchorId="appearance-window-background-blur"
+            label={t("settings.appearance.windowBackgroundBlur")}
+            description={t("settings.appearance.windowBackgroundBlur.desc")}
+          >
+            <Toggle
+              checked={windowBackgroundBlur}
+              onChange={setWindowBackgroundBlur}
+              ariaLabel={t("settings.appearance.windowBackgroundBlur")}
+            />
+          </SettingRow>
+        )}
       </div>
 
       <SectionHeader title={t("settings.appearance.uiTheme")} />

components/settings/tabs/ai/AIPrivacySection.test.tsx

@@ -1,183 +1,154 @@
 import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
 import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { I18nProvider } from '../../../../application/i18n/I18nProvider';
+import React, { act } from 'react';
+import { JSDOM } from 'jsdom';
 import { STORAGE_KEY_AI_PRIVACY } from '../../../../infrastructure/config/storageKeys';
-import { AIPrivacySection } from './AIPrivacySection';
 
-function installEnvironment(setConfig: (config: unknown) => Promise<unknown>) {
-  const values = new Map<string, string>();
-  const events = new EventTarget();
-  const globals = {
-    IS_REACT_ACT_ENVIRONMENT: true,
-    localStorage: {
-      getItem: (key: string) => values.get(key) ?? null,
-      setItem: (key: string, value: string) => values.set(key, value),
-    },
-    window: {
-      netcatty: { externalMcpSetConfig: setConfig },
-      addEventListener: events.addEventListener.bind(events),
-      removeEventListener: events.removeEventListener.bind(events),
-      dispatchEvent: events.dispatchEvent.bind(events),
-    },
-  };
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  for (const [name, value] of Object.entries(globals)) {
-    previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
-    Object.defineProperty(globalThis, name, { value, configurable: true, writable: true });
-  }
-  return {
-    values,
-    restore: () => {
-      for (const [name, descriptor] of previous) {
-        if (descriptor) Object.defineProperty(globalThis, name, descriptor);
-        else Reflect.deleteProperty(globalThis, name);
-      }
-    },
-  };
+const dom = new JSDOM('<div id="root"></div>', { url: 'http://localhost/#/settings' });
+for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'HTMLTextAreaElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'FocusEvent', 'getComputedStyle', 'localStorage'] as const) {
+  Object.defineProperty(globalThis, key, { value: dom.window[key], configurable: true });
+}
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true, requestAnimationFrame: (fn: () => void) => setTimeout(fn, 0), cancelAnimationFrame: clearTimeout });
+const { createRoot } = await import('react-dom/client');
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { AIPrivacySection } = await import('./AIPrivacySection');
+
+async function mount(setConfig: (config: unknown) => Promise<unknown> = async () => ({ ok: true }), saved?: string) {
+  dom.window.localStorage.clear();
+  if (saved) dom.window.localStorage.setItem(STORAGE_KEY_AI_PRIVACY, saved);
+  Object.assign(window, { netcatty: { externalMcpSetConfig: setConfig } });
+  const root = createRoot(document.getElementById('root')!);
+  await act(async () => root.render(<I18nProvider locale="en"><AIPrivacySection /></I18nProvider>));
+  return async () => { await act(async () => root.unmount()); };
+}
+const button = (text: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((el) => el.textContent === text)!;
+const click = async (text: string) => { await act(async () => button(text).click()); };
+async function input(index: number, value: string) {
+  const el = document.querySelectorAll('textarea')[index];
+  await act(async () => {
+    Object.getOwnPropertyDescriptor(dom.window.HTMLTextAreaElement.prototype, 'value')!.set!.call(el, value);
+    el.dispatchEvent(new dom.window.Event('input', { bubbles: true }));
+  });
 }
 
-function view() {
-  return <I18nProvider locale="en"><AIPrivacySection /></I18nProvider>;
-}
-
-test('privacy settings default off and explain their limits and connection scope', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('privacy overview is persisted state; configuration preserves the full scope and atomic draft', async () => {
+  const unmount = await mount();
   try {
-    await act(async () => { renderer = create(view()); });
-    const markup = JSON.stringify(renderer!.toJSON());
-    assert.equal(renderer!.root.findAllByType('button').filter((node) => node.props['aria-checked'] === false).length, 2);
-    assert.match(markup, /cannot detect every secret/);
-    assert.match(markup, /AI privacy/);
-    assert.match(markup, /Catty, integrated agents and external MCP clients/);
-    assert.match(markup, /Only Netcatty-managed data and tools are covered/);
-    assert.match(markup, /native tools, direct file access and other MCP servers/);
-    assert.match(markup, /Binary tool responses are blocked/);
-    assert.match(markup, /one managed conversation or external MCP connection/);
-    assert.match(markup, /reconnect external MCP clients/);
-    assert.match(markup, /start a new managed conversation/);
-    assert.match(markup, /Additional IP ranges/);
-    assert.match(markup, /Custom regular expressions/);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.equal(document.querySelector('textarea'), null);
+    assert.match(document.body.textContent!, /Text redaction disabled/);
+    await click('Configure privacy');
+    const dialog = document.querySelector('[role="dialog"]')!;
+    assert.match(dialog.textContent!, /cannot detect every secret/);
+    assert.match(dialog.textContent!, /Catty, integrated agents and external MCP clients/);
+    assert.match(dialog.textContent!, /Only Netcatty-managed data and tools are covered/);
+    assert.match(dialog.textContent!, /native tools, direct file access and other MCP servers/);
+    assert.match(dialog.textContent!, /Binary tool responses are blocked/);
+    assert.match(dialog.textContent!, /one managed conversation or external MCP connection/);
+    assert.match(dialog.textContent!, /reconnect external MCP clients/);
+    assert.equal(dialog.querySelectorAll('[role="switch"][aria-checked="false"]').length, 2);
+    assert.equal(button('Apply').disabled, true);
+  } finally { await unmount(); }
 });
 
-test('AI privacy is shared Tool Access UI, not nested under External MCP', async () => {
-  const settingsTab = await readFile(new URL('../SettingsAITab.tsx', import.meta.url), 'utf8');
-  const externalCard = await readFile(new URL('./ExternalMcpCard.tsx', import.meta.url), 'utf8');
-  const toolsTab = settingsTab.split('<TabsContent value="tools"')[1].split('</TabsContent>')[0];
-  assert.match(toolsTab, /<\/SettingsSection>\s*<AIPrivacySection \/>\s*<SettingsSection anchorId="ai-external-mcp"/);
-  assert.doesNotMatch(externalCard, /AIPrivacySection|ExternalMcpRedactionSection/);
-});
-
-test('privacy drafts apply together, retain rejected input and persist only validated settings', async () => {
+test('rejected privacy draft stays open and accepted draft commits once and returns focus', async () => {
   const calls: unknown[] = [];
   let accepted = false;
-  const env = installEnvironment(async (config) => {
-    calls.push(config);
-    return accepted ? { ok: true } : { ok: false, error: 'Invalid privacy rules.' };
-  });
-  let renderer: ReactTestRenderer | undefined;
+  const unmount = await mount(async (config) => { calls.push(config); return accepted ? { ok: true } : { ok: false, error: 'Invalid privacy rules.' }; });
   try {
-    await act(async () => { renderer = create(view()); });
-    const root = renderer!.root;
-    const privacySwitch = () => root.findAllByType('button').find((node) => (
-      node.props['aria-label'] === 'Enable text redaction'
-    ))!;
-    const apply = () => root.findAllByType('button').find((node) => node.props.children === 'Apply')!;
-    await act(async () => { privacySwitch().props.onClick(); });
-    await act(async () => {
-      root.findAllByType('textarea')[0].props.onChange({ currentTarget: { value: '192.0.2.0/24\n\n2001:db8::/32' } });
-      root.findAllByType('textarea')[1].props.onChange({ currentTarget: { value: '[' } });
-    });
-    assert.equal(calls.length, 0, 'draft edits must not change runtime or storage');
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-    await act(async () => { apply().props.onClick(); });
-    assert.equal(root.findAllByType('textarea')[1].props.value, '[');
-    assert.match(root.findByProps({ role: 'alert' }).children.join(''), /Invalid privacy rules/);
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-
+    const trigger = button('Configure privacy');
+    trigger.focus();
+    await click('Configure privacy');
+    await act(async () => (document.querySelector('[aria-label="Enable text redaction"]') as HTMLButtonElement).click());
+    await input(0, '192.0.2.0/24\n\n2001:db8::/32');
+    await input(1, '[');
+    assert.equal(calls.length, 0);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
+    await click('Apply');
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /Invalid privacy rules/);
+    assert.equal(document.querySelectorAll('textarea')[1].value, '[');
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
     accepted = true;
-    await act(async () => {
-      root.findAllByType('textarea')[1].props.onChange({ currentTarget: { value: 'INTERNAL_[A-Z0-9]+' } });
-    });
-    await act(async () => { apply().props.onClick(); });
-    const saved = JSON.parse(env.values.get(STORAGE_KEY_AI_PRIVACY)!);
-    assert.deepEqual(saved, {
-      enabled: true,
-      redactPrivateIps: false,
-      cidrs: ['192.0.2.0/24', '2001:db8::/32'],
-      patterns: ['INTERNAL_[A-Z0-9]+'],
-    });
+    await input(1, 'INTERNAL_[A-Z0-9]+');
+    await click('Apply');
+    const saved = JSON.parse(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY)!);
+    assert.deepEqual(saved, { enabled: true, redactPrivateIps: false, cidrs: ['192.0.2.0/24', '2001:db8::/32'], patterns: ['INTERNAL_[A-Z0-9]+'] });
     assert.deepEqual(calls[1], { redaction: saved });
-    assert.equal(root.findAllByProps({ role: 'alert' }).length, 0);
-    assert.match(root.findByProps({ role: 'status' }).children.join(''), /new managed conversation/);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(document.activeElement, trigger);
+    assert.match(document.querySelector('[role="status"]')!.textContent!, /new managed conversation/);
+    await click('Configure privacy');
+    assert.equal(document.querySelectorAll('textarea')[1].value, 'INTERNAL_[A-Z0-9]+');
+  } finally { await unmount(); }
 });
 
-test('malformed saved privacy settings remain visible as a recoverable error', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('Cancel, X and Escape discard edits and reopening reads saved values', async () => {
+  let calls = 0;
+  const unmount = await mount(async () => { calls += 1; return { ok: true }; });
   try {
-    env.values.set(STORAGE_KEY_AI_PRIVACY, '{');
-    await act(async () => { renderer = create(view()); });
-    assert.match(renderer!.root.findByProps({ role: 'alert' }).children.join(''), /Invalid saved AI privacy settings/);
-    assert.ok(renderer!.root.findAllByType('button').some((node) => node.props.children === 'Apply'));
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), '{');
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    for (const close of ['Cancel', 'X', 'Escape']) {
+      await click('Configure privacy');
+      await input(0, '192.0.2.0/24');
+      assert.match(document.querySelector('[role="status"]')!.textContent!, /Unsaved changes/);
+      if (close === 'Cancel') await click('Cancel');
+      else if (close === 'X') await act(async () => (document.querySelector('[data-dialog-close]:not([aria-hidden])') as HTMLButtonElement).click());
+      else await act(async () => { document.dispatchEvent(new dom.window.KeyboardEvent('keydown', { key: 'Escape', bubbles: true })); });
+      assert.equal(document.querySelector('[role="dialog"]'), null);
+      await click('Configure privacy');
+      assert.equal(document.querySelector('textarea')!.value, '');
+      await click('Cancel');
+    }
+    assert.equal(calls, 0);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), null);
+  } finally { await unmount(); }
 });
 
-test('privacy apply disables draft controls until shared validation settles', async () => {
-  let resolveConfig!: (result: unknown) => void;
-  const env = installEnvironment(() => new Promise((resolve) => { resolveConfig = resolve; }));
-  let renderer: ReactTestRenderer | undefined;
+test('busy Apply blocks duplicate submits, edits and Escape', async () => {
+  let resolve!: (value: unknown) => void;
+  let calls = 0;
+  const unmount = await mount(() => { calls += 1; return new Promise((done) => { resolve = done; }); });
   try {
-    await act(async () => { renderer = create(view()); });
-    const root = renderer!.root;
-    await act(async () => {
-      root.findAllByType('button').find((node) => node.props['aria-label'] === 'Enable text redaction')!.props.onClick();
-    });
-    await act(async () => {
-      root.findAllByType('button').find((node) => node.props.children === 'Apply')!.props.onClick();
-    });
-    assert.ok(root.findAllByType('button').every((node) => node.props.disabled));
-    assert.ok(root.findAllByType('textarea').every((node) => node.props.disabled));
-    assert.equal(env.values.get(STORAGE_KEY_AI_PRIVACY), undefined);
-    await act(async () => { resolveConfig({ ok: true }); });
-    assert.ok(root.findAllByType('button').every((node) => !node.props.disabled));
-    assert.equal(JSON.parse(env.values.get(STORAGE_KEY_AI_PRIVACY)!).enabled, true);
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    await click('Configure privacy');
+    await input(0, '192.0.2.0/24');
+    await click('Apply');
+    assert.ok([...document.querySelectorAll('[role="dialog"] textarea, [role="dialog"] [role="switch"]')].every((el) => (el as HTMLInputElement).disabled));
+    assert.equal(button('Cancel').disabled, true);
+    await act(async () => { button('Applying...').click(); document.dispatchEvent(new dom.window.KeyboardEvent('keydown', { key: 'Escape', bubbles: true })); });
+    assert.ok(document.querySelector('[role="dialog"]'));
+    assert.equal(calls, 1);
+    await act(async () => { resolve({ ok: true }); });
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+  } finally { await unmount(); }
 });
 
-test('shared privacy controls refresh when another window changes the shared preference', async () => {
-  const env = installEnvironment(async () => ({ ok: true }));
-  let renderer: ReactTestRenderer | undefined;
+test('malformed saved settings remain visible and repairable without being rewritten on open', async () => {
+  const unmount = await mount(undefined, '{');
   try {
-    await act(async () => { renderer = create(view()); });
-    const settings = { enabled: true, redactPrivateIps: true, cidrs: ['192.0.2.0/24'], patterns: ['INTERNAL_.*'] };
-    env.values.set(STORAGE_KEY_AI_PRIVACY, JSON.stringify(settings));
-    const event = new Event('storage');
-    Object.defineProperty(event, 'key', { value: STORAGE_KEY_AI_PRIVACY });
-    await act(async () => { window.dispatchEvent(event); });
-    assert.equal(renderer!.root.findAllByType('button').filter((node) => node.props['aria-checked'] === true).length, 2);
-    assert.equal(renderer!.root.findAllByType('textarea')[0].props.value, '192.0.2.0/24');
-    assert.equal(renderer!.root.findAllByType('textarea')[1].props.value, 'INTERNAL_.*');
-  } finally {
-    if (renderer) await act(async () => { renderer!.unmount(); });
-    env.restore();
-  }
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /Invalid saved AI privacy settings/);
+    await click('Configure privacy');
+    assert.equal(button('Apply').disabled, false);
+    assert.equal(dom.window.localStorage.getItem(STORAGE_KEY_AI_PRIVACY), '{');
+  } finally { await unmount(); }
+});
+
+test('cross-window changes refresh clean drafts but preserve dirty drafts with a conflict notice', async () => {
+  const unmount = await mount();
+  const settings = { enabled: true, redactPrivateIps: true, cidrs: ['192.0.2.0/24'], patterns: ['INTERNAL_.*'] };
+  const update = async () => {
+    dom.window.localStorage.setItem(STORAGE_KEY_AI_PRIVACY, JSON.stringify(settings));
+    await act(async () => { window.dispatchEvent(new dom.window.StorageEvent('storage', { key: STORAGE_KEY_AI_PRIVACY })); });
+  };
+  try {
+    await click('Configure privacy');
+    await update();
+    assert.equal(document.querySelector('textarea')!.value, '192.0.2.0/24');
+    await input(0, '198.51.100.0/24');
+    settings.cidrs = ['203.0.113.0/24'];
+    await update();
+    assert.equal(document.querySelector('textarea')!.value, '198.51.100.0/24');
+    assert.match(document.querySelector('[role="alert"]')!.textContent!, /another window/);
+    assert.equal(button('Apply').disabled, true);
+    await click('Cancel');
+    await click('Configure privacy');
+    assert.equal(document.querySelector('textarea')!.value, '203.0.113.0/24');
+  } finally { await unmount(); }
 });

components/settings/tabs/ai/AIPrivacySection.tsx

@@ -1,7 +1,8 @@
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
 import { useAIPrivacyState } from "../../../../application/state/useExternalMcpToggleState";
 import { Button } from "../../../ui/button";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
 import { SettingCard, SettingRow, SettingsSection, Toggle } from "../../settings-ui";
 
 export const AIPrivacySection: React.FC = () => {
@@ -12,8 +13,32 @@ export const AIPrivacySection: React.FC = () => {
   const [cidrs, setCidrs] = useState(settings.cidrs.join("\n"));
   const [patterns, setPatterns] = useState(settings.patterns.join("\n"));
   const [applied, setApplied] = useState(false);
+  const [open, setOpen] = useState(false);
+  const errorRef = useRef<HTMLParagraphElement>(null);
+  useEffect(() => { if (open && error) errorRef.current?.focus(); }, [open, error]);
+  const [draftBase, setDraftBase] = useState(settings);
+  const [conflict, setConflict] = useState(false);
+  const dirty = enabled !== draftBase.enabled || privateIps !== draftBase.redactPrivateIps
+    || cidrs !== draftBase.cidrs.join("\n") || patterns !== draftBase.patterns.join("\n");
+  const changeOpen = (next: boolean) => {
+    if (applying) return;
+    setDraftBase(settings);
+    setEnabled(settings.enabled);
+    setPrivateIps(settings.redactPrivateIps);
+    setCidrs(settings.cidrs.join("\n"));
+    setPatterns(settings.patterns.join("\n"));
+    setConflict(false);
+    setOpen(next);
+  };
 
+  const draftState = useRef({ open, dirty, applying });
+  draftState.current = { open, dirty, applying };
   useEffect(() => {
+    if (draftState.current.open && draftState.current.dirty && !draftState.current.applying) {
+      setConflict(true);
+      return;
+    }
+    setDraftBase(settings);
     setEnabled(settings.enabled);
     setPrivateIps(settings.redactPrivateIps);
     setCidrs(settings.cidrs.join("\n"));
@@ -21,6 +46,7 @@ export const AIPrivacySection: React.FC = () => {
   }, [settings]);
 
   const onApply = async () => {
+    if (applying || conflict) return;
     setApplied(false);
     const saved = await apply({
       enabled,
@@ -29,13 +55,36 @@ export const AIPrivacySection: React.FC = () => {
       patterns: patterns.split(/\r?\n/).filter((line) => line.trim().length > 0),
     });
     setApplied(saved);
+    if (saved) setOpen(false);
   };
 
   return (
     <SettingsSection anchorId="ai-privacy" title={t("ai.privacy.title")}>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.description")}</p>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.boundary")}</p>
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingCard>
+        <SettingRow
+          className="flex-col items-start md:flex-row md:items-center"
+          label={t(settings.enabled ? "ai.toolSettings.privacyOn" : "ai.toolSettings.privacyOff")}
+          description={`${t("ai.privacy.privateIps")}: ${t(settings.redactPrivateIps ? "common.enabled" : "common.disabled")} · ${t("ai.toolSettings.ruleSummary", { cidrs: String(settings.cidrs.length), patterns: String(settings.patterns.length) })}`}
+        >
+          <ToolSettingsDialog
+            title={t("ai.privacy.title")}
+            triggerLabel={t("ai.toolSettings.configurePrivacy")}
+            open={open}
+            onOpenChange={changeOpen}
+            busy={applying}
+            footer={<>
+              {dirty ? <span role="status" className="mr-auto self-center text-xs text-muted-foreground">{t("ai.toolSettings.unsaved")}</span> : null}
+              <Button type="button" variant="outline" onClick={() => changeOpen(false)} disabled={applying}>{t("common.cancel")}</Button>
+              <Button type="button" onClick={() => { void onApply(); }} disabled={applying || conflict || (!dirty && !error)}>
+                {t(applying ? "ai.privacy.applying" : "ai.privacy.apply")}
+              </Button>
+            </>}
+          >
+            <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.description")}</p>
+            <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.boundary")}</p>
+      <SettingCard divided className="border-0 rounded-none bg-transparent p-0">
         <SettingRow label={t("ai.privacy.enable")}>
           <Toggle
             checked={enabled}
@@ -56,9 +105,9 @@ export const AIPrivacySection: React.FC = () => {
           />
         </SettingRow>
       </SettingCard>
-      <div className="space-y-3 rounded-md border border-border/60 bg-background/50 p-3">
+      <div className="space-y-4">
         <label className="block space-y-1.5">
-          <span className="text-xs font-medium">{t("ai.privacy.cidrs")}</span>
+          <span className="text-sm font-medium">{t("ai.privacy.cidrs")}</span>
           <span className="block text-xs text-muted-foreground">{t("ai.privacy.cidrs.description")}</span>
           <textarea
             value={cidrs}
@@ -72,7 +121,7 @@ export const AIPrivacySection: React.FC = () => {
           />
         </label>
         <label className="block space-y-1.5">
-          <span className="text-xs font-medium">{t("ai.privacy.patterns")}</span>
+          <span className="text-sm font-medium">{t("ai.privacy.patterns")}</span>
           <span className="block text-xs text-muted-foreground">{t("ai.privacy.patterns.description")}</span>
           <textarea
             value={patterns}
@@ -86,20 +135,15 @@ export const AIPrivacySection: React.FC = () => {
           />
         </label>
         <p className="text-xs text-muted-foreground leading-5">{t("ai.privacy.connectionScope")}</p>
-        <div className="flex items-center justify-between gap-3">
-          <p className="text-xs text-amber-500">{t("ai.privacy.reconnect")}</p>
-          <Button size="sm" variant="outline" onClick={() => { void onApply(); }} disabled={applying}>
-            {t(applying ? "ai.privacy.applying" : "ai.privacy.apply")}
-          </Button>
-        </div>
-        {error ? (
-          <p role="alert" className="text-xs text-destructive">
-            {t("ai.privacy.failed")} {error}
-          </p>
-        ) : applied ? (
-          <p role="status" className="text-xs text-emerald-500">{t("ai.privacy.applied")}</p>
-        ) : null}
+        <p className="text-xs text-amber-500">{t("ai.privacy.reconnect")}</p>
       </div>
+            {conflict ? <p role="alert" className="text-xs text-destructive">{t("ai.toolSettings.conflict")}</p> : null}
+            {error ? <p ref={errorRef} tabIndex={-1} role="alert" className="text-xs text-destructive">{t("ai.privacy.failed")} {error}</p> : null}
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
+      {error && !open ? <p role="alert" className="text-xs text-destructive">{t("ai.privacy.failed")} {error}</p>
+        : applied ? <p role="status" className="text-xs text-emerald-500">{t("ai.privacy.applied")}</p> : null}
     </SettingsSection>
   );
 };

components/settings/tabs/ai/CopyableCodeBlock.tsx

@@ -1,10 +1,12 @@
 import React from "react";
-import { Check, Copy } from "lucide-react";
+import { Check, Copy, Eye, EyeOff } from "lucide-react";
 import { cn } from "../../../../lib/utils";
+import { useI18n } from "../../../../application/i18n/I18nProvider";
 import { Button } from "../../../ui/button";
 
 type CopyableCodeBlockProps = {
   label?: string;
+  sensitive?: boolean;
   value: string;
   copyKey: string;
   copied: string | null;
@@ -17,6 +19,7 @@ type CopyableCodeBlockProps = {
 
 export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
   label,
+  sensitive = false,
   value,
   copyKey,
   copied,
@@ -26,7 +29,9 @@ export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
   emptyLabel,
   className,
 }) => {
-  const display = value || emptyLabel || "";
+  const { t } = useI18n();
+  const [revealed, setRevealed] = React.useState(false);
+  const display = sensitive && value && !revealed ? "••••••••" : value || emptyLabel || "";
   const canCopy = Boolean(value);
   const isCopied = copied === copyKey;
 
@@ -38,12 +43,15 @@ export const CopyableCodeBlock: React.FC<CopyableCodeBlockProps> = ({
       <div className="group relative rounded-md border border-border/60 bg-muted/20">
         <pre
           className={cn(
-            "max-h-40 overflow-auto whitespace-pre-wrap break-all px-3 py-2.5 pr-11 font-mono text-xs leading-5",
+            "max-h-40 overflow-auto whitespace-pre-wrap break-all px-3 py-2.5 pr-20 font-mono text-xs leading-5",
             !value && "text-muted-foreground",
           )}
         >
           {display}
         </pre>
+        {sensitive && value ? <Button type="button" variant="ghost" size="sm" className="absolute right-10 top-1.5 h-7 w-7 p-0" onClick={() => setRevealed(!revealed)} aria-label={t(revealed ? "ai.toolSettings.hideSecret" : "ai.toolSettings.showSecret")}>
+          {revealed ? <EyeOff size={14} /> : <Eye size={14} />}
+        </Button> : null}
         <Button
           type="button"
           variant="ghost"

components/settings/tabs/ai/ExternalMcpCard.httpErrors.test.tsx

@@ -0,0 +1,133 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React, { act } from 'react';
+import { JSDOM } from 'jsdom';
+import { installAiToolAccessFixture } from '../../../../scripts/fixtures/ai-tool-access/bridge.cjs';
+
+const dom = new JSDOM('<div id="root"></div>', { url: 'http://localhost/#/settings' });
+for (const key of ['window', 'document', 'location', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent', 'FocusEvent', 'getComputedStyle', 'localStorage'] as const) {
+  Object.defineProperty(globalThis, key, { value: dom.window[key], configurable: true });
+}
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true, requestAnimationFrame: (fn: () => void) => setTimeout(fn, 0), cancelAnimationFrame: clearTimeout });
+const { createRoot } = await import('react-dom/client');
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { TooltipProvider } = await import('../../../ui/tooltip');
+const { ExternalMcpCard } = await import('./ExternalMcpCard');
+
+type FixtureControl = { rejectHttp: boolean; throwHttp: boolean; holdHttp: boolean; pendingHttp: (() => void)[]; pendingClients: (() => void)[]; rejectRotate: boolean; throwRotate: boolean; calls: { name: string; args: unknown[] }[] };
+async function mount(options: { enabled?: boolean; holdClients?: boolean } = {}, openHttp = true) {
+  installAiToolAccessFixture({ locale: 'en', enabled: true, ...options });
+  Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => {} } });
+  const qa = (window as unknown as { __aiToolQa: FixtureControl }).__aiToolQa;
+  const root = createRoot(document.getElementById('root')!);
+  await act(async () => root.render(<I18nProvider locale="en"><TooltipProvider><ExternalMcpCard /></TooltipProvider></I18nProvider>));
+  if (openHttp) await click('Configure HTTP');
+  return { qa, close: async () => { await act(async () => root.unmount()); } };
+}
+const dialog = () => document.querySelector<HTMLElement>('[role="dialog"]')!;
+const button = (text: string, scope: ParentNode = document) => [...scope.querySelectorAll<HTMLButtonElement>('button')].find((el) => el.textContent === text)!;
+const click = async (text: string) => { await act(async () => button(text).click()); };
+async function changePort(value: string) {
+  const port = dialog().querySelector<HTMLInputElement>('[aria-label="Port"]')!;
+  await act(async () => {
+    port.focus();
+    Object.getOwnPropertyDescriptor(dom.window.HTMLInputElement.prototype, 'value')!.set!.call(port, value);
+    port.dispatchEvent(new dom.window.Event('input', { bubbles: true }));
+  });
+  await act(async () => port.blur());
+  return port;
+}
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`HTTP ${failure} configuration failure is visible inside the dialog, preserves input and can retry`, async () => {
+    const h = await mount();
+    try {
+      h.qa.rejectHttp = failure === 'returned';
+      h.qa.throwHttp = failure === 'thrown';
+      const port = await changePort('47401');
+      const message = failure === 'returned' ? 'Fixture: port unavailable.' : 'Fixture: HTTP configuration threw.';
+      const alert = dialog().querySelector('[role="alert"]')!;
+      assert.match(alert.textContent!, new RegExp(message.replaceAll('.', '\\.')));
+      assert.equal(document.activeElement, alert, 'the error must be reachable without scrolling back manually');
+      assert.equal(port.value, '47401');
+      assert.ok(document.querySelector('[role="dialog"]'));
+      assert.match(document.querySelector('[data-settings-anchor="ai-external-mcp-http"]')!.textContent!, /Fixture:/);
+      const beforeRetry = h.qa.calls.filter((call) => call.name === 'config').length;
+      h.qa.rejectHttp = false;
+      h.qa.throwHttp = false;
+      await click('Retry');
+      assert.equal(h.qa.calls.filter((call) => call.name === 'config').length, beforeRetry + 1);
+      assert.equal(dialog().querySelector('[role="alert"]'), null);
+      assert.equal(port.value, '47401');
+    } finally { await h.close(); }
+  });
+}
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`HTTP ${failure} token rotation failure stays in the active dialog and retries explicitly`, async () => {
+    const h = await mount();
+    try {
+      await act(async () => (dialog().querySelector('[aria-label="Enable HTTP"]') as HTMLButtonElement).click());
+      await act(async () => dialog().querySelector('summary')!.click());
+      h.qa.rejectRotate = failure === 'returned';
+      h.qa.throwRotate = failure === 'thrown';
+      await click('Regenerate');
+      assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /Fixture: token rotation/);
+      assert.equal(dialog().textContent!.includes('SYNTHETIC_FIXTURE_TOKEN_NEVER_REAL'), false);
+      h.qa.rejectRotate = false;
+      h.qa.throwRotate = false;
+      await click('Retry');
+      assert.equal(dialog().querySelector('[role="alert"]'), null);
+      assert.equal(dialog().textContent!.includes('SYNTHETIC_ROTATED_FIXTURE_TOKEN'), false);
+    } finally { await h.close(); }
+  });
+}
+
+test('HTTP clipboard failure is visible in the dialog and clears only after another copy attempt', async () => {
+  const h = await mount();
+  try {
+    await act(async () => dialog().querySelector('summary')!.click());
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => { throw new Error('Fixture clipboard failure'); } } });
+    const copy = () => dialog().querySelector<HTMLButtonElement>('[aria-label="Copy"]:not([disabled])')!;
+    await act(async () => copy().click());
+    assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /copy/i);
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText: async () => {} } });
+    await act(async () => copy().click());
+    assert.equal(dialog().querySelector('[role="alert"]'), null);
+  } finally { await h.close(); }
+});
+
+for (const failure of ['returned', 'thrown'] as const) {
+  test(`a completed runtime poll cannot suppress a pending HTTP ${failure} failure`, async () => {
+    const h = await mount();
+    try {
+      h.qa.holdHttp = true;
+      h.qa.rejectHttp = failure === 'returned';
+      h.qa.throwHttp = failure === 'thrown';
+      const beforePoll = h.qa.calls.filter((call) => call.name === 'status').length;
+      const port = await changePort('47402');
+      assert.match(dialog().querySelector('[role="status"]')!.textContent!, /Applying HTTP/);
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 3200)); });
+      assert.ok(h.qa.calls.filter((call) => call.name === 'status').length > beforePoll);
+      await act(async () => h.qa.pendingHttp.splice(0).forEach((resolve) => resolve()));
+      assert.match(dialog().querySelector('[role="alert"]')!.textContent!, /Fixture:/);
+      assert.equal(port.value, '47402');
+      assert.equal(dialog().querySelector('[role="status"]'), null);
+    } finally { await h.close(); }
+  });
+}
+
+test('completed MCP enable can be turned off while unrelated client discovery is still pending', async () => {
+  const h = await mount({ enabled: false, holdClients: true }, false);
+  try {
+    const toggle = document.querySelector<HTMLButtonElement>('[role="switch"][aria-label="External MCP"]')!;
+    await act(async () => toggle.click());
+    assert.equal(toggle.getAttribute('aria-checked'), 'true');
+    assert.ok(h.qa.pendingClients.length > 0, 'client discovery remains intentionally unresolved');
+    assert.equal(toggle.disabled, false, 'successful enable must release the switch before client discovery finishes');
+    await act(async () => toggle.click());
+    assert.equal(toggle.getAttribute('aria-checked'), 'false');
+    assert.equal(toggle.disabled, false);
+    assert.deepEqual(h.qa.calls.filter((call) => call.name === 'enable').map((call) => call.args[0]), [true, false]);
+  } finally { await h.close(); }
+});

components/settings/tabs/ai/ExternalMcpCard.tsx

@@ -1,4 +1,4 @@
-import React, { useCallback, useEffect, useMemo, useState } from "react";
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { HelpCircle, RefreshCw } from "lucide-react";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
 import {
@@ -31,8 +31,13 @@ import {
 } from "../../../../application/state/useExternalMcpToggleState";
 import { cn } from "../../../../lib/utils";
 import { Button } from "../../../ui/button";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "../../../ui/tabs";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../../../ui/tooltip";
-import { Select, SettingCard, SettingRow, Toggle } from "../../../settings/settings-ui";
+import { Select, SettingCard, SettingRow, SettingsSection, Toggle } from "../../../settings/settings-ui";
+import { ToolStatusPill, type ToolStatusTone } from "./ToolStatusPill";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
+import { useOptionalSettingsFocus } from "../../SettingsFocusContext";
+import { SettingsAnchor } from "../../settings-ui";
 import { CopyableCodeBlock } from "./CopyableCodeBlock";
 import { ExternalMcpHttpSection, type ExternalMcpHttpViewStatus } from "./ExternalMcpHttpSection";
 import { getBridge } from "./types";
@@ -72,23 +77,13 @@ type StatusView = {
   className: string;
 };
 
-function getBridgeStatusView(status: ExternalMcpStatus | null, enabled: boolean): StatusView {
-  if (!enabled) {
-    return { labelKey: "ai.externalMcp.status.disabled", className: "text-muted-foreground" };
-  }
-  if (!status || !status.ok) {
-    return { labelKey: "ai.externalMcp.status.unavailable", className: "text-amber-500" };
-  }
-  if (status.state === "running") {
-    return { labelKey: "ai.externalMcp.status.running", className: "text-emerald-500" };
-  }
-  if (status.state === "starting") {
-    return { labelKey: "ai.externalMcp.status.starting", className: "text-amber-500" };
-  }
-  if (status.state === "error") {
-    return { labelKey: "ai.externalMcp.status.error", className: "text-destructive" };
-  }
-  return { labelKey: "ai.externalMcp.status.disabled", className: "text-muted-foreground" };
+function getBridgeStatusView(status: ExternalMcpStatus | null, enabled: boolean): { labelKey: string; tone: ToolStatusTone } {
+  if (!enabled) return { labelKey: "ai.externalMcp.status.disabled", tone: "inactive" };
+  if (!status || !status.ok) return { labelKey: "ai.externalMcp.status.unavailable", tone: status?.error ? "error" : "inactive" };
+  if (status.state === "running") return { labelKey: "ai.externalMcp.status.running", tone: "active" };
+  if (status.state === "starting") return { labelKey: "ai.externalMcp.status.starting", tone: "inactive" };
+  if (status.state === "error") return { labelKey: "ai.externalMcp.status.error", tone: "error" };
+  return { labelKey: "ai.externalMcp.status.disabled", tone: "inactive" };
 }
 
 /** Map bridge permissionMode to a Safety i18n key for display. */
@@ -252,6 +247,15 @@ export function buildCursorSnippet(launcherPath: string, discoveryPath?: string
 
 export const ExternalMcpCard: React.FC = () => {
   const { t } = useI18n();
+  const [behaviorOpen, setBehaviorOpen] = useState(false);
+  const focus = useOptionalSettingsFocus();
+  useEffect(() => {
+    if (focus?.request?.anchorId === "ai-external-mcp-approval-alert") setBehaviorOpen(true);
+  }, [focus?.request]);
+  const statusGeneration = useRef(0);
+  const clientStatusGeneration = useRef(0);
+  const httpOperationGeneration = useRef(0);
+  useEffect(() => () => { statusGeneration.current += 1; clientStatusGeneration.current += 1; httpOperationGeneration.current += 1; }, []);
   const { enabled, setEnabled, error: configError } = useExternalMcpToggleState();
   const [mode, setModeRaw] = useState<ExternalMcpMode>(() => readExternalMcpMode());
   const [idleTimeoutMinutes, setIdleTimeoutRaw] = useState<number>(() => readExternalMcpIdleTimeoutMinutes());
@@ -268,8 +272,11 @@ export const ExternalMcpCard: React.FC = () => {
     listenAddress: readExternalMcpHttpListenAddress(),
     clientHost: readExternalMcpHttpClientHost(),
   }));
+  const [isApplyingHttp, setIsApplyingHttp] = useState(false);
+  const [isToggling, setIsToggling] = useState(false);
   const [isRotatingHttpToken, setIsRotatingHttpToken] = useState(false);
   const [status, setStatus] = useState<ExternalMcpStatus | null>(null);
+  const [manualFormat, setManualFormat] = useState("command");
   const [selectedClient, setSelectedClient] = useState<ExternalMcpClient>("codex");
   const [codexStatus, setCodexStatus] = useState<ClientSetupStatus | null>(null);
   const [claudeStatus, setClaudeStatus] = useState<ClientSetupStatus | null>(null);
@@ -280,6 +287,8 @@ export const ExternalMcpCard: React.FC = () => {
   const [isAddingClaude, setIsAddingClaude] = useState(false);
   const [isAddingGrok, setIsAddingGrok] = useState(false);
   const [copied, setCopied] = useState<string | null>(null);
+  const [httpCopyError, setHttpCopyError] = useState<string | null>(null);
+  const [httpActionError, setHttpActionError] = useState<{ kind: "config" | "rotate"; message: string } | null>(null);
   const [actionMessage, setActionMessage] = useState<{ tone: "error" | "warning" | "success"; text: string } | null>(null);
   const bridgeUnavailableMessage = t("ai.externalMcp.bridgeUnavailable");
 
@@ -324,6 +333,10 @@ export const ExternalMcpCard: React.FC = () => {
   }, []);
 
   const applyHttpSettings = useCallback(async (next: ExternalMcpHttpSettings) => {
+    const operation = ++httpOperationGeneration.current;
+    const generation = ++statusGeneration.current;
+    setHttpActionError(null);
+    setIsApplyingHttp(true);
     const normalized: ExternalMcpHttpSettings = {
       enabled: writeExternalMcpHttpEnabled(next.enabled),
       port: writeExternalMcpHttpPort(next.port),
@@ -332,36 +345,56 @@ export const ExternalMcpCard: React.FC = () => {
       clientHost: writeExternalMcpHttpClientHost(next.clientHost),
     };
     setHttpSettings(normalized);
-    const nextStatus = await getBridge()?.externalMcpSetConfig?.({
-      httpEnabled: normalized.enabled,
-      httpPort: normalized.port,
-      httpAllowCustomBind: normalized.allowCustomBind,
-      httpListenAddress: normalized.listenAddress,
-      httpClientHost: normalized.clientHost,
-    });
-    if (nextStatus && typeof nextStatus === "object") {
-      setStatus(nextStatus as ExternalMcpStatus);
+    try {
+      const nextStatus = await getBridge()?.externalMcpSetConfig?.({
+        httpEnabled: normalized.enabled,
+        httpPort: normalized.port,
+        httpAllowCustomBind: normalized.allowCustomBind,
+        httpListenAddress: normalized.listenAddress,
+        httpClientHost: normalized.clientHost,
+      }) as ExternalMcpStatus | undefined;
+      if (operation !== httpOperationGeneration.current) return;
+      if (!nextStatus?.ok || nextStatus.error || nextStatus.http?.error) {
+        setHttpActionError({ kind: "config", message: nextStatus?.error || nextStatus?.http?.error || bridgeUnavailableMessage });
+        return;
+      }
+      if (generation === statusGeneration.current) setStatus(nextStatus);
+    } catch (error) {
+      if (operation === httpOperationGeneration.current) {
+        setHttpActionError({ kind: "config", message: error instanceof Error ? error.message : String(error) });
+      }
+    } finally {
+      if (operation === httpOperationGeneration.current) setIsApplyingHttp(false);
     }
-  }, []);
+  }, [bridgeUnavailableMessage]);
 
   const rotateHttpToken = useCallback(async () => {
-    const bridge = getBridge();
-    if (!bridge?.externalMcpSetConfig) return;
+    const operation = ++httpOperationGeneration.current;
+    const generation = ++statusGeneration.current;
     setIsRotatingHttpToken(true);
-    setActionMessage(null);
+    setHttpActionError(null);
     try {
-      const nextStatus = await bridge.externalMcpSetConfig({ rotateHttpToken: true });
-      if (nextStatus && typeof nextStatus === "object") {
-        setStatus(nextStatus as ExternalMcpStatus);
+      const nextStatus = await getBridge()?.externalMcpSetConfig?.({ rotateHttpToken: true }) as ExternalMcpStatus | undefined;
+      if (operation !== httpOperationGeneration.current) return;
+      if (!nextStatus?.ok || nextStatus.error || nextStatus.http?.error) {
+        setHttpActionError({ kind: "rotate", message: nextStatus?.error || nextStatus?.http?.error || bridgeUnavailableMessage });
+        return;
+      }
+      if (generation === statusGeneration.current) setStatus(nextStatus);
+    } catch (error) {
+      if (operation === httpOperationGeneration.current) {
+        setHttpActionError({ kind: "rotate", message: error instanceof Error ? error.message : String(error) });
       }
     } finally {
       setIsRotatingHttpToken(false);
     }
-  }, []);
+  }, [bridgeUnavailableMessage]);
 
   const refreshStatus = useCallback(async (options?: { quiet?: boolean; clients?: boolean }) => {
+    const generation = ++statusGeneration.current;
     const bridge = getBridge();
     const includeClients = options?.clients !== false;
+    const clientGeneration = includeClients ? ++clientStatusGeneration.current : clientStatusGeneration.current;
     if (
       !bridge?.externalMcpGetStatus
       || !bridge?.externalMcpCodexGetStatus
@@ -411,10 +444,15 @@ export const ExternalMcpCard: React.FC = () => {
           bridge.externalMcpGetUniversalSetupPrompt?.()
             ?? Promise.resolve({ ok: false, prompt: "" }),
         ]);
-        setStatus(nextStatus as ExternalMcpStatus);
-        if (enabled && nextStatus?.ok && !nextStatus.enabled) {
-          setEnabled(false);
+        // Runtime polling and CLI/client discovery have separate lifetimes.
+        // A fast quiet poll must not discard a slow, still-current client batch.
+        if (generation === statusGeneration.current) {
+          setStatus(nextStatus as ExternalMcpStatus);
+          if (enabled && nextStatus?.ok && !nextStatus.enabled) {
+            setEnabled(false);
+          }
         }
+        if (clientGeneration !== clientStatusGeneration.current) return;
         setCodexStatus(nextCodexStatus as ClientSetupStatus);
         setClaudeStatus(nextClaudeStatus as ClientSetupStatus);
         setGrokStatus(nextGrokStatus as ClientSetupStatus);
@@ -425,13 +463,14 @@ export const ExternalMcpCard: React.FC = () => {
         );
       } else {
         const nextStatus = await bridge.externalMcpGetStatus();
+        if (generation !== statusGeneration.current) return;
         setStatus(nextStatus as ExternalMcpStatus);
         if (enabled && nextStatus?.ok && !nextStatus.enabled) {
           setEnabled(false);
         }
       }
     } finally {
-      if (!options?.quiet) setIsRefreshing(false);
+      if (!options?.quiet && clientGeneration === clientStatusGeneration.current) setIsRefreshing(false);
     }
   }, [bridgeUnavailableMessage, enabled, setEnabled]);
 
@@ -481,8 +520,10 @@ export const ExternalMcpCard: React.FC = () => {
   const canAddToClaude = claudeStatus?.state === "not_configured";
   const canAddToGrok = grokStatus?.state === "not_configured";
 
-  const copyText = useCallback(async (key: string, text: string) => {
+  const copyText = useCallback(async (key: string, text: string, scope: "client" | "http" = "client") => {
     if (!text) return;
+    setCopied((current) => current === key ? null : current);
+    if (scope === "http") setHttpCopyError(null);
     try {
       await navigator.clipboard.writeText(text);
       setCopied(key);
@@ -490,7 +531,8 @@ export const ExternalMcpCard: React.FC = () => {
         setCopied((current) => (current === key ? null : current));
       }, 1200);
     } catch {
-      setActionMessage({ tone: "error", text: t("ai.externalMcp.copyFailed") });
+      if (scope === "http") setHttpCopyError(t("ai.externalMcp.copyFailed"));
+      else setActionMessage({ tone: "error", text: t("ai.externalMcp.copyFailed") });
     }
   }, [t]);
 
@@ -634,8 +676,13 @@ export const ExternalMcpCard: React.FC = () => {
   ]);
 
   return (
-    <div className="rounded-lg border bg-card p-4 space-y-3">
-      <div className="flex items-start justify-between gap-4">
+    <SettingsSection
+      anchorId="ai-external-mcp"
+      title={t("ai.externalMcp.title")}
+      actions={<ToolStatusPill tone={bridgeStatusView.tone}>{t(bridgeStatusView.labelKey)}</ToolStatusPill>}
+    >
+      <div className="space-y-4">
+      <div className="flex items-start gap-4">
         <div className="min-w-0 flex items-start gap-1.5">
           <p className="min-w-0 text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.description")}
@@ -665,12 +712,10 @@ export const ExternalMcpCard: React.FC = () => {
             </TooltipContent>
           </Tooltip>
         </div>
-        <div className={cn("text-xs font-medium shrink-0", bridgeStatusView.className)}>
-          {t(bridgeStatusView.labelKey)}
-        </div>
       </div>
 
-      <div className="flex items-center justify-between gap-4 rounded-md border border-border/60 bg-background/70 px-3 py-2">
+      <SettingCard divided>
+      <div className="flex items-center justify-between gap-4 py-3">
         <div className="min-w-0">
           <div className="text-sm font-medium">{t("ai.externalMcp.title")}</div>
           <div className="text-xs text-muted-foreground">
@@ -679,17 +724,21 @@ export const ExternalMcpCard: React.FC = () => {
         </div>
         <Toggle
           checked={enabled}
+          disabled={isToggling}
+          ariaLabel={t("ai.externalMcp.title")}
           onChange={(nextEnabled) => {
+            statusGeneration.current += 1;
             setActionMessage(null);
-            void setEnabled(nextEnabled).then(() => refreshStatus());
+            setIsToggling(true);
+            void setEnabled(nextEnabled).then(() => { void refreshStatus(); }).finally(() => setIsToggling(false));
           }}
         />
       </div>
 
       {/* Permission mode is controlled in Safety settings; surface it here so External MCP
           users see why write tools may still prompt (confirm) or run freely (auto). */}
-      <div className="flex items-start justify-between gap-4 rounded-md border border-border/60 bg-background/70 px-3 py-2">
-        <div className="min-w-0 space-y-1">
+      <div className="flex items-start justify-between gap-4 py-3">
+        <div className="min-w-0 flex-1 space-y-1">
           <div className="text-sm font-medium">{t("ai.externalMcp.permissionMode.label")}</div>
           <div className="text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.permissionMode.hint")}
@@ -706,9 +755,11 @@ export const ExternalMcpCard: React.FC = () => {
         </div>
       </div>
 
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingsAnchor anchorId="ai-external-mcp-approval-alert">
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t("ai.toolSettings.behavior")} description={t(mode === "persistent" ? "ai.externalMcp.mode.persistent" : "ai.externalMcp.mode.temporary")}>
+          <ToolSettingsDialog title={t("ai.toolSettings.behavior")} triggerLabel={t("ai.toolSettings.configureBehavior")} immediate open={behaviorOpen} onOpenChange={setBehaviorOpen}>
+      <SettingCard divided className="border-0 bg-transparent p-0">
         <SettingRow
-          anchorId="ai-external-mcp-approval-alert"
           label={t("ai.externalMcp.approvalAlert")}
           description={t("ai.externalMcp.approvalAlert.description")}
         >
@@ -803,6 +854,10 @@ export const ExternalMcpCard: React.FC = () => {
             <span className="text-xs text-muted-foreground">{t("ai.externalMcp.idleTimeout.minutes")}</span>
           </div>
         </SettingRow>
+      </SettingCard>
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingsAnchor>
       </SettingCard>
 
       <ExternalMcpHttpSection
@@ -811,93 +866,36 @@ export const ExternalMcpCard: React.FC = () => {
         status={status?.http || null}
         copied={copied}
         rotating={isRotatingHttpToken}
-        onCopy={copyText}
+        onCopy={(key, text) => { void copyText(key, text, "http"); }}
+        applying={isApplyingHttp}
+        operationError={httpActionError?.message ?? null}
+        copyError={httpCopyError}
+        onRetry={httpActionError ? () => {
+          if (httpActionError.kind === "rotate") void rotateHttpToken();
+          else void applyHttpSettings(httpSettings);
+        } : undefined}
         onChange={(next) => { void applyHttpSettings(next); }}
         onRotateToken={() => { void rotateHttpToken(); }}
       />
 
-      <div className="space-y-2">
-        <div className="flex min-h-8 items-center justify-between gap-2">
-          <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.discovery")}</div>
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={() => void refreshStatus()}
-            disabled={isRefreshing}
-          >
-            <RefreshCw size={14} className={cn("mr-1.5", isRefreshing && "animate-spin")} />
-            {t("ai.externalMcp.refresh")}
-          </Button>
-        </div>
-        <div className="space-y-2.5 rounded-md border border-border/60 bg-background/50 p-3">
-          <CopyableCodeBlock
-            label={t("ai.externalMcp.launcher")}
-            value={launcherPath || ""}
-            copyKey="launcher"
-            copied={copied}
-            onCopy={copyText}
-            copyLabel={t("ai.externalMcp.copy")}
-            copiedLabel={t("ai.externalMcp.copied")}
-            emptyLabel={t("ai.externalMcp.unavailable")}
-          />
-          <CopyableCodeBlock
-            label={t("ai.externalMcp.discovery")}
-            value={status?.discoveryPath || ""}
-            copyKey="discovery"
-            copied={copied}
-            onCopy={copyText}
-            copyLabel={t("ai.externalMcp.copy")}
-            copiedLabel={t("ai.externalMcp.copied")}
-            emptyLabel={t("ai.externalMcp.unavailable")}
-          />
-          {!enabled ? (
-            <p className="text-xs text-amber-500">{t("ai.externalMcp.enableForLauncher")}</p>
-          ) : null}
-        </div>
-      </div>
+      <SettingCard>
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t("ai.externalMcp.clientConfiguration")} description={t("ai.externalMcp.clientConfiguration.description")}>
+          <ToolSettingsDialog title={t("ai.externalMcp.clientConfiguration")} triggerLabel={t("ai.toolSettings.configureClients")}>
 
       <div className="space-y-2">
         <div className="space-y-1">
-          <div className="text-sm font-semibold text-foreground">
-            {t("ai.externalMcp.clientConfiguration")}
-          </div>
           <p className="text-xs text-muted-foreground leading-5">
             {t("ai.externalMcp.clientConfiguration.description")}
           </p>
         </div>
 
-        <div
-          role="tablist"
-          aria-label={t("ai.externalMcp.clientConfiguration")}
-          className="grid grid-cols-5 gap-1 rounded-md bg-muted p-1"
-        >
-          {CLIENT_TABS.map((client) => {
-            const active = selectedClient === client;
-            return (
-              <button
-                key={client}
-                type="button"
-                role="tab"
-                aria-selected={active}
-                onClick={() => {
-                  setSelectedClient(client);
-                  setActionMessage(null);
-                }}
-                className={cn(
-                  "inline-flex h-8 items-center justify-center rounded-sm px-2 text-xs font-medium transition-colors",
-                  "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
-                  active
-                    ? "bg-background text-foreground shadow-sm"
-                    : "text-muted-foreground hover:text-foreground",
-                )}
-              >
-                {t(`ai.externalMcp.client.${client}`)}
-              </button>
-            );
-          })}
-        </div>
+        <Tabs value={selectedClient} onValueChange={(value) => { setSelectedClient(value as ExternalMcpClient); setManualFormat(value === "other" || value === "cursor" ? "snippet" : "command"); setActionMessage(null); }}>
+          <TabsList aria-label={t("ai.externalMcp.clientConfiguration")} className="flex h-auto flex-wrap justify-start">
+            {CLIENT_TABS.map((client) => <TabsTrigger key={client} value={client}>{t(`ai.externalMcp.client.${client}`)}</TabsTrigger>)}
+          </TabsList>
+          <TabsContent value={selectedClient}>
 
-        <div className="space-y-3 rounded-md border border-border/60 bg-background/50 p-3">
+        <div className="space-y-4">
           {selectedClientMeta.kind === "installable" && selectedClientMeta.statusView ? (
             <div className="flex items-center justify-between gap-3">
               <div className={cn("text-xs font-medium", selectedClientMeta.statusView.className)}>
@@ -924,57 +922,76 @@ export const ExternalMcpCard: React.FC = () => {
             </p>
           )}
 
-          {selectedClientMeta.kind === "installable" ? (
-            <>
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.cliCommand")}
-                value={selectedClientMeta.command}
-                copyKey="command"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.configSnippet")}
-                value={selectedClientMeta.snippet}
-                copyKey="snippet"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-            </>
-          ) : (
-            <>
-              <CopyableCodeBlock
-                label={t("ai.externalMcp.configSnippet")}
-                value={selectedClientMeta.snippet}
-                copyKey="cursor"
-                copied={copied}
-                onCopy={copyText}
-                copyLabel={t("ai.externalMcp.copy")}
-                copiedLabel={t("ai.externalMcp.copied")}
-                emptyLabel={t("ai.externalMcp.unavailable")}
-              />
-              {selectedClient === "other" ? (
-                <CopyableCodeBlock
-                  label={t("ai.externalMcp.universalSetupPrompt")}
-                  value={universalSetupPrompt}
-                  copyKey="universal-setup-prompt"
-                  copied={copied}
-                  onCopy={copyText}
-                  copyLabel={t("ai.externalMcp.copy")}
-                  copiedLabel={t("ai.externalMcp.copied")}
-                  emptyLabel={t("ai.externalMcp.unavailable")}
-                />
-              ) : null}
-            </>
-          )}
+          <details className="space-y-3">
+            <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.manualSetup")}</summary>
+            <label className="flex flex-wrap items-center justify-between gap-2 text-sm">
+              {t("ai.toolSettings.format")}
+              <select aria-label={t("ai.toolSettings.format")} className="h-9 max-w-full rounded-md border border-input bg-background px-3 text-sm" value={manualFormat} onChange={(event) => setManualFormat(event.currentTarget.value)}>
+                {selectedClientMeta.kind === "installable" ? <option value="command">{t("ai.externalMcp.cliCommand")}</option> : null}
+                <option value="snippet">{t("ai.externalMcp.configSnippet")}</option>
+                {selectedClient === "other" ? <option value="prompt">{t("ai.externalMcp.universalSetupPrompt")}</option> : null}
+              </select>
+            </label>
+            <CopyableCodeBlock
+              label={t(manualFormat === "command" ? "ai.externalMcp.cliCommand" : manualFormat === "prompt" ? "ai.externalMcp.universalSetupPrompt" : "ai.externalMcp.configSnippet")}
+              value={manualFormat === "command" ? selectedClientMeta.command : manualFormat === "prompt" ? universalSetupPrompt : selectedClientMeta.snippet}
+              copyKey={manualFormat}
+              copied={copied}
+              onCopy={copyText}
+              copyLabel={t("ai.externalMcp.copy")}
+              copiedLabel={t("ai.externalMcp.copied")}
+              emptyLabel={t("ai.externalMcp.unavailable")}
+            />
+          </details>
         </div>
+          </TabsContent>
+        </Tabs>
       </div>
+      <details className="space-y-3">
+        <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.connectionDetails")}</summary>
+        <div className="flex min-h-8 items-center justify-between gap-2">
+          <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.discovery")}</div>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void refreshStatus()}
+            disabled={isRefreshing}
+          >
+            <RefreshCw size={14} className={cn("mr-1.5", isRefreshing && "animate-spin")} />
+            {t("ai.externalMcp.refresh")}
+          </Button>
+        </div>
+        <div className="space-y-3">
+          <CopyableCodeBlock
+            label={t("ai.externalMcp.launcher")}
+            value={launcherPath || ""}
+            copyKey="launcher"
+            copied={copied}
+            onCopy={copyText}
+            copyLabel={t("ai.externalMcp.copy")}
+            copiedLabel={t("ai.externalMcp.copied")}
+            emptyLabel={t("ai.externalMcp.unavailable")}
+          />
+          <CopyableCodeBlock
+            label={t("ai.externalMcp.discovery")}
+            value={status?.discoveryPath || ""}
+            copyKey="discovery"
+            copied={copied}
+            onCopy={copyText}
+            copyLabel={t("ai.externalMcp.copy")}
+            copiedLabel={t("ai.externalMcp.copied")}
+            emptyLabel={t("ai.externalMcp.unavailable")}
+          />
+          {!enabled ? (
+            <p className="text-xs text-amber-500">{t("ai.externalMcp.enableForLauncher")}</p>
+          ) : null}
+        </div>
+      </details>
+
+            {actionMessage ? <p role={actionMessage.tone === "error" ? "alert" : "status"} className={cn("text-xs", actionMessage.tone === "error" ? "text-destructive" : "text-muted-foreground")}>{actionMessage.text}</p> : null}
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
 
       {actionMessage ? (
         <div
@@ -991,6 +1008,7 @@ export const ExternalMcpCard: React.FC = () => {
       {configError || status?.error ? (
         <div role="alert" className="text-xs text-destructive">{configError || status?.error}</div>
       ) : null}
-    </div>
+      </div>
+    </SettingsSection>
   );
 };

components/settings/tabs/ai/ExternalMcpHttpSection.tsx

@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React, { useEffect, useId, useRef, useState } from "react";
 import {
   buildClaudeHttpAddCommand,
   buildCodexHttpEnvLine,
@@ -8,9 +8,12 @@ import {
   DEFAULT_EXTERNAL_MCP_HTTP_PORT,
 } from "../../../../domain/externalMcpHttp";
 import { useI18n } from "../../../../application/i18n/I18nProvider";
-import { cn } from "../../../../lib/utils";
 import { Button } from "../../../ui/button";
 import { SettingCard, SettingRow, Toggle } from "../../settings-ui";
+import { ToolStatusPill } from "./ToolStatusPill";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
+import { useOptionalSettingsFocus } from "../../SettingsFocusContext";
+import { SettingsAnchor } from "../../settings-ui";
 import { CopyableCodeBlock } from "./CopyableCodeBlock";
 
 export type ExternalMcpHttpViewStatus = {
@@ -41,6 +44,10 @@ type ExternalMcpHttpSectionProps = {
   status: ExternalMcpHttpViewStatus | null;
   copied: string | null;
   rotating: boolean;
+  applying?: boolean;
+  operationError?: string | null;
+  copyError?: string | null;
+  onRetry?: () => void;
   onCopy: (key: string, text: string) => void;
   onChange: (next: ExternalMcpHttpViewSettings) => void;
   onRotateToken: () => void;
@@ -73,11 +80,25 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   status,
   copied,
   rotating,
+  applying,
+  operationError,
+  copyError,
+  onRetry,
   onCopy,
   onChange,
   onRotateToken,
 }) => {
   const { t } = useI18n();
+  const operationErrorRef = useRef<HTMLDivElement>(null);
+  const errorId = useId();
+  const [open, setOpen] = useState(false);
+  useEffect(() => {
+    if (open && (operationError || copyError)) operationErrorRef.current?.focus();
+  }, [open, operationError, copyError]);
+  const focus = useOptionalSettingsFocus();
+  useEffect(() => {
+    if (focus?.request?.anchorId === "ai-external-mcp-http") setOpen(true);
+  }, [focus?.request]);
   const [portDraft, setPortDraft] = useState(String(settings.port || DEFAULT_EXTERNAL_MCP_HTTP_PORT));
   const [addressDraft, setAddressDraft] = useState(settings.listenAddress || "0.0.0.0");
   const [clientHostDraft, setClientHostDraft] = useState(settings.clientHost || "");
@@ -85,6 +106,16 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   const [addressError, setAddressError] = useState(false);
   const [clientHostError, setClientHostError] = useState(false);
 
+  const changeOpen = (next: boolean) => {
+    setPortDraft(String(settings.port || DEFAULT_EXTERNAL_MCP_HTTP_PORT));
+    setAddressDraft(settings.listenAddress || "0.0.0.0");
+    setClientHostDraft(settings.clientHost || "");
+    setPortError(false);
+    setAddressError(false);
+    setClientHostError(false);
+    setOpen(next);
+  };
+
   const listenAddress = settings.allowCustomBind
     ? (status?.listenAddress || settings.listenAddress)
     : "127.0.0.1";
@@ -97,14 +128,9 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   );
   const token = status?.bearerToken || "";
   const listening = Boolean(status?.listening);
-  const statusLabel = listening
-    ? t("ai.externalMcp.http.listening")
-    : t("ai.externalMcp.http.notListening");
-  const statusClass = status?.errorCode
-    ? "text-destructive"
-    : listening
-      ? "text-emerald-500"
-      : "text-muted-foreground";
+  const hasRuntimeError = Boolean(operationError || status?.errorCode || status?.error);
+  const statusLabel = hasRuntimeError ? t("ai.externalMcp.status.error")
+    : t(listening ? "ai.externalMcp.http.listening" : "ai.externalMcp.http.notListening");
 
   let errorText = "";
   if (portError) errorText = t("ai.externalMcp.http.invalidPort");
@@ -116,6 +142,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   } else if (status?.errorCode === "invalid_address") errorText = t("ai.externalMcp.http.invalidAddress");
   else if (status?.errorCode === "invalid_port") errorText = t("ai.externalMcp.http.invalidPort");
   else if (status?.errorCode === "listen_failed") errorText = status.error || t("ai.externalMcp.http.listenFailed");
+  else if (status?.error) errorText = status.error;
 
   const commitPort = () => {
     const port = parsePort(portDraft);
@@ -151,16 +178,25 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
   };
 
   return (
-    <div className="space-y-2">
+    <SettingsAnchor anchorId="ai-external-mcp-http" className="space-y-2">
       <div className="flex items-center justify-between gap-3">
         <div className="text-sm font-semibold text-foreground">{t("ai.externalMcp.http.title")}</div>
-        <div className={cn("text-xs font-medium", statusClass)}>{statusLabel}</div>
+        <ToolStatusPill tone={hasRuntimeError ? "error" : listening ? "active" : "inactive"}>{statusLabel}</ToolStatusPill>
       </div>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.description")}</p>
       <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.legacySseNote")}</p>
-      <SettingCard divided className="rounded-md border-border/60 bg-background/70">
+      <SettingCard>
+        <SettingRow className="flex-col items-start md:flex-row md:items-center" label={t(settings.enabled ? "ai.toolSettings.httpOn" : "ai.toolSettings.httpOff")} description={settings.allowCustomBind ? t("ai.externalMcp.http.warning") : t("ai.toolSettings.loopback")}>
+          <ToolSettingsDialog title={t("ai.externalMcp.http.title")} triggerLabel={t("ai.toolSettings.configureHttp")} immediate open={open} onOpenChange={changeOpen}>
+      {applying ? <p role="status" className="text-xs text-muted-foreground">{t("ai.toolSettings.applyingHttp")}</p> : null}
+      {operationError || copyError ? <div ref={operationErrorRef} role="alert" tabIndex={-1} className="space-y-2 text-xs text-destructive">
+        {operationError ? <p>{operationError}</p> : null}
+        {copyError ? <p>{copyError}</p> : null}
+        {operationError && onRetry ? <Button type="button" variant="outline" size="sm" disabled={rotating || applying} onClick={onRetry}>{t("ai.toolSettings.retry")}</Button> : null}
+      </div> : null}
+      <p className="text-xs text-muted-foreground leading-5">{t("ai.externalMcp.http.description")}</p>
+      <SettingCard divided className="border-0 bg-transparent p-0">
         <SettingRow
-          anchorId="ai-external-mcp-http"
           label={t("ai.externalMcp.http.enable")}
         >
           <Toggle
@@ -176,6 +212,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
           <input
             type="number"
             aria-label={t("ai.externalMcp.http.port")}
+            aria-invalid={portError}
+            aria-describedby={portError ? errorId : undefined}
             min={1024}
             max={65535}
             value={portDraft}
@@ -207,6 +245,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             <input
               type="text"
               aria-label={t("ai.externalMcp.http.listenAddress")}
+              aria-invalid={addressError}
+              aria-describedby={addressError ? errorId : undefined}
               placeholder={t("ai.externalMcp.http.listenAddress.placeholder")}
               value={addressDraft}
               onChange={(event) => {
@@ -226,6 +266,8 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             <input
               type="text"
               aria-label={t("ai.externalMcp.http.clientHost")}
+              aria-invalid={clientHostError}
+              aria-describedby={clientHostError ? errorId : undefined}
               placeholder={t("ai.externalMcp.http.clientHost.placeholder")}
               value={clientHostDraft}
               onChange={(event) => {
@@ -245,8 +287,9 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
       {settings.enabled && !externalMcpEnabled ? (
         <p className="text-xs text-amber-500">{t("ai.externalMcp.http.requiresExternalMcp")}</p>
       ) : null}
-      {errorText ? <p className="text-xs text-destructive">{errorText}</p> : null}
-      <div className="space-y-2.5 rounded-md border border-border/60 bg-background/50 p-3">
+      {errorText ? <p id={errorId} role="alert" className="text-xs text-destructive">{errorText}</p> : null}
+      <details className="space-y-4">
+        <summary className="cursor-pointer text-sm font-medium">{t("ai.toolSettings.connectionDetails")}</summary>
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.url")}
           value={url}
@@ -259,6 +302,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.token")}
           value={token}
+          sensitive
           copyKey="http-token"
           copied={copied}
           onCopy={onCopy}
@@ -272,7 +316,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
             type="button"
             variant="outline"
             size="sm"
-            disabled={!externalMcpEnabled || !settings.enabled || rotating}
+            disabled={!externalMcpEnabled || !settings.enabled || rotating || applying}
             onClick={onRotateToken}
           >
             {t("ai.externalMcp.http.regenerate")}
@@ -290,6 +334,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.envLine")}
           value={token ? buildCodexHttpEnvLine(token) : ""}
+          sensitive
           copyKey="http-env"
           copied={copied}
           onCopy={onCopy}
@@ -300,6 +345,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.claudeCommand")}
           value={token ? buildClaudeHttpAddCommand(url, token) : ""}
+          sensitive
           copyKey="http-claude"
           copied={copied}
           onCopy={onCopy}
@@ -310,6 +356,7 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
         <CopyableCodeBlock
           label={t("ai.externalMcp.http.genericSnippet")}
           value={token ? buildGenericHttpMcpJson(url, token) : ""}
+          sensitive
           copyKey="http-json"
           copied={copied}
           onCopy={onCopy}
@@ -317,7 +364,14 @@ export const ExternalMcpHttpSection: React.FC<ExternalMcpHttpSectionProps> = ({
           copiedLabel={t("ai.externalMcp.copied")}
           emptyLabel={t("ai.externalMcp.unavailable")}
         />
-      </div>
-    </div>
+      </details>
+          </ToolSettingsDialog>
+        </SettingRow>
+      </SettingCard>
+      {settings.enabled && !externalMcpEnabled ? <p className="text-xs text-amber-500">{t("ai.externalMcp.http.requiresExternalMcp")}</p> : null}
+      {applying ? <p role="status" className="text-xs text-muted-foreground">{t("ai.toolSettings.applyingHttp")}</p> : null}
+      {copyError ? <p role="alert" className="text-xs text-destructive">{copyError}</p> : null}
+      {operationError || status?.error ? <p role="alert" className="text-xs text-destructive">{operationError || status?.error}</p> : null}
+    </SettingsAnchor>
   );
 };

components/settings/tabs/ai/ModelSelector.discovery.test.tsx

@@ -0,0 +1,177 @@
+import assert from 'node:assert/strict';
+import test, { after } from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { JSDOM } from 'jsdom';
+
+const dom = new JSDOM('<!doctype html><html><body></body></html>', { url: 'http://localhost/' });
+const previous = new Map<string, PropertyDescriptor | undefined>();
+for (const name of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'MutationObserver', 'CustomEvent', 'Event'] as const) {
+  previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
+  Object.defineProperty(globalThis, name, { value: dom.window[name], configurable: true });
+}
+for (const [name, value] of Object.entries({ IS_REACT_ACT_ENVIRONMENT: true, fetch: () => { throw new Error('Network is forbidden in model discovery tests'); } })) {
+  previous.set(name, Object.getOwnPropertyDescriptor(globalThis, name));
+  Object.defineProperty(globalThis, name, { value, configurable: true });
+}
+after(() => {
+  dom.window.close();
+  for (const [name, descriptor] of previous) {
+    if (descriptor) Object.defineProperty(globalThis, name, descriptor);
+    else Reflect.deleteProperty(globalThis, name);
+  }
+});
+const { I18nProvider } = await import('../../../../application/i18n/I18nProvider');
+const { TooltipProvider } = await import('../../../ui/tooltip');
+const { ModelSelector } = await import('./ModelSelector');
+
+type Response = { ok: boolean; status?: number; data: string; error?: string };
+function deferred() {
+  let resolve!: (value: Response) => void;
+  let reject!: (error: Error) => void;
+  const promise = new Promise<Response>((yes, no) => { resolve = yes; reject = no; });
+  return { promise, resolve, reject };
+}
+type Props = React.ComponentProps<typeof ModelSelector>;
+const baseProps: Props = {
+  value: '', onChange: () => {}, baseURL: 'http://127.0.0.1:9217/v1',
+  providerId: 'custom', style: 'openai', apiKey: 'SYNTHETIC_FIXTURE_KEY', customHeaders: {},
+};
+async function mount() {
+  const requests: ({ url: string; method: string; body: string | undefined } & ReturnType<typeof deferred>)[] = [];
+  const allowlistCalls: string[] = [];
+  let overflow = false;
+  Object.defineProperty(window, 'netcatty', { configurable: true, value: {
+    aiAllowlistAddHost: async (baseURL: string) => { allowlistCalls.push(baseURL); return { ok: true }; },
+    aiFetch: (url: string, method: string, _headers: unknown, body: string | undefined) => {
+      // Hold instead of rejecting if a regression exceeds the budget, so even a
+      // broken auto-fetch effect cannot create an uncontrolled test loop.
+      if (requests.length >= 4) { overflow = true; return new Promise<Response>(() => {}); }
+      const pending = deferred();
+      requests.push({ url, method, body, ...pending });
+      return pending.promise;
+    },
+  } });
+  let renderer!: ReactTestRenderer;
+  const view = (updates: Partial<Props> = {}) => <I18nProvider locale="en"><TooltipProvider>
+    <ModelSelector {...baseProps} {...updates} />
+  </TooltipProvider></I18nProvider>;
+  await act(async () => { renderer = create(view()); });
+  const input = () => renderer.root.findByType('input');
+  const open = async () => { await act(async () => input().props.onFocus()); };
+  const close = async () => { await act(async () => input().props.onBlur()); };
+  const refresh = async () => {
+    const button = renderer.root.findAllByType('button').find((node) => typeof node.props.onClick === 'function')!;
+    await act(async () => button.props.onClick({ defaultPrevented: false }));
+  };
+  const markup = () => JSON.stringify(renderer.toJSON());
+  return {
+    requests, allowlistCalls, input, open, close, refresh, markup,
+    update: async (updates: Partial<Props>) => { await act(async () => renderer.update(view(updates))); },
+    assertBounded: () => assert.equal(overflow, false, 'mock request budget was not exceeded'),
+    unmount: async () => { await act(async () => renderer.unmount()); },
+  };
+}
+const notFound: Response = { ok: false, status: 404, data: '{"error":"fixture has no model-list route"}' };
+const models = (id: string): Response => ({ ok: true, status: 200, data: JSON.stringify({ data: [{ id }] }) });
+
+for (const failure of ['404', 'transport', 'invalid-json'] as const) {
+  test(`model discovery ${failure} failure stays visible without auto-retry; Refresh retries once`, async () => {
+    const h = await mount();
+    const reject = (index: number) => {
+      if (failure === 'transport') h.requests[index].reject(new Error('Synthetic model-list transport failure'));
+      else h.requests[index].resolve(failure === '404' ? notFound : { ok: true, status: 200, data: '{not json' });
+    };
+    try {
+      assert.equal(h.requests.length, 0);
+      await h.open();
+      assert.equal(h.requests.length, 1);
+      assert.equal(h.requests[0].url, 'http://127.0.0.1:9217/v1/models');
+      assert.equal(h.requests[0].method, 'GET');
+      assert.equal(h.requests[0].body, undefined);
+      await act(async () => reject(0));
+      assert.equal(h.requests.length, 1, 'failure must settle instead of triggering the loading effect again');
+      assert.match(h.markup(), /text-destructive/);
+      assert.doesNotMatch(h.markup(), /Loading models/);
+      await h.close();
+      await h.open();
+      await h.update({ customHeaders: {} });
+      assert.equal(h.requests.length, 1, 'reopen or an equal-config render must not retry a failure');
+      assert.match(h.markup(), /text-destructive/);
+      await h.refresh();
+      assert.equal(h.requests.length, 2);
+      await act(async () => reject(1));
+      assert.equal(h.requests.length, 2);
+      assert.match(h.markup(), /text-destructive/);
+      assert.equal(h.allowlistCalls.length, 2);
+      h.assertBounded();
+    } finally { await h.unmount(); }
+  });
+}
+
+test('changing provider configuration clears a settled error and permits one fresh discovery', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 1);
+    await h.update({ baseURL: 'http://127.0.0.1:9217/second-provider/v1', providerId: 'openai' });
+    assert.equal(h.requests.length, 2);
+    assert.equal(h.requests[1].url, 'http://127.0.0.1:9217/second-provider/v1/models');
+    await act(async () => h.requests[1].resolve(models('second-model')));
+    assert.equal(h.requests.length, 2);
+    assert.match(h.markup(), /second-model/);
+    assert.doesNotMatch(h.markup(), /Failed to fetch models/);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('a provider switch ignores an older pending discovery failure', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await h.update({ baseURL: 'http://127.0.0.1:9217/second-provider/v1' });
+    assert.equal(h.requests.length, 2);
+    await act(async () => h.requests[1].resolve(models('current-model')));
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 2);
+    assert.match(h.markup(), /current-model/);
+    assert.doesNotMatch(h.markup(), /Failed to fetch models/);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('successful discovery remains cached across reopen and manual model entry remains controlled', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await act(async () => h.requests[0].resolve(models('listed-model')));
+    await h.close();
+    await h.open();
+    assert.equal(h.requests.length, 1);
+    assert.match(h.markup(), /listed-model/);
+    const changed: string[] = [];
+    await h.update({ onChange: (value) => { changed.push(value); } });
+    await act(async () => h.input().props.onChange({ target: { value: 'manual-model' } }));
+    await h.update({ value: changed[0] });
+    assert.deepEqual(changed, ['manual-model']);
+    assert.equal(h.input().props.value, 'manual-model');
+    assert.equal(h.requests.length, 1);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+});
+
+test('closing and unmounting with a pending discovery do not trigger another request', async () => {
+  const h = await mount();
+  try {
+    await h.open();
+    await h.close();
+    await act(async () => h.requests[0].resolve(notFound));
+    assert.equal(h.requests.length, 1);
+    await h.refresh();
+    assert.equal(h.requests.length, 2);
+    h.assertBounded();
+  } finally { await h.unmount(); }
+  await act(async () => h.requests[1].resolve(notFound));
+  assert.equal(h.requests.length, 2);
+});

components/settings/tabs/ai/ModelSelector.tsx

@@ -175,12 +175,12 @@ export const ModelSelector: React.FC<{
     }
   }, [baseURL, effectiveModelsEndpoint, apiKey, customHeaders, resolvedStyle, skipTLSVerify, discoveryKey]);
 
-  // Auto-fetch when dropdown first opens
+  // Failed discovery stays settled until explicit refresh or a new discovery key.
   useEffect(() => {
-    if (isOpen && canFetch && !hasFetched && !isLoading) {
+    if (isOpen && canFetch && !hasFetched && !isLoading && error === null) {
       void fetchModels();
     }
-  }, [isOpen, canFetch, hasFetched, isLoading, fetchModels]);
+  }, [isOpen, canFetch, hasFetched, isLoading, error, fetchModels]);
 
   // Filter preset and discovered models by current input value (inline autocomplete).
   const suggestions = useMemo(() => {

components/settings/tabs/ai/ToolAccessGuidance.tsx

@@ -4,6 +4,7 @@ import { useI18n } from "../../../../application/i18n/I18nProvider";
 import type { AIToolIntegrationMode } from "../../../../infrastructure/ai/types";
 import { cn } from "../../../../lib/utils";
 import { useToolAccessGuidanceState } from "../../../../application/state/useToolAccessGuidanceState";
+import { ToolSettingsDialog } from "./ToolSettingsDialog";
 import { EXTERNAL_MCP_DISCOVERY_ENV_VAR } from "./ExternalMcpCard";
 
 /** Build a ready-to-paste prompt so an external AI client can register Netcatty MCP itself. */
@@ -45,16 +46,20 @@ type CopyRowProps = {
 
 const CopyRow: React.FC<CopyRowProps> = ({ value, label, copyLabel, copiedLabel, testId }) => {
   const [copied, setCopied] = useState(false);
+  const [copyError, setCopyError] = useState(false);
+  const { t } = useI18n();
   const canCopy = Boolean(value);
 
   const handleCopy = async () => {
     if (!value) return;
+    setCopyError(false);
+    setCopied(false);
     try {
       await navigator.clipboard.writeText(value);
       setCopied(true);
       window.setTimeout(() => setCopied(false), 1200);
     } catch {
-      // Clipboard may be unavailable; the text stays selectable in the block.
+      setCopyError(true);
     }
   };
 
@@ -82,6 +87,7 @@ const CopyRow: React.FC<CopyRowProps> = ({ value, label, copyLabel, copiedLabel,
           {copied ? <Check size={14} className="text-emerald-500" /> : <Copy size={14} />}
         </button>
       </div>
+      {copyError ? <p role="alert" className="text-xs text-destructive">{t("ai.externalMcp.copyFailed")}</p> : null}
     </div>
   );
 };
@@ -93,7 +99,7 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
 
   if (mode === "skills") {
     return (
-      <div className="rounded-md border border-border/60 bg-background/50 p-3 space-y-2">
+      <ToolSettingsDialog title={t("ai.toolAccess.skills.file")} triggerLabel={t("ai.toolSettings.viewSkills")}>
         <p className="text-xs text-muted-foreground leading-5">
           {t("ai.toolAccess.skills.description")}
         </p>
@@ -110,12 +116,12 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
         {commandPrefix ? (
           <p className="text-xs text-muted-foreground/80 font-mono break-all">{commandPrefix}</p>
         ) : null}
-      </div>
+      </ToolSettingsDialog>
     );
   }
 
   return (
-    <div className="rounded-md border border-border/60 bg-background/50 p-3 space-y-2">
+    <ToolSettingsDialog title={t("ai.toolAccess.mcpPrompt.title")} triggerLabel={t("ai.toolSettings.viewPrompt")}>
       <p className="text-xs text-muted-foreground leading-5">
         {t("ai.toolAccess.mcpPrompt.description")}
       </p>
@@ -129,6 +135,6 @@ export const ToolAccessGuidance: React.FC<{ mode: AIToolIntegrationMode }> = ({
       {!mcpLauncherPath ? (
         <p className="text-xs text-amber-500">{t("ai.toolAccess.mcpPrompt.enableHint")}</p>
       ) : null}
-    </div>
+    </ToolSettingsDialog>
   );
 };

components/settings/tabs/ai/ToolSettingsDialog.tsx

@@ -0,0 +1,47 @@
+import React from "react";
+import { useI18n } from "../../../../application/i18n/I18nProvider";
+import { Button } from "../../../ui/button";
+import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle, DialogTrigger } from "../../../ui/dialog";
+
+/** Shared, bounded settings dialog. Callers retain their original commit semantics. */
+export const ToolSettingsDialog: React.FC<{
+  title: string;
+  triggerLabel: string;
+  children: React.ReactNode;
+  immediate?: boolean;
+  open?: boolean;
+  onOpenChange?: (open: boolean) => void;
+  footer?: React.ReactNode;
+  busy?: boolean;
+}> = ({ title, triggerLabel, children, immediate, open, onOpenChange, footer, busy }) => {
+  const { t } = useI18n();
+  const [localOpen, setLocalOpen] = React.useState(false);
+  const changeOpen = (next: boolean) => {
+    if (busy) return;
+    setLocalOpen(next);
+    onOpenChange?.(next);
+  };
+  return (
+    <Dialog open={open ?? localOpen} onOpenChange={changeOpen}>
+      <DialogTrigger asChild>
+        <Button type="button" variant="outline" size="sm">{triggerLabel}</Button>
+      </DialogTrigger>
+      <DialogContent
+        className="flex max-h-[calc(100dvh-2rem)] w-[calc(100vw-2rem)] max-w-2xl flex-col gap-0 overflow-hidden p-0"
+        aria-busy={busy || undefined}
+        hideCloseButton={busy}
+        onEscapeKeyDown={(event) => { if (busy) event.preventDefault(); }}
+        onInteractOutside={(event) => { if (busy) event.preventDefault(); }}
+      >
+        <DialogHeader className="shrink-0 px-6 pb-4 pt-6 pr-12 text-left">
+          <DialogTitle>{title}</DialogTitle>
+          {immediate ? <p className="text-xs text-muted-foreground">{t("ai.toolSettings.immediate")}</p> : null}
+        </DialogHeader>
+        <div className="min-h-0 overflow-y-auto px-6 pb-6 space-y-4">{children}</div>
+        <DialogFooter className="shrink-0 gap-2 border-t px-6 py-4">
+          {footer ?? <Button type="button" variant="outline" onClick={() => changeOpen(false)}>{t("common.close")}</Button>}
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

components/settings/tabs/ai/ToolStatusPill.tsx

@@ -0,0 +1,14 @@
+import React from "react";
+import { cn } from "../../../../lib/utils";
+
+export type ToolStatusTone = "active" | "inactive" | "error";
+
+/** Non-interactive runtime status, shared by the MCP and HTTP section headers. */
+export const ToolStatusPill: React.FC<{ tone: ToolStatusTone; children: React.ReactNode }> = ({ tone, children }) => (
+  <span role="status" className={cn(
+    "inline-flex shrink-0 items-center rounded-full px-2.5 py-0.5 text-xs font-medium leading-5",
+    tone === "active" ? "bg-primary/10 text-primary"
+      : tone === "error" ? "bg-destructive/10 text-destructive"
+        : "bg-muted text-muted-foreground",
+  )}>{children}</span>
+);

components/sftp/SftpOverlays.tsx

@@ -264,6 +264,7 @@ export const SftpOverlays: React.FC<SftpOverlaysProps> = React.memo(({
               open={showTextEditor}
               onClose={closeTextEditor}
               fileName={textEditorFileName}
+              filePath={textEditorTarget?.fullPath}
               initialContent={textEditorContent}
               onSave={handleSaveTextFile}
               editorWordWrap={editorWordWrap}

components/sftp/hooks/useSftpViewFileOps.ts

@@ -248,7 +248,7 @@ export const useSftpViewFileOps = ({
       hostId: target.hostId,
       remotePath: target.fullPath,
       fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
       content: snapshot.content,
       baselineContent: snapshot.baselineContent,
       wordWrap: snapshot.wordWrap,
@@ -284,7 +284,7 @@ export const useSftpViewFileOps = ({
       hostId: target.hostId,
       remotePath: target.fullPath,
       fileName: target.file.name,
-      languageId: snapshot.languageId || getLanguageId(target.file.name),
+      languageId: snapshot.languageId || getLanguageId(target.fullPath),
       content: snapshot.content,
       baselineContent: snapshot.baselineContent,
       wordWrap: snapshot.wordWrap,

components/sftp/nginxEditorLanguage.test.ts

@@ -0,0 +1,131 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import ts from 'typescript';
+import type { TextEditorPaneProps } from '../editor/TextEditorPane';
+import type { SftpStateApi } from '../../application/state/useSftpState';
+import { editorTabStore } from '../../application/state/editorTabStore';
+import { activeTabStore } from '../../application/state/activeTabStore';
+import { useSftpViewFileOps } from './hooks/useSftpViewFileOps';
+
+// Keep the real modal state/save flow; replace only Monaco and visual chrome.
+function loadModal(pane: React.ComponentType<TextEditorPaneProps>) {
+  const url = new URL('../TextEditorModal.tsx', import.meta.url);
+  const compiled = ts.transpileModule(readFileSync(url, 'utf8'), { compilerOptions: {
+    module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022,
+    jsx: ts.JsxEmit.ReactJSX, esModuleInterop: true,
+  } }).outputText;
+  const require = createRequire(url);
+  const passthrough = ({ children }: { children: React.ReactNode }) => children;
+  const replacements: Record<string, unknown> = {
+    './editor/TextEditorPane': { TextEditorPane: pane },
+    './ui/dialog': { Dialog: passthrough, DialogContent: passthrough, DialogTitle: passthrough },
+    './ui/toast': { toast: { success() {}, error() {} } },
+    '../application/state/windowInputFocus': { scheduleWindowInputFocus() {} },
+  };
+  const module = { exports: {} as { default: React.ComponentType<Record<string, unknown>> } };
+  new Function('require', 'module', 'exports', compiled)(
+    (id: string) => replacements[id] ?? require(id), module, module.exports,
+  );
+  return module.exports.default;
+}
+
+test('SFTP modal uses full paths, preserves manual selection and saves exact content', async () => {
+  const globals = globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean };
+  const previousAct = globals.IS_REACT_ACT_ENVIRONMENT;
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
+  const previousActiveTab = activeTabStore.getActiveTabId();
+  const detached: Array<{ languageId: string; content: string; remotePath: string }> = [];
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
+    setTimeout, clearTimeout,
+    netcatty: { openEditorWindow: async (snapshot: typeof detached[number]) => {
+      detached.push(snapshot);
+      return { success: true };
+    } },
+  } });
+  globals.IS_REACT_ACT_ENVIRONMENT = true;
+  let paneProps: TextEditorPaneProps | undefined;
+  const Modal = loadModal((props) => { paneProps = props; return null; });
+  let ops: ReturnType<typeof useSftpViewFileOps> | undefined;
+  const original = '# fixture\r\nserver { proxy_pass http://$host; }\r\n';
+  const writes: unknown[][] = [];
+  const connection = { id: 'nginx-fixture', hostId: 'nginx-host', currentPath: '/etc/nginx/conf.d' };
+  const sftpRef = { current: {
+    leftPane: { id: 'nginx-pane', connection }, rightPane: { id: 'nginx-pane', connection },
+    joinPath: (parent: string, name: string) => `${parent}/${name}`,
+    readTextFile: async () => original,
+    writeTextFile: async (...args: unknown[]) => { writes.push(args); },
+  } as unknown as SftpStateApi };
+  function Probe() {
+    ops = useSftpViewFileOps({
+      sftpRef, behaviorRef: { current: '' }, autoSyncRef: { current: false },
+      getOpenerForFileRef: { current: () => null }, setOpenerForExtension() {}, t: (key) => key,
+    });
+    return ops.showTextEditor ? React.createElement(Modal, {
+      open: true, onClose() {}, fileName: ops.textEditorTarget!.file.name,
+      filePath: ops.textEditorTarget!.fullPath, initialContent: ops.textEditorContent,
+      onSave: ops.handleSaveTextFile, editorWordWrap: false, onToggleWordWrap() {},
+      hotkeyScheme: 'pc', keyBindings: [], onPromoteToTab: ops.onPromoteToTab,
+    }) : null;
+  }
+  let renderer: ReactTestRenderer | undefined;
+  try {
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    const file = { name: 'site.conf', size: original.length, type: 'file' as const, lastModified: 0, sizeFormatted: '', lastModifiedFormatted: '' };
+    await act(async () => { await ops!.onEditFileLeft(file); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    assert.equal(paneProps!.fileName, 'site.conf');
+    // Keep the modal mounted: basename and content stay identical, only path changes.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/site.conf'); });
+    assert.equal(paneProps!.languageId, 'nginx');
+    await act(async () => { paneProps!.onLanguageChange('ini'); });
+    await act(async () => { paneProps!.onSave(); });
+    assert.deepEqual(writes, [['left', '/etc/nginx/conf.d/site.conf', original]]);
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    let tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'ini', 'promotion preserves a manual override');
+    assert.equal(tab?.content, original);
+    editorTabStore.close(tab!.id);
+
+    // A generic config can still be switched to Nginx manually.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/other/site.conf'); });
+    assert.equal(paneProps!.languageId, 'ini');
+    await act(async () => { paneProps!.onLanguageChange('nginx'); });
+    assert.equal(paneProps!.languageId, 'nginx', 'arbitrary config supports manual Nginx selection');
+    await act(async () => { paneProps!.onPromoteToTab!(); });
+    tab = editorTabStore.getTabs().find(({ sessionId }) => sessionId === connection.id);
+    assert.equal(tab?.languageId, 'nginx');
+
+    // Legacy snapshots without language still infer from the full target path.
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/conf.d/fallback.conf'); });
+    await act(async () => { ops!.onPromoteToTab({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(editorTabStore.getTabs().find(({ remotePath }) => remotePath.endsWith('/fallback.conf'))?.languageId, 'nginx');
+    await act(async () => { await ops!.onEditFileLeft(file, '/etc/nginx/sites-enabled/example.com'); });
+    await act(async () => { ops!.onPopOut({ fileName: file.name, content: original,
+      baselineContent: original, languageId: '', wordWrap: false, viewState: null }); });
+    assert.equal(detached.at(-1)?.languageId, 'nginx', 'pop-out fallback also uses the full path');
+    assert.equal(detached.at(-1)?.remotePath, '/etc/nginx/sites-enabled/example.com');
+    assert.equal(detached.at(-1)?.content, original);
+  } finally {
+    await act(async () => { renderer?.unmount(); });
+    for (const tab of editorTabStore.getTabs().filter(({ sessionId }) => sessionId === connection.id)) editorTabStore.close(tab.id);
+    activeTabStore.setActiveTabId(previousActiveTab);
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+    globals.IS_REACT_ACT_ENVIRONMENT = previousAct;
+    if (previousWindow) Object.defineProperty(globalThis, 'window', previousWindow);
+    else Reflect.deleteProperty(globalThis, 'window');
+  }
+});
+
+test('the SFTP overlay forwards path context to the lazy modal', () => {
+  const overlay = readFileSync(new URL('./SftpOverlays.tsx', import.meta.url), 'utf8');
+  assert.match(overlay, /<LazyTextEditorModal[\s\S]*?filePath=\{textEditorTarget\?\.fullPath\}/);
+  const pane = readFileSync(new URL('../editor/TextEditorPane.tsx', import.meta.url), 'utf8');
+  assert.match(pane, /beforeMount=\{registerNginxLanguage\}/);
+});

components/terminalLayer/TerminalLayerSupport.tsx

@@ -283,6 +283,8 @@ interface AIChatPanelsHostProps {
   mountedTabIds: string[];
   activeTabId: string | null;
   activeSidePanelTab: SidePanelTab | null;
+  /** All live terminal+workspace target ids (for /chats dangling detection). */
+  liveScopeTargetIds: Set<string>;
   contextsByTabId: Map<string, AIPanelContext>;
   resolveExecutorContext: (scope: {
     type: 'terminal' | 'workspace';
@@ -298,6 +300,8 @@ interface AIChatPanelsHostProps {
   onOpenVaultHostFromChat?: (hostId: string) => void;
   onOpenVaultSectionFromChat?: (section: 'notes' | 'hosts' | 'snippets') => void;
   onOpenVaultSnippetFromChat?: (snippetId: string) => void;
+  /** Live workspaces, threaded to AI chats for `/chats` scope titles. */
+  workspaces?: Workspace[] | null;
 }
 
 const EMPTY_WORKSPACES: Workspace[] = [];
@@ -450,6 +454,7 @@ function aiChatPanelsHostAreEqual(
   next: AIChatPanelsHostProps,
 ): boolean {
   if (prev.mountedTabIds !== next.mountedTabIds) return false;
+  if (prev.liveScopeTargetIds !== next.liveScopeTargetIds) return false;
   if (prev.contextsByTabId !== next.contextsByTabId) return false;
   if (prev.activeSidePanelTab !== next.activeSidePanelTab) return false;
   if (prev.pendingTerminalSelection !== next.pendingTerminalSelection) return false;
@@ -462,6 +467,7 @@ function aiChatPanelsHostAreEqual(
   if (prev.onOpenVaultHostFromChat !== next.onOpenVaultHostFromChat) return false;
   if (prev.onOpenVaultSectionFromChat !== next.onOpenVaultSectionFromChat) return false;
   if (prev.onOpenVaultSnippetFromChat !== next.onOpenVaultSnippetFromChat) return false;
+  if (prev.workspaces !== next.workspaces) return false;
   if (prev.activeTabId === next.activeTabId) return true;
 
   for (let i = 0; i < prev.mountedTabIds.length; i += 1) {
@@ -489,6 +495,7 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
   mountedTabIds,
   activeTabId,
   activeSidePanelTab,
+  liveScopeTargetIds,
   contextsByTabId,
   resolveExecutorContext,
   pendingTerminalSelection,
@@ -500,6 +507,7 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
   onOpenVaultHostFromChat,
   onOpenVaultSectionFromChat,
   onOpenVaultSnippetFromChat,
+  workspaces,
 }) => {
   const aiConfig = useContext(AIConfigContext);
 
@@ -517,6 +525,10 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
     showDraftView,
     updateDraft,
   } = aiConfig;
+  const aiPanelWorkspaces = useMemo(
+    () => (workspaces ?? []).map((workspace) => ({ id: workspace.id, title: workspace.title })),
+    [workspaces],
+  );
 
   useEffect(() => {
     if (!pendingTerminalSelection) return;
@@ -588,6 +600,9 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
                     undoLastTurnInSession={aiConfig.undoLastTurnInSession}
                     deleteSession={aiConfig.deleteSession}
                     updateSessionTitle={aiConfig.updateSessionTitle}
+                    rebindSessionScope={aiConfig.rebindSessionScope}
+                    exportSessionsBackup={aiConfig.exportSessionsBackup}
+                    importSessionsBackup={aiConfig.importSessionsBackup}
                     updateSessionExternalSessionId={aiConfig.updateSessionExternalSessionId}
                     addMessageToSession={aiConfig.addMessageToSession}
                     updateLastMessage={aiConfig.updateLastMessage}
@@ -621,7 +636,9 @@ const AIChatPanelsHostInner: React.FC<AIChatPanelsHostProps> = ({
                     scopeHostIds={context.scopeHostIds}
                     scopeLabel={context.scopeLabel}
                     focusedSessionId={context.focusedSessionId}
+                    workspaces={aiPanelWorkspaces}
                     terminalSessions={context.terminalSessions}
+                    liveScopeTargetIds={liveScopeTargetIds}
                     resolveExecutorContext={resolveExecutorContext}
                     isVisible={isVisible}
                     notes={notes}

components/terminalLayer/terminalLayerSidePanelSlots.tsx

@@ -654,6 +654,7 @@ function SidePanelAiSlotInner({
         mountedTabIds={mountedAiTabIds}
         activeTabId={activeTabId}
         activeSidePanelTab={isVisible ? 'ai' : null}
+        liveScopeTargetIds={validAIScopeTargetIds}
         contextsByTabId={aiContextsByTabId}
         resolveExecutorContext={resolveAIExecutorContext}
         pendingTerminalSelection={pendingTerminalSelectionForAI}
@@ -665,6 +666,7 @@ function SidePanelAiSlotInner({
         onOpenVaultHostFromChat={onOpenVaultHostFromChat}
         onOpenVaultSectionFromChat={onOpenVaultSectionFromChat}
         onOpenVaultSnippetFromChat={onOpenVaultSnippetFromChat}
+        workspaces={workspaces}
       />
     </AISidePanelStateRoot>
   );

docs/plugin-platform/author-identity.md

@@ -0,0 +1,58 @@
+# Plugin author presentation
+
+The marketplace displays the catalog's author next to a small avatar. Installed
+views reuse the author row. Missing, loading, unavailable, or invalid imagery
+uses a bundled placeholder. An avatar is presentation metadata, not proof of an
+authenticated GitHub publisher.
+
+The registry binds an image to its reviewed displayed-author subject. Repository
+ownership alone does not establish that subject. The current first-party author
+is the Netcatty project, not an assumed personal GitHub identity. Until an image
+pin is reviewed, its avatar remains null.
+
+## Avatar delivery
+
+Delivery v2 extends the reserved `avatar` field to null or
+`{path, sha256, size}`. The path is exactly `/assets/<sha256>.png` or `.webp`.
+Size is a positive integer no greater than 256KiB. The delivery digest and existing
+id/version/repository/commit tuple bind the reference. Catalog and index identity
+fields do not change. Source-only delivery v1 remains supported.
+
+Only the main process fetches the selected source's same-origin asset. Existing
+URL, credential, redirect, timeout, byte-count, and SHA-256 checks apply. The host
+rechecks the source and selection after asynchronous work. The existing isolated
+icon rasterizer validates and converts PNG or WebP to a bounded PNG data URI,
+using its current queue, pending-work map, and cache. No renderer URL, arbitrary
+file path, GitHub API, or GitHub avatar URL is accepted. Visible rows load lazily.
+
+Installed presentation uses already validated catalog metadata only when source,
+version, package digest, and manifest match the active installation. It does not
+fetch a catalog just because the installed list opens. Without an exact match,
+the declared publisher and placeholder remain visible, without a maintenance
+badge. No installed-data migration or persistent identity cache is added.
+
+## Official maintenance
+
+The borderless gold pill means that the Netcatty project maintains the plugin.
+It does not certify the plugin's safety or grant permissions. It is separate
+from the official marketplace source label.
+
+The main process requires the built-in official source and one of these explicit
+first-party ID and repository pairs:
+
+- `com.netcatty.starter`, `binaricat/Netcatty`
+- `com.netcatty.hello`, `binaricat/Netcatty`
+
+A local import, a third-party copy, an ID prefix, author text, manifest publisher,
+README, or membership in the official marketplace cannot create this badge.
+The renderer consumes the host result through the existing trusted-app IPC
+boundary. No new plugin permission or plugin RPC is introduced.
+
+## Validation scope
+
+Focused registered tests cover source spoofing, exact installed identity,
+hash-bound images, invalid metadata and decoding, redirects, source removal,
+selection changes, cache reuse, lazy loading, stale UI cleanup, placeholders,
+and borderless light/dark theme classes. These tests do not establish native
+layout, actual account identity, live CDN deployment, or successful network access.
+Actual app screenshots and native acceptance remain separately scheduled.

docs/plugin-platform/contract-and-sdk.md

@@ -450,6 +450,13 @@ new child to an opened parent directory without a path race.
 `readDirectory()` likewise keeps its stable SDK/RPC method but fails closed
 unless the main process supplies a native adapter whose inode checks and entry
 enumeration are bound to the same directory handle.
+The host advertises `filesystem.directory-enumeration` only when it supplies that
+adapter. Declare the feature as required, or optional and check
+`context.enabledFeatures.has(PLUGIN_FILESYSTEM_DIRECTORY_ENUMERATION_FEATURE)`.
+The default host supplies no adapter and does not enable this feature. Both the
+SDK and direct RPC return `unsupported` before a permission request or path probe.
+An enabled feature still requires the declared `filesystem.read` directory
+resource and the normal permission, root, symlink and same-handle checks.
 
 Permission names already use the phase-3 enforcement boundaries: clipboard
 read/write, terminal metadata/output/input and input/output interception, Vault

docs/plugin-platform/foundation-landing.md

@@ -0,0 +1,121 @@
+# Plugin foundation landing candidate
+
+Draft #4011 is the single landing vehicle for the accumulated plugin foundation.
+Earlier integration records describe frozen evidence, not the current acceptance
+status. This candidate preserves their source history through ordinary merges.
+The user cancelled the reference-driven row redesign. Installed grid and Settings
+quick-toggle layout are restored exactly to b14, while author presentation and all
+functional/security corrections remain. Cancelled visual commits stay in history
+with attributable reverts; they are not effective changes in the landing tree.
+It does not include global Agent/custom Chat #4006/#4012, model-picker #4002,
+or terminal diagnostic #3999. No older source PR is closed by this preparation.
+
+## Included commits
+
+| Input | Exact input | Ordinary integration |
+| --- | --- | --- |
+| Prior #4011 | `d40b0d3c25ed00a33679e83be948fd1a5aa10bfa` | Starting point; all inherited contributions retained |
+| Current main | `2796d1113a6310fae1779931f242e208a69b95a5` | `db1223d16`; Nginx #4010, macOS appearance #4013, closed-socket MCP reconnect #4016 |
+| Author metadata and preserved visual history | `e4eb33856b335fe0b1d302827b1325ddfc23bdde` | `b3895a477`; preserves original avatar/badge, canonical v2 schema, b14 invalidation, visual-worker patch subsequently reverted |
+| Directory availability | `a36a906292cbe8033bc19b596dcaf7f853a804c7` | `d035cbea3`; no native adapter or expanded permission |
+| Two-profile sync composition | `14ed19d2ed7cd1ecc201c9c910b112e97cc098ff` | `fc37ac48e`; tests only |
+| Restore pre-row layout | `7e7b05620ff800ae459d0bf007bbace6aaebbdbc` | Normal revert of e4 row commit; all six layout paths match parent `b14b65679ffd9c617bb0aa1215d8653c53430243` |
+| Rejected-install catalog refresh | `50fda91424c915c1497e53a87a210e3943cb1e39` | Separate correction after bounded review; service and mounted-row regression only |
+
+The separately published icon branch first reverted its outline correction
+(`530ff0318`), then the e4 row commit (`6e4465f47`). Neither outline correction nor
+those isolated reverts are imported here; foundation never included the outline.
+The e4 and 1f renderer artifacts are historical pre-cancellation evidence, not
+accepted final UI. No further cancelled-design build or screenshot is requested.
+
+The only manual merge conflict was the end of `index.css`. Resolution retains
+both the prior host-security theme block and main's window-background-blur block,
+with their declarations unchanged. Automatic combinations retain main appearance
+wiring alongside plugin settings/theme wiring, all five locales, preload methods,
+the host services and SDK exports. No permission, source, endpoint, sandbox or
+selected-resource restriction is relaxed. Package and lock inputs are unchanged.
+
+`50fda9142` reuses the same selection-token comparison after an install-triggered
+catalog refresh, including an install rejected for a changed/withdrawn selection.
+The rejection is preserved; mounted authors no longer retain withdrawn enrichment.
+The regression makes no package download or execution. It also preserves the
+original synchronous unavailable-source rejection in `list()`: the first aggregate
+runtime run caught that b14 changed it into a Promise rejection. The assertion was
+not weakened. Corrected aggregate runtime: 711 pass, one native skip, zero failures
+or cancellations. The original failed run and fail-before regression are retained.
+
+## Checks and packages
+
+Registered runtime, SDK/contract, Settings and actual connected host entrypoints,
+changed-main MCP/appearance/editor regressions, example preparation, code generation,
+lint and the normal production renderer build are run on this candidate. Exact
+head, commands, counts and CI links are recorded in #4011. Package provenance is
+in [the bounded sample manifest](foundation-packages.json): each archive is built
+twice and whole-byte compared. Assistant is byte-identical to d40; Host changes
+only README wording, with manifest/entrypoint unchanged. Database-owned, Rfam and
+terminal archives change only `browser.js` minified bound identifier spelling.
+Rebuilding the same sources with d40's generated SDK/contract artifacts reproduces
+the exact old archive hashes. Parsing and normalizing lexical bindings yields
+identical ASTs for all three bundles; manifests, protocol and permissions do not
+change. Preparation does not connect, activate or query.
+
+Local checks at pre-restoration1f: runtime 711 pass/one existing native skip; SDK91; Settings and
+connected host/security78; changed-main MCP/appearance/editor71; examples five
+pass/one Docker opt-in skip. Contract/capability/Codex generation has no drift;
+lint zero errors/seven existing warnings; normal production build36.13s. These
+checks do not claim native UI, packaging or encrypted transport acceptance.
+Restoration-focused layout/author tests: six pass; changed-file lint and diff
+checks clean. Two broader Settings runs each had38pass/one PluginLogSettings
+file-entry failure, without a detailed assertion; that file alone passed. Their
+cause remains unclassified and both failed runs are retained. No production log
+change or baseline attribution is made. Every one of the six layout paths exactly matches b14; fourteen functional
+paths (identity/provenance, permissions, directory availability and sync included)
+remain byte-identical to1f. The five sample records remain unchanged. Pre-restoration1f exact CI completed:
+[test40505644082](https://github.com/binaricat/Netcatty/actions/runs/40505644082)
+records15,372pass/50skip/zero failures or cancellations on its successful retry;
+[packages40505644200](https://github.com/binaricat/Netcatty/actions/runs/40505644200)
+passed all four platforms with release skipped. Its original runner shutdown is
+retained. These results do not certify the restored head.
+
+An earlier coding-executor full suite timed out after 15 minutes: 31 failures and
+482 cancellations. Seven failures reproduced on unchanged d40; 24 were not probed
+on that baseline. They remain unresolved evidence, not assumed baseline failures.
+No additional long local full suite is used to conceal them. Clean-run exact-head
+CI is a separate aggregate check and does not diagnose that historical run.
+
+## Acceptance and landing order
+
+1. Foundation: keep #4011 Draft until integrated CI/review and affected native UI
+   acceptance settle. d40 Settings, Host/Vault policy, terminal A/B selection and
+   inert multiline draft isolation, and native chat split/drag ownership passes
+   are historical evidence at their stated heads. They do not certify this new
+   current-main merge tree. The e4/07b reference-driven row design is cancelled;
+   stop its native visual work. Restored layout retains author/avatar presentation.
+   Avatar/catalog behavior and the final install-refresh correction still require
+   their scoped review/acceptance; cancellation does not erase functional gates.
+2. Marketplace distribution: retain static-source identity and v2 delivery checks,
+   but track reviewed registry data, actual hosting/CDN and install/update/source
+   replacement/withdrawal acceptance separately. Current live source-only viewing
+   is not installation or deployment acceptance. Never weaken admitted-source or
+   destination guards to manufacture a pass.
+3. Global Agent: #4006/#4012 remain a separate later increment, with their own
+   scope, review, CI and actual sample smoke. #4002 is also separate.
+
+Historical integration vehicles #3967/#3989/#3993/#3997/#4001/#4004 are superseded
+as landing vehicles, not discarded contributions. Their ancestors and native
+receipts stay available. Unique source PRs remain intact; no premature closures.
+
+Directory enumeration is intentionally unavailable in the default production
+composition until a same-handle adapter exists. The advertised feature now tells
+SDK callers the truth; filesystem permission alone does not enable it. The new
+sync composition test proves local collect/apply/hydrate with real databases, not
+encrypted cloud transport or native cloud-account sync. A native compatibility
+transition needs two properly versioned builds; two 0.0.0 checkouts do not qualify.
+
+Public database acceptance remains blocked by the retained TCP refusal before
+protocol payload; the separately owned local fixture is pending. Source-policy,
+compatibility and database gates must be explicitly reconciled by the parent,
+not silently removed from requirements. Nested log-dialog overlap has source
+coverage but no normal native route in the tested UI. This is code-readiness work,
+not a claim that deployment, every original requirement or the whole project is
+complete. No main merge, Ready transition, release or live metadata publication.

docs/plugin-platform/foundation-packages.json

@@ -0,0 +1,177 @@
+[
+  {
+    "name": "assistant",
+    "id": "com.netcatty.assistant",
+    "version": "0.1.0",
+    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "bytes": 17214,
+    "fileCount": 6,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        "ai.invoke",
+        "context.selected.list",
+        "context.selected.read"
+      ]
+    },
+    "features": {
+      "required": [
+        "ai.model-invocation",
+        "context.selected-read"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [],
+    "delta": "Archive byte-identical."
+  },
+  {
+    "name": "database-owned",
+    "id": "com.netcatty.database-minimal",
+    "version": "0.1.0",
+    "sha256": "3c67f529cd5d2843dbf74a62d237b7b7d50d24a466ade85cce76b3adfff919a2",
+    "bytes": 11660,
+    "fileCount": 5,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://10.77.0.20:3306"
+          ],
+          "reason": "Connect only to the prepared disposable fixture."
+        }
+      ]
+    },
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "boundIdentifierAlphaEquivalent": true
+  },
+  {
+    "name": "database-rfam-readonly",
+    "id": "com.netcatty.database-rfam-readonly",
+    "version": "0.1.0",
+    "sha256": "554407c067ced0a6634599b7eccc7c6dbb4f2ff7c523d0bacbbbd4fb78c04612",
+    "bytes": 11003,
+    "fileCount": 5,
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
+          ],
+          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
+        }
+      ]
+    },
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "boundIdentifierAlphaEquivalent": true
+  },
+  {
+    "name": "host-actions",
+    "id": "com.netcatty.host-actions",
+    "version": "0.1.0",
+    "sha256": "9713f001449b0c749f518d42f013fa72ead6dd43f8e7ddd7843cc6ecc03027f9",
+    "bytes": 4789,
+    "fileCount": 3,
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "vault.metadata",
+        "vault.write",
+        "ui.interact"
+      ]
+    },
+    "features": {
+      "required": [
+        "vault.host-actions",
+        "commands.interactive"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "README.md"
+    ],
+    "delta": "README wording follows permission policy. Manifest and browser entrypoint are byte-identical."
+  },
+  {
+    "name": "terminal-selection-draft",
+    "id": "com.netcatty.terminal-selection-draft",
+    "version": "0.1.0",
+    "sha256": "aaadd8687b1af1d6e1f9a56c52760ac0d19e7ed4e8212fb7c8775ed052ed74f1",
+    "bytes": 2954,
+    "fileCount": 2,
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "terminal.selection.read",
+        "terminal.input.propose"
+      ]
+    },
+    "features": {
+      "required": [
+        "terminal.selection-sharing",
+        "terminal.input-drafts",
+        "commands.interactive"
+      ]
+    },
+    "repeatIdentical": true,
+    "previousD40Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "preparedOnly": true,
+    "noConnectionOrActivation": true,
+    "changedEntriesFromD40": [
+      "browser.js"
+    ],
+    "delta": "Generated SDK export changes alter only minified bound identifier spelling; scope-aware normalized AST is identical.",
+    "oldGeneratedRebuildSha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "boundIdentifierAlphaEquivalent": true
+  }
+]

docs/plugin-platform/global-agent-qa.md

@@ -0,0 +1,92 @@
+# Global Agent continuation: bounded QA recipe
+
+This is a separate increment after the plugin platform foundation. The transport
+review checkpoint is #4012 at `ea619555`; its isolated correction is `63f0572e0`.
+The runtime continuation carries the correction through an ordinary feature-branch
+merge. It is not merged to main or accepted for release.
+
+## Reproduce the installable sample
+
+From the exact runtime head reported in the handoff:
+
+```sh
+npm ci
+npm run build:plugin-runtime-deps
+node examples/plugins/global-agent/build.mjs
+node packages/plugin-cli/dist/cli.js pack examples/plugins/global-agent/.package --out /tmp/netcatty-global-agent.ncpkg
+sha256sum /tmp/netcatty-global-agent.ncpkg
+```
+
+The reproducible sample SHA-256 is
+`f0edf43523845847d5dbb74b0c4d8cd3bfe8e0f89ca193f28140e6b47dc45ed0`.
+Two independent package builds matched. Build scripts and tests are excluded
+from the six-file installed package.
+
+The sample reserves transcript space inside the actual 798-by-548-pixel plugin
+viewport measured during native QA. In a scheduled native test environment, run
+`npm run test:plugin-global-agent-layout` for the bounded render regression. It
+loads the real sample HTML/CSS with synthetic history, including the fixture
+notice, and checks transcript scrolling, reachable configuration, and visible
+mouse Stop. It does not load the plugin script or start an Agent/provider. This
+render check remains pending where the normal browser sandbox cannot start;
+do not disable the sandbox to run it. Also verify the installed sample visually
+at the 1188-by-848-pixel app window before accepting the viewport correction.
+
+For the modal-history lifecycle regression, stop the synthetic stream, close
+the modal with the host X, and reopen it without disabling/restarting the
+plugin or waiting for five-minute lease expiry. Select the owned conversation,
+confirm fresh empty targets, and Open. History must load without another model
+request. Repeat with a new conversation. The sample command runtime retains
+only its last host-issued chat handle and releases that exact lease on explicit
+Open; it does not change core expiry, source ownership or duplicate-open guards.
+
+## Native fixture acceptance (parent-scheduled GUI only)
+
+1. Use an isolated synthetic profile, no real Notes, hosts, histories or keys.
+   Start `node scripts/plugin-global-agent-provider-fixture.mjs --port 9218`.
+   It performs no inference or outbound request and logs no bodies/headers.
+2. Through normal host settings, configure an OpenAI-compatible Chat Completions
+   provider at `http://127.0.0.1:9218/v1`, model `global-agent-fixture`, with the
+   fixture-only literal `FIXTURE_ONLY_API_MARKER`. Do not use real credentials,
+   paid services, allowlist edits, debugger injection or the builtin AI sidebar.
+3. Install the `.ncpkg` in Settings → Plugins and open its contributed Global
+   Agent Chat view. Verify light/dark/accent updates using existing theme tokens.
+4. Choose Catty. Choose no targets, or only owned synthetic terminal fixtures,
+   then Open conversation. The fixture's default tool is `get_environment`; it
+   never requests a terminal command. Record Send → streamed result/usage and
+   `GET /fixture/status` counters. This proves a deterministic pipeline, not
+   real model inference.
+5. Send `fixture:wait`, wait for output, press Stop. Verify aborted count rises
+   once and no late text appears. Capture screenshot/video with fixture labels.
+6. Exercise Actions Ask using the existing in-app policy dialog: approve and
+   deny the scoped environment tool separately. Actions Deny permits model-only
+   chat with no tools. Agent-use Deny prevents dispatch. A policy change revokes
+   existing handles; reselect/reopen explicitly before another Send.
+7. Close/reopen and disable/re-enable only this synthetic plugin. Reselect its
+   targets and reopen its owned conversation. History should survive, while the
+   private per-open actor ID is fresh. At five-minute expiry, the sample asks for
+   explicit reselection and keeps the draft, without resending or renewing scope.
+8. Revoke/disable or lock while streaming and verify cleanup/no late events.
+   Disconnect/re-own a selected synthetic worker during selection and a turn;
+   stale selections must fail instead of binding a replacement connection.
+
+Do not activate a configured real Claude backend in this fixture recipe. Claude
+MCP's code/handler boundary is covered with synthetic tests; authenticated service
+and genuine CLI acceptance remain unverified and require separately approved
+access. Other backends are explicitly unsupported/unavailable. No background
+service, blanket OS/Vault access, merge or release is implied.
+
+## Evidence and limits
+
+- Installed Catty path uses actual `AgentRuntime`, driver, main provider admission,
+  source policy and worker dispatcher, with JSDOM/in-process plugin transport and
+  synthetic workers. It proves selected B dispatch, stream, Stop, revocation and
+  history after runtime restart. This is not a native BrowserWindow sandbox test.
+- Main/core tests cover source/session/resource substitution, scope expiry,
+  approval waits, worker lifecycle, cancellation, late completion, stable source
+  budgets, source-isolated history and no key serialization. Filesystem API reads
+  cannot access the core history root. Explicitly granted terminal commands still
+  have that terminal's native OS authority.
+- No GUI ran in this executor. Native screenshots/video and independent runtime
+  review remain parent-owned gates. The exact-head CI result must be reported
+  separately from focused local evidence.

docs/plugin-platform/global-agent-wip.md

@@ -0,0 +1,309 @@
+# Global Agent plugin bridge (work in progress)
+
+This stack starts from `integration/plugin-ask-routing-acceptance` at
+`2433cf0130d1c3274c56c39e5765349c2945de01`. The parent confirmed this dependency;
+its native Ask acceptance and integrated CI are still pending. This branch does
+not modify the frozen candidate, #3986, #3998, or #4002.
+
+The user approved a global conversation independent of a terminal or workspace,
+with a plugin-provided chat UI and selectable existing Agent backends. Core owns
+Agent execution, history, target authority, native approvals, credentials and
+audit. Global is not unrestricted inventory access or a background service.
+
+## Stage 1: dispatch authority
+
+`electron/plugins/agent/delegatedScope.cjs` is a host-only authority. It does not
+register plugin APIs, start an Agent or implement an orchestration loop.
+
+- `issue(context, hostSnapshot)` authenticates with the existing source binding.
+  Host snapshots contain backend identity/revision, target kind/id/owner/revision,
+  synchronous current-owner checks, and a supported capability subset. The public
+  result contains only an opaque handle and expiry. Plugin parameters must never
+  be used as `hostSnapshot`.
+- `begin(handle, context)` returns an internal turn ticket and AbortController.
+- `dispatch(ticket, context, resolvedAction, execute)` runs the common host policy
+  adapter once, checks current target revisions after any approval wait, invokes
+  the real dispatcher, and rejects late results. `resolvedAction` must come from
+  canonical host capability/argument resolution, not an unchecked plugin object.
+- `assertTurn` guards outgoing events. `finish` and `stop` invalidate the exact
+  ticket. Runtime/plugin release, lock/hide invalidation and shutdown abort work.
+- Handles expire in five minutes. There are at most eight per runtime owner and
+  64 overall, with at most 32 explicit resources per scope. Expiry never silently
+  refreshes a selection or revives an old turn.
+
+The focused tests use the actual `PluginAISourceBinding` with synthetic host
+registries, two terminal owners representing different workspaces, controlled
+time, and deferred approval/native completion. They cover source/runtime/target
+substitution, focus changes, revision changes across approval, policy denial,
+Stop, release, lock, late completion and bounds. They do not yet prove actual MCP
+or AgentRuntime dispatch; those remain integration gates.
+
+Initial execution failed before test discovery because the new worktree has no
+dependencies (`ajv/dist/2020` missing). Running with the existing local worktree's
+read-only CommonJS dependency path passes all 12 cases. No provider, CLI Agent,
+paid credentials or GUI was used.
+
+The adjacent run then passed 49 tests and failed one installed-entrypoint test
+because ESM could not resolve `@netcatty/plugin-cli` from the new worktree. Standard
+`npm ci --ignore-scripts` and `build:plugin-runtime-deps` repaired the setup. These
+failures are setup evidence, not failed-before product regressions.
+
+The core conversation repository stores the existing global `AISession` document
+shape in a host-only directory, namespaced by the hash of source/private-owner.
+Native session identity and compaction remain private. Commits serialize a cloned
+snapshot, revalidate provenance before atomic rename, and retain previous history
+when that check fails. Files use mode 0600 and no-follow reads. The repository
+does not register a plugin storage API or change the source database schema.
+
+The canonical schema and SDK now declare the proposed session interface and
+permissions. Runtime methods and the supported-feature advertisement are not yet
+registered. This stage must not be described as an installable working Agent
+bridge. Focused scope/history/wire and permission-copy tests pass 20 cases;
+contract/SDK/CLI tests pass 91. Focused lint and generated drift checks pass.
+
+## Independent stage-1 correction
+
+The independent review of exact `056164157f34ea779ed6cf51199909082345eca4`
+confirmed two helper defects before any runtime acceptance claim: source failure
+during the initial owner check rejected late work without aborting the active
+native signal; Stop could acquire a replacement turn after awaiting identity.
+
+Both reproduce against that exact helper using the real `PluginAISourceBinding`:
+the focused before run is 13 passed / 2 failed. The correction revokes the captured
+scope when its own host-authenticated identity fails, and captures the intended
+turn before Stop's first await. A foreign runtime cannot use a failed lookup to
+revoke another caller's scope. Focused after: 15 passed / 0 failed. The complete
+foundation/permission group passes 23 on Node 24.19.0 and Node 22.23.3; focused lint
+and diff checks pass. Logs: `/tmp/netcatty-global-agent-review-before.log`,
+`/tmp/netcatty-global-agent-review-after.log`,
+`/tmp/netcatty-global-agent-review-node22.log`.
+
+The first CI run at 0561641, test `40459522087`, Linux job `122040565759`, failed
+after an explicit runner shutdown and operation cancellation, with no assertion
+failure in its log and no complete repository test total. Package workflow
+`40459521971` and both Windows jobs passed. The parent authorized one job rerun;
+it was requested once, producing Linux job `122048349748`, still running at this
+checkpoint. Original runner failure remains historical evidence. Neither that
+rerun nor the helper fix establishes runtime, native or independent-review
+acceptance; the correction still needs reviewer recheck.
+
+### Follow-up: cancellation is not source revocation
+
+The independent recheck confirmed the first two repairs and found a remaining
+Stop race: an aborted Stop(A) RPC could enter the generic owner-failure cleanup
+after B had started, revoking B's scope. The same failure was reproduced at both
+owner-validation await paths using the actual source binding. Exact-18377 source
+with the new 18-case scope suite yields 16 passed / 2 failed; evidence is retained
+in `/tmp/netcatty-global-agent-stop-rpc-exact183-before.log`.
+
+The minimal follow-up distinguishes this request's abort/deadline from verified
+owner or resource failure, rethrows the access failure, and leaves the existing
+turn-capture rule intact. Cancellation of Stop(A) cannot revoke B. A separate
+regression confirms that a verified source mismatch still aborts native work
+even when the RPC is concurrently cancelled. Foreign caller protections remain.
+The full foundation/permission group passes 26 tests on Node 22.23.3 and Node
+24.19.0; focused lint and diff checks pass. Logs:
+`/tmp/netcatty-global-agent-stop-rpc-final.log` and
+`/tmp/netcatty-global-agent-stop-rpc-node22.log`. Independent recheck is pending.
+
+The authorized original-head Linux rerun `122048349748` ended cancelled, with an
+operation-cancelled log and no assertion failure. No second rerun was requested.
+At 18377, test workflow `40462595842`, Linux job `122050816182`, also received an
+explicit runner shutdown; `PluginLogSettings.test.tsx` was SIGKILLed immediately
+afterward. That interrupted stage reports 34 passed / 1 failed, not a complete
+repository total or an assertion failure. Both Windows jobs passed. No blind
+rerun of that job was made. Package workflow `40462595846` was still running when
+checked. These records are not substituted for exact-head green CI.
+
+## Planned public contract and adapters
+
+### Independent transport correction
+
+The exact `ea619555` internal-handler reproductions fail all four targeted cases:
+both no-session and empty-selection environment reads serialize global tool hints;
+stale chat-wide cleanup cancels replacement B; and caller-supplied builtin chat
+text can downgrade cancellation of a main-owned delegated request. The outer
+sender gate still accepts only the current trusted main window. These are trusted
+application lifecycle defects, not arbitrary plugin IPC exposure or installed
+runtime exploit evidence.
+
+Cancellation now resolves ownership from the main request map, rejects a
+conflicting caller chat, checks the recorded sender and current turn lease, and
+cancels only that native request. The legacy chat-wide cleanup IPC is unavailable
+for reserved delegated conversations; main-owned exact-turn release remains the
+cleanup authority. All delegated environment return paths omit global tool hints.
+
+An additional Node 22 regression is independently reproduced: inline arrow
+properties at the beginning of `module.exports` prevent namespace detection of
+existing exports such as `init`, breaking the real Catty attachment harness.
+Identifier exports preserve that existing interface. Correction tests pass 94 on
+Node 22.23.3, including the actual Catty attachment consumer; focused lint passes.
+Failed-before logs are `/tmp/netcatty-global-agent-transport-review-four-failed-before.log`
+and `/tmp/netcatty-global-agent-ea619-namespace-before.log`. The transport PR's
+review checkpoint remains `ea619555` until the parent integrates/rechecks this
+separate correction. No native/backend/full-CI acceptance is implied.
+
+### Stage 2A: trusted native dispatch boundary
+
+The independent bounded recheck of foundation `ba4d3fc` passed all 20 reviewer
+cases. This resolves its reported helper findings; it does not establish full CI,
+runtime, backend or native acceptance.
+
+The additive transport slice gives managed subprocesses a separate per-turn MCP
+credential, permanently binds their TCP connection to that turn, filters their
+tool list, and routes actual tool execution through the source-bound host policy
+adapter. Catty's trusted-app IPC enters the same dispatcher. Branded approval
+contexts skip the legacy Agent approval only after that host adapter grants the
+action; process-global permission mode is unchanged. Selected environment reads
+return the scoped session metadata without querying global tunnel inventory.
+
+Managed Claude is restricted to its existing MCP mode with builtin tools disabled,
+strict MCP configuration and no inherited settings sources. The main native entry
+rejects unverified backends and Skills mode for reserved delegated conversations.
+Each model stream and native SDK request carries a main-owned turn tag; releasing
+that lease aborts its HTTP/native work. Old credentials, cancellation requests and
+disposers cannot acquire or cancel the next turn.
+
+The focused boundary suite passes 116 cases, including an actual local TCP/main
+handler with synthetic workers, plus two new actual-HTTP/renderer-transport lease
+tests. These are deterministic transport tests, not real model inference or
+authenticated Claude service/CLI acceptance. Public runtime registration, core
+conversation integration and the custom chat sample are still separate work in
+progress; this transport slice alone is not a usable plugin Agent feature.
+
+At exact `ba4d3fc`, package CI `40464058910` passed; test workflow `40464058908`
+is red. Linux job `122055141575` failed a real assertion in
+`PluginManagementDialog.interaction.test.tsx:71`: the external view handoff had
+not run when asserted. That stage reports 34 passed / 1 failed; earlier runtime
+and contract groups passed 720 and 5. Both Windows jobs passed. No blind rerun was
+requested. This unresolved assertion must not be classified as runner shutdown.
+
+The wider initial local transport run reports 697 passed / 10 failed / 3 skipped.
+All ten failures are Cursor discovery expectations after `npm ci --ignore-scripts`
+left SQLite's native binding absent, making the bundled Cursor SDK import fail.
+The standard rebuild first failed using unwritable default caches; rebuilding
+with task-local npm/node-gyp cache paths succeeded. The failed totals are retained
+in `/tmp/netcatty-global-agent-transport-expanded.log`; the after-setup run is
+recorded separately. No GUI or provider credentials were used.
+
+After the dependency repair, the expanded transport/native-handler/preload/SDK
+suite passes 709 tests, 0 failures, 3 skips. Log:
+`/tmp/netcatty-global-agent-transport-expanded-after-setup.log`. Focused lint passes.
+
+The proposed feature is `ai.agent-sessions`, with `ai.agent.use` for conversation
+operations and `ai.agent.actions` for actual Agent tool actions. Permission mode
+comes from the existing source-bound Allow/Ask/Deny engine. These are additive
+names, separate from the existing tools-disabled `ai.invoke` broker.
+
+The API will provide backend listing, explicit target selection, owned chat
+listing/opening, sending, bounded event reads, history, Stop and close. Backend
+references are opaque host-issued configuration revisions. Conversation references
+identify only histories owned by the calling source/private-owner; runtime handles
+are separate and cannot substitute builtin chat IDs or native SDK resume IDs.
+Messages cannot supply permissionMode, CLI/env/MCP configuration or owner fields.
+
+Core will reuse `AISession`, `AgentRuntime`, both existing turn drivers, event and
+compaction handling, SDK resume identity validation, and `stopAgentTurn`. The first
+eligible backends are Catty and configured Claude Code in MCP mode. Other backend
+entries must return explicit unsupported/unconfigured status until their native
+tool and approval boundaries are verified. Codex SDK's current unrestricted native
+configuration must not be treated as eligible merely because it has a driver.
+
+The terminal worker already exposes a suitable main-owned resource binding:
+`getPluginSessionBinding(sessionId, ownerWebContentsId)` returns worker epoch and
+session generation. Use this for dispatch-time targets; do not use menu IDs,
+focused tab, display labels, or a renderer-provided session ID as authority.
+
+The MCP dispatcher and Catty direct execution route need the same delegated
+session guard. A delegated call must not update process-global permission mode,
+or request both an Agent approval and a plugin approval for the same action.
+Policy changes, disable/restart/source replacement, lock and host disconnection
+must cancel scoped native work and invalidate outgoing event tickets. Existing
+Agent trace and plugin audit/log facilities will receive redacted correlation
+metadata, not credentials, provider diagnostics or full unreviewed tool payloads.
+
+## Remaining acceptance gates
+
+### Separate runtime/sample implementation checkpoint
+
+The runtime continuation wires the nine `context.agent` methods through the
+registered default host, dedicated trusted-app preload/IPC and `PluginAgentHost`
+mounted in `AppView`. It reuses the existing `AgentRuntime`, Catty/external turn
+drivers, core `AISession` documents, compaction, model/provider transport, native
+cancellation, selected worker epoch/generation checks and permission/audit engine.
+No source database, Vault history or builtin conversation ownership change is
+included. Plugin input cannot supply internal session IDs, source/owner, CLI/env,
+MCP configuration or permission mode.
+
+The first eligible profiles are configured Catty and Claude MCP. Other known
+backends report unsupported/unavailable. Claude has builtin tools disabled,
+strict MCP, no inherited settings sources, at most 12 native turns and no native
+session persistence/resume; its existing driver rehydrates from core-owned history.
+This code path has handler/driver/MCP fixture coverage. Authenticated Claude
+service/native CLI acceptance has not run and must not be inferred from mocks.
+
+Actions use one source-bound Allow / Ask / Deny decision path. Actions Deny permits
+model-only conversation with an empty tool profile; Agent-use Deny blocks host
+dispatch. Explicit target choice is independent of focus/workspace. Worker
+lifecycle changes cancel a pending chooser and revoke stale target leases;
+source/runtime/policy/lock invalidation aborts native work and rejects late events.
+Core history is source/private-owner namespaced and read/write protected through
+the plugin filesystem broker. A user-granted terminal command still has that
+terminal's native OS authority; this is not an OS filesystem sandbox.
+
+Bounds include six sends/source/minute, eight scopes/runtime and 64 total, 256
+retained turn handles, 32 tool actions and 32 Catty HTTP calls per turn, 12 Catty
+iterations, a 120-second turn lifetime, 60-second model HTTP/15-second streaming
+idle deadlines, 128 KiB HTTP responses, 256 KiB projected turn output and 4 KiB
+text events. Usage is projected; no hard total native-Claude token budget is
+claimed. Handles expire after five minutes without silent target reselection.
+
+The installable `examples/plugins/global-agent` sample provides backend/owned
+conversation choice, explicit targets, history, Send/Stop and existing host theme
+tokens. Its deterministic local provider fixture performs no model inference,
+paid API calls, real terminal execution or request/body/header logging. The
+installed Node/JSDOM pipeline test uses actual Catty orchestration, configured
+HTTP admission and main dispatch to synthetic workers. It proves one selected-B
+tool cycle, streamed result, Stop and revoked-handle denial; it is not native
+browser sandbox or real model acceptance. A failed-before JSON-snapshot regression
+is retained at `/tmp/netcatty-global-agent-snapshot-failed-before.log`.
+
+Recorded validation: plugin runtime 732 passed/0 failed/1 skipped; affected group
+105 passed/0 failed/3 skipped; examples 6 passed/0 failed/1 skipped; repaired setup
+paths 284 passed. Build, codegen and lint passed before the final review corrections.
+Typecheck is still red: 774 diagnostics on both unchanged foundation and this
+continuation, with equal per-file/error-code counts; it is not a clean typecheck.
+The repaired Node 22 full run reports 15,354 passed/9 failed/46 skipped. Eight are
+missing xterm install patches, subsequently applied; the ninth is the transport
+CJS namespace regression fixed separately. Exact final-head validation is pending.
+
+The earlier pre-setup full run remains pending after its timed-out unpatched FIDO
+test worker kept a socket open. Reading `/proc/319596/cwd` to confirm that worker's
+identity was denied (EACCES); no signal was sent and no alternate route attempted.
+Its log is retained without invented final totals. `pack:dir` first failed using
+the unwritable default npm cache; a standard task-local cache repaired that step,
+then native rebuild failed because installed `@electron/rebuild` hardcodes
+`/home/agent/.electron-gyp` outside writable roots. No home override or sandbox
+bypass was attempted. Native screenshots/video and independent runtime review
+remain parent-owned gates; nothing is merged or released.
+
+Final focused Node 22 validation passes 205 cases, including all nine failure
+paths from the broad run after the documented setup/correction changes. The
+installed pipeline additionally proves disable/re-enable, owned history reopening
+and a fresh model-only turn under Actions Deny. `conversationRef` is durable;
+each open receives a fresh private runtime actor so revoked privacy/native/tool
+state cannot be revived. A typed, host-only close control clears its owned
+runtime caches after that actor settles. Build, lint (seven existing warnings)
+and generated drift checks pass. Typecheck still has the same 774 per-file/code
+diagnostic counts as the unchanged foundation. Logs:
+`/tmp/netcatty-global-agent-lifecycle-final-tests.log`,
+`/tmp/netcatty-global-agent-lifecycle-final-build.log`, and
+`/tmp/netcatty-global-agent-lifecycle-final-typecheck.log`.
+
+The native recipe and reproducible package hash are in
+[`global-agent-qa.md`](global-agent-qa.md). Remaining gates are independent
+transport/runtime review, CI on the final integrated head, parent-scheduled native
+screenshots/video, genuine Claude compatibility acceptance with separately
+approved access, and native packaging on a machine with supported writable
+rebuild caches. The initial full-run pending worker and previous red totals above
+remain recorded. No GUI ownership, merge or release is granted to this executor.

docs/plugin-platform/host-vault-actions-proposal.md

@@ -1,8 +1,8 @@
 # Host and Vault actions
 
 Feature: `vault.host-actions`. The SDK registers three methods under
-`context.vault`. Netcatty owns the picker, field-diff review, and connection
-confirmation. Plugin business logic stays in the offline browser sandbox.
+`context.vault`. Netcatty owns the picker, field-diff review, permission routing,
+and normal connection dispatch. Plugin business logic stays in the offline browser sandbox.
 
 Base: source integration #3981 at
 `4213d8e6726c44e7a479418ece3adf16ea494782`.
@@ -36,10 +36,12 @@ remain behind the typed target reference; its revision is the expected revision.
 Group metadata describes the explicitly selected current member handles. The
 grant never expands when another host joins a group.
 
-Selection grants metadata access only. Each draft save and each connection
-requires its own host-owned confirmation. A connection confirmation displays the
-saved target and whether saved scripts can run. It does not grant terminal input,
-terminal output, or session access.
+Selection shares the chosen metadata only. Later edit and connection requests
+follow the plugin's Allow, Ask, or Deny settings. Draft saves retain the mandatory
+host editor. Connection Ask displays the saved target and whether saved scripts
+can run; Allow can dispatch without that permission-only dialog. Normal SSH
+authentication remains unchanged. These actions grant no terminal input, output,
+or session access.
 
 All requests are bounded and cancel on runtime stop, source replacement, revoke,
 Vault lock, owner window replacement, expiry, or user cancellation. The host
@@ -47,7 +49,7 @@ revalidates authority and expected revision after asynchronous work and before
 the Vault write or connection dispatch.
 
 Bounds reuse `HostInteractionLimits`: one pending request per runtime,
-eight total, ten per minute, a 60-second confirmation deadline, and a 64-KiB
+eight total, ten per minute, a 60-second host-interaction deadline, and a 64-KiB
 request ceiling. Selection adds a maximum of 50 current hosts. Titles use the
 existing 128-character single-line limit. Draft field lengths use
 `ImporterHostDraft`. Unknown properties are rejected by the shared schema.
@@ -86,15 +88,16 @@ It revalidates after asynchronous authentication. AI selected-context handles ar
 text-disclosure handles and cannot target these actions.
 
 The permission engine gates selection with `vault.metadata`, drafts with
-`vault.write`, and connection requests with `ui.interact`. Every save or connection
-also requires a separate host-owned confirmation and a signed one-use action
-claim. A stored permission grant cannot bypass this review.
+`vault.write`, and connection requests with `ui.interact`. Each committed save or
+connection uses a signed one-use action claim. Permission settings control the
+permission-only prompt; an Allow setting does not bypass the draft editor or
+normal SSH authentication.
 
 After review, the renderer prepares the existing transaction or connection
 request. It claims action authority after the final asynchronous preparation,
 immediately before persistence or dispatch. This claim is the action's commit
 point. Completion only acknowledges the committed action. Automation changes
-during connection review require fresh confirmation.
+during an Ask connection review require fresh confirmation.
 The connection label uses the same `resolveEffectiveTerminalProtocol` helper as
 the launcher, including Mosh/ET flags and implicit localhost shells. Local
 execution displays an explicit on-device shell notice and omits the remote SSH

docs/plugin-platform/market-sources.md

@@ -3,8 +3,10 @@
 The plugin manager has Installed, Official marketplace and Third-party marketplace
 pages. Listing a plugin in the official market does not certify it or establish
 that Netcatty maintains it. Remote manifests, publisher names, source names and
-README content cannot create a host-issued official badge. This revision does not
-issue maintainer badges. README text and images remain author content.
+README content cannot create a host-issued official badge. The separate gold
+maintainer badge requires the built-in official source and an exact host-curated
+first-party ID/repository pair. It describes maintenance, not safety certification.
+README text and images remain author content.
 
 ## Add a source
 
@@ -33,20 +35,24 @@ manifest, compatibility, browser-runtime admission and archive validation still
 apply. Third-party source consent is not permission consent.
 
 Delivery v1 is unchanged and source-only. Delivery **v2** has the same fields and
-strict schema as v1, with `schemaVersion: 2` and one extension: each plugin's
-`artifact` can be null or a package reference:
+strict schema as v1, with `schemaVersion: 2`. Each plugin's `artifact` can be null
+or a package reference:
 
 ```json
 {"path":"/assets/<64-lowercase-hex-sha256>.ncpkg","sha256":"<same-sha256>","size":12345}
 ```
 
-Packages are at most 32 MiB. The catalog entry must contain
+V2 delivery packages are at most 16 MiB. The catalog entry must contain
 `artifact: {url: "https://plugins.example.com/assets/<same-sha256>.ncpkg", sha256}`.
 The index's current, non-withdrawn version must exactly equal the catalog entry
 and use `distribution: "release"`. Source-only entries retain null delivery
-artifacts and `distribution: "source-only"`. Avatars remain null; remote README
-embeds are not loaded. README and PNG/WebP references retain the v1 bounds.
+artifacts and `distribution: "source-only"`. The reserved `avatar` can also be
+null or a same-origin `/assets/<sha256>.png` or `.webp` reference, with a positive
+size no greater than 256KiB. The host verifies and rasterizes its bytes through
+the existing image infrastructure. Missing or invalid imagery uses a placeholder.
+Remote README embeds are not loaded. README and PNG/WebP references retain the v1 bounds.
 Existing official bootstrap entries are not changed or made installable.
+See [author presentation](author-identity.md) for subject and maintenance authority.
 
 Before every install, refresh and validate the entire snapshot again. A changed
 selection, withdrawal, unavailable source, altered hash or size prevents install;

docs/plugin-platform/registry-client.md

@@ -29,6 +29,13 @@ for brand icons. This v1 publishing schema requires **avatar and artifact to
 be null**. The client rejects unsupported delivery metadata rather than
 inventing installable packages or deriving a GitHub avatar URL.
 
+Delivery v2 retains those fields and admits hash-bound packages plus the reserved
+avatar as null or a positive-size PNG/WebP asset reference of at most 256KiB.
+The host fetches only the selected source's same-origin asset, verifies bytes,
+and reuses its bounded icon rasterizer and cache. The renderer receives a PNG
+data URI. Author imagery does not verify a GitHub account, and no GitHub avatar
+URL is derived. See [author presentation](author-identity.md).
+
 Index is validated with its pinned schema. Plugin/version identities must be
 unique; each catalog entry must exactly equal the index's current, non-withdrawn,
 source-only entry. Withdrawal does not disable, uninstall or delete any existing
@@ -73,7 +80,7 @@ exact SHA-256 bytes; it does not relax those future gates or auto-enable code.
 | README details | Exact delivery `/assets/<hash>.md` | Visible error/Retry, no upstream fallback |
 | Uninstalled brand icons | Existing reviewed bundled previews | Default icon; delivery icon metadata validated but not fetched by UI |
 | Installed brand icons | Host-owned local package decoder | Default icon; no activation/network request |
-| Author avatars | Not implemented; delivery v1 requires null | Existing local presentation; no avatar lookup |
+| Author avatars | Visible-row host fetch of a validated v2 same-origin resource; v1 remains null | Default placeholder; no GitHub lookup or renderer URL fetch |
 | Package artifacts | Not published or admitted by delivery v1 | Source-only; no download action fabricated |
 | Source/README links | Explicit user-opened external HTTPS link | May open GitHub; no background dependency |
 

domain/pluginPermissionDescriptions.cjs

@@ -3,6 +3,8 @@
 // Presentation only. Admission and grants remain owned by the canonical schema
 // and permission engine. Tests require exact coverage of its permission enum.
 const PERMISSION_DESCRIPTIONS = {
+  "ai.agent.use": [true, "Agent conversations", "Use configured host Agents and read this plugin's own chat history. Model or Agent service usage may incur costs.", "Agent 会话", "使用宿主已配置的 Agent，并读取此插件自己的聊天历史；模型或 Agent 服务可能产生费用。"],
+  "ai.agent.actions": [true, "Agent actions", "Authorize Agent tools against explicitly selected targets under this plugin's policy. Commands can change remote systems.", "Agent 操作", "根据插件策略授权 Agent 工具操作明确选中的目标；命令可能更改远程系统。"],
   storage: [false, "Plugin storage", "Save and read this plugin's local data.", "插件存储", "保存和读取此插件自己的本地数据。"],
   "runtime.advanced": [true, "Full device access", "Run Node code with filesystem and network access outside broker restrictions. Developer mode only.", "完整设备访问", "运行 Node 代码，可直接访问文件系统和网络，不受代理权限限制。仅限开发者模式。"],
   "settings.read": [false, "Read plugin settings", "Read this plugin's configured preferences.", "读取插件设置", "读取此插件自己的设置。"],

domain/settingsSearch.test.ts

@@ -5,6 +5,7 @@ import en from "../application/i18n/locales/en.ts";
 import zhCN from "../application/i18n/locales/zh-CN.ts";
 import zhTW from "../application/i18n/locales/zh-TW.ts";
 import { filterSettingsSearchCatalog } from "./settingsSearch.ts";
+import { resolveSettingsPlatform } from "./settingsSearchCatalog.ts";
 import { SETTINGS_SEARCH_CATALOG } from "./settingsSearchCatalog.ts";
 
 const EN: Record<string, string> = {
@@ -152,3 +153,37 @@ test("Sync status entries retain syncSubTab for navigation", () => {
   assert.ok(backups);
   assert.equal(backups?.entry.syncSubTab, "status");
 });
+
+test("macOS-only settings stay out of search on other platforms", () => {
+  const blurId = "appearance-window-background-blur";
+
+  // Both a targeted query and the default (empty query) list must skip it,
+  // otherwise selecting the hit jumps to a tab with no anchor to focus.
+  const macHits = filterSettingsSearchCatalog("", tEn, { platform: "mac", limit: 500 });
+  assert.ok(macHits.some((hit) => hit.entry.id === blurId));
+
+  for (const platform of ["win", "linux"] as const) {
+    const searched = filterSettingsSearchCatalog("frosted glass", tEn, { platform });
+    assert.equal(searched.some((hit) => hit.entry.id === blurId), false);
+
+    const defaults = filterSettingsSearchCatalog("", tEn, { platform, limit: 500 });
+    assert.equal(defaults.some((hit) => hit.entry.id === blurId), false);
+  }
+});
+
+test("platform-gated entries never hide cross-platform settings", () => {
+  for (const platform of ["mac", "win", "linux"] as const) {
+    const hits = filterSettingsSearchCatalog("opacity", tEn, { platform });
+    assert.ok(
+      hits.some((hit) => hit.entry.id === "appearance-window-opacity"),
+      `window opacity must stay searchable on ${platform}`,
+    );
+  }
+});
+
+test("resolveSettingsPlatform maps Electron-style platform strings", () => {
+  assert.equal(resolveSettingsPlatform("MacIntel"), "mac");
+  assert.equal(resolveSettingsPlatform("Win32"), "win");
+  assert.equal(resolveSettingsPlatform("Linux x86_64"), "linux");
+  assert.equal(resolveSettingsPlatform(""), "linux");
+});

domain/settingsSearch.ts

@@ -1,6 +1,9 @@
 import { matchesSearchQuery } from "../lib/searchMatcher";
 import {
   SETTINGS_SEARCH_CATALOG,
+  isSettingsEntryAvailableOn,
+  resolveSettingsPlatform,
+  type SettingsPlatform,
   type SettingsSearchEntry,
   type SettingsTabId,
 } from "./settingsSearchCatalog";
@@ -61,16 +64,22 @@ export function filterSettingsSearchCatalog(
     catalog?: readonly SettingsSearchEntry[];
     includePlugins?: boolean;
     limit?: number;
+    /** Platform whose settings UI will receive the jump; defaults to the host. */
+    platform?: SettingsPlatform;
   },
 ): SettingsSearchHit[] {
   const catalog = options?.catalog ?? SETTINGS_SEARCH_CATALOG;
   const includePlugins = options?.includePlugins ?? true;
   const limit = options?.limit ?? 40;
+  const platform = options?.platform ?? resolveSettingsPlatform();
   const trimmed = query.trim();
 
   const hits: SettingsSearchHit[] = [];
   for (const entry of catalog) {
     if (!includePlugins && entry.tab === "plugins") continue;
+    // Platform-gated settings are hidden from search where their anchor is not
+    // rendered, so a hit always has a real control to focus.
+    if (!isSettingsEntryAvailableOn(entry, platform)) continue;
     const hit = buildSettingsSearchHit(entry, t);
     if (!trimmed) {
       hits.push(hit);

domain/settingsSearchCatalog.ts

@@ -31,6 +31,8 @@ export const SYNC_SETTINGS_SUB_TAB_IDS = ["providers", "status"] as const;
 
 export type SyncSettingsSubTabId = (typeof SYNC_SETTINGS_SUB_TAB_IDS)[number];
 
+export type SettingsPlatform = "mac" | "win" | "linux";
+
 export type SettingsSearchEntry = {
   /** Stable id; also used as `data-settings-anchor` on the target element. */
   id: string;
@@ -47,8 +49,33 @@ export type SettingsSearchEntry = {
   sectionKey?: string;
   /** Extra English/Chinese aliases that are not full i18n strings. */
   keywords?: readonly string[];
+  /**
+   * Platforms where the destination actually renders. Omit for cross-platform
+   * entries. Entries must not be offered on a platform whose settings UI hides
+   * the anchor, otherwise search jumps to a tab with nothing to highlight.
+   */
+  platforms?: readonly SettingsPlatform[];
 };
 
+/** Resolve the host platform in the same terms the settings UI branches on. */
+export function resolveSettingsPlatform(
+  platform?: string,
+): SettingsPlatform {
+  const value = platform
+    ?? (typeof navigator !== "undefined" ? navigator.platform : "");
+  if (/mac|iphone|ipad/i.test(value)) return "mac";
+  if (/win/i.test(value)) return "win";
+  return "linux";
+}
+
+export function isSettingsEntryAvailableOn(
+  entry: SettingsSearchEntry,
+  platform: SettingsPlatform,
+): boolean {
+  if (!entry.platforms?.length) return true;
+  return entry.platforms.includes(platform);
+}
+
 export const SETTINGS_SEARCH_CATALOG: readonly SettingsSearchEntry[] = [
   // Application
   {
@@ -108,6 +135,14 @@ export const SETTINGS_SEARCH_CATALOG: readonly SettingsSearchEntry[] = [
     descriptionKey: "settings.appearance.windowOpacity.desc",
     keywords: ["transparency", "透明"],
   },
+  {
+    id: "appearance-window-background-blur",
+    tab: "appearance",
+    labelKey: "settings.appearance.windowBackgroundBlur",
+    descriptionKey: "settings.appearance.windowBackgroundBlur.desc",
+    keywords: ["blur", "frosted glass", "vibrancy", "模糊", "毛玻璃"],
+    platforms: ["mac"],
+  },
   {
     id: "appearance-theme",
     tab: "appearance",

domain/windowBackgroundBlur.test.ts

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  isWindowBackgroundBlurActive,
+} from './windowBackgroundBlur';
+
+test('window background blur is visible only with a translucent surface', () => {
+  assert.equal(isWindowBackgroundBlurActive(true, 1), false);
+  assert.equal(isWindowBackgroundBlurActive(true, 0.99), true);
+  assert.equal(isWindowBackgroundBlurActive(true, 0.5), true);
+  assert.equal(isWindowBackgroundBlurActive(true, Number.NaN), false);
+});
+
+test('window background blur becomes inactive without losing the request state', () => {
+  assert.equal(isWindowBackgroundBlurActive(true, 0.85), true);
+  assert.equal(isWindowBackgroundBlurActive(true, 1), false);
+  assert.equal(isWindowBackgroundBlurActive(false, 0.85), false);
+});

domain/windowBackgroundBlur.ts

@@ -0,0 +1,6 @@
+export function isWindowBackgroundBlurActive(
+  requested: boolean,
+  windowOpacity: number,
+): boolean {
+  return requested && Number.isFinite(windowOpacity) && windowOpacity < 1;
+}

domain/workspace.ts

@@ -10,6 +10,16 @@ export type SplitHint = {
   targetSessionId?: string;
 };
 
+export const invertSplitPosition = (position: SplitPosition): SplitPosition => {
+  switch (position) {
+    case 'left': return 'right';
+    case 'right': return 'left';
+    case 'top': return 'bottom';
+    case 'bottom': return 'top';
+  }
+};
+
+
 export const pruneWorkspaceNode = (node: WorkspaceNode, targetSessionId: string): WorkspaceNode | null => {
   if (node.type === 'pane') {
     return node.sessionId === targetSessionId ? null : node;

electron/bridges/ai/ptyExec.readiness.test.cjs

@@ -36,6 +36,79 @@ test('PTY sends no bytes while a slow shell is starting, then runs once ready',
   assert.equal(pty.writes.length, 1);
 });
 
+test('macOS default zsh prompt is recognized as an idle prompt', async () => {
+  const pty = new TestPty();
+  const session = { _promptTrackTail: '', lastIdlePrompt: '' };
+  const prompt = 'hexiao@JosephdeMacBook-Pro-2 ~ % ';
+  trackSessionIdlePrompt(session, `Last login: Mon Oct 26\r\n${prompt}`);
+  assert.equal(session.lastIdlePrompt, prompt);
+  assert.equal(readyPrompt(session), prompt);
+
+  const job = startPtyJob(pty, 'echo OK', {
+    shellKind: 'posix',
+    getReadyPrompt: () => readyPrompt(session),
+    promptWaitTimeoutMs: 200,
+    timeoutMs: 1000,
+  });
+  const result = await job.resultPromise;
+  assert.equal(result.ok, true);
+  assert.equal(pty.writes.length, 1);
+});
+
+test('zsh prompt with pending input does not become ready', async (t) => {
+  t.mock.timers.enable({ apis: ['Date', 'setTimeout'] });
+  const pty = new TestPty();
+  const session = { _promptTrackTail: '', lastIdlePrompt: '' };
+  trackSessionIdlePrompt(session, 'hexiao@JosephdeMacBook-Pro-2 ~ % echo half-typed');
+  assert.equal(readyPrompt(session), '');
+
+  const job = startPtyJob(pty, 'echo OK', {
+    shellKind: 'posix',
+    getReadyPrompt: () => readyPrompt(session),
+    promptWaitTimeoutMs: 50,
+    timeoutMs: 1000,
+  });
+  t.mock.timers.tick(50);
+  const result = await job.resultPromise;
+  assert.equal(result.code, 'SHELL_NOT_READY');
+  assert.deepEqual(pty.writes, []);
+});
+
+test('zsh default prompts allow directory spaces and the privileged marker', async () => {
+  for (const prompt of ['alice@MacBook-Pro My Project % ', 'root@MacBook-Pro ~ # ', 'root@MacBook-Pro My Project # ']) {
+    const pty = new TestPty();
+    const session = { _promptTrackTail: '', lastIdlePrompt: '' };
+    trackSessionIdlePrompt(session, `Last login\r\n${prompt}`);
+    assert.equal(getFreshIdlePrompt(session), prompt);
+    assert.equal(getVisibleIdlePrompt(session), prompt);
+
+    const result = await startPtyJob(pty, 'echo OK', {
+      shellKind: 'posix',
+      getReadyPrompt: () => readyPrompt(session),
+      promptWaitTimeoutMs: 200,
+      timeoutMs: 1000,
+    }).resultPromise;
+    assert.equal(result.ok, true, prompt);
+    assert.equal(pty.writes.length, 1, prompt);
+  }
+});
+
+test('zsh spaced-directory prompts with pending input stay unready', async () => {
+  for (const line of ['alice@MacBook-Pro My Project % echo %', 'root@MacBook-Pro My Project # echo #']) {
+    const pty = new TestPty();
+    const session = { _promptTrackTail: '', lastIdlePrompt: '' };
+    trackSessionIdlePrompt(session, line);
+    assert.equal(readyPrompt(session), '', line);
+    const result = await startPtyJob(pty, 'echo forbidden', {
+      getReadyPrompt: () => readyPrompt(session),
+      promptWaitTimeoutMs: 25,
+      timeoutMs: 1000,
+    }).resultPromise;
+    assert.equal(result.code, 'SHELL_NOT_READY', line);
+    assert.deepEqual(pty.writes, [], line);
+  }
+});
+
 test('PTY readiness timeout does not send command or interrupt to a busy program', async () => {
   const pty = new TestPty();
   const job = startPtyJob(pty, 'echo OK', { getReadyPrompt:()=>'', promptWaitTimeoutMs:25, timeoutMs:1000 });

electron/bridges/ai/ptyExec.test.cjs

@@ -312,6 +312,21 @@ test("recognizes PowerShell on Linux/macOS prompts (`PS /home/alice>`)", () => {
   );
 });
 
+test("recognizes the macOS zsh default prompt without changing PowerShell/cmd detection", () => {
+  assert.equal(
+    resolveEffectiveShellKind(undefined, "hexiao@JosephdeMacBook-Pro-2 ~ % "),
+    "posix",
+  );
+  assert.equal(
+    resolveEffectiveShellKind(undefined, "hexiao@MacBook-Pro ~/git %", { loginShellHint: "powershell" }),
+    "posix",
+  );
+  assert.equal(
+    resolveEffectiveShellKind("posix", "hexiao@MacBook-Pro ~ % echo half-typed"),
+    "posix",
+  );
+});
+
 test("ignores ANSI-coloured PowerShell prompts when detecting the shell", () => {
   assert.equal(
     resolveEffectiveShellKind(undefined, "PS C:\\Users\\alice>"),

electron/bridges/ai/ptyExecPromptSuffix.test.cjs

@@ -41,6 +41,16 @@ test("prompt suffix is found after a very large flood of CRLF output", () => {
   assert.equal(hasExpectedPromptSuffix(`${flood}${COLORED_PROMPT}`, "root@3160T:~# "), true);
 });
 
+test("macOS zsh default prompt suffix matches only when the prompt is idle", () => {
+  const prompt = "hexiao@JosephdeMacBook-Pro-2 ~ % ";
+  assert.equal(hasExpectedPromptSuffix(`Last login\r\n${prompt}`, prompt), true);
+  assert.equal(hasExpectedPromptSuffix(`Last login\r\n${prompt}echo hello`, prompt), false);
+  assert.equal(
+    hasExpectedPromptSuffix(`Last login\r\n${prompt}`, "hexiao@JosephdeMacBook-Pro-2 ~ %"),
+    false,
+  );
+});
+
 test("live PTY CR bytes match a cached two-line idle prompt", () => {
   // Bash writes the PS1 newline as CR and ONLCR adds another, so the bytes
   // are `\r\r\n`. The idle-prompt cache keeps those as blank lines. Suffix

electron/bridges/ai/shellUtils.cjs

@@ -69,6 +69,13 @@ const CMD_PROMPT_PATTERN = /^[A-Za-z]:(?:\\[^<>"|]*)?>$/;
 //     the final `]` before `$`/`#` is the delimiter.
 const POSIX_PROMPT_PATTERN = /^(?:[^\s@]+@[^\s:]+(?::[^\n\r]*)?|\[[^\s@\]]+@[^\s\]:]+(?:\s+[^\n\r]+)?\])[#$]$/;
 
+// macOS ships zsh with `%n@%m %1~ %#`, which renders as
+// `user@host ~ %` / `user@host My Project %`; privileged shells end in `#`.
+// Allow spaces in the path, but keep prompt delimiters excluded so a prompt
+// followed by input (`user@host ~ % echo %`) cannot count as idle. Requiring
+// whitespace before the marker also rejects output such as `user@host 100%`.
+const ZSH_PROMPT_PATTERN = /^[^\s@]+@[^\s:]+ [^\s%#$][^%#$\r\n]* [%#]$/;
+
 // Host line of a two-line bash PS1 (`\u@\h: \w` then a following `$` or `#`).
 // Same user@host[:path] class as POSIX_PROMPT_PATTERN's first alternative,
 // without a prompt marker on this line. Oh My Zsh `ys` uses a different host
@@ -103,7 +110,8 @@ function isDefaultPosixPromptLine(line) {
   const withoutEnvPrefix = normalized.replace(/^\([^()\n\r]+\)\s+/, "");
   return (
     POSIX_PROMPT_PATTERN.test(withoutEnvPrefix) ||
-    ALPINE_PROMPT_PATTERN.test(withoutEnvPrefix)
+    ALPINE_PROMPT_PATTERN.test(withoutEnvPrefix) ||
+    ZSH_PROMPT_PATTERN.test(withoutEnvPrefix)
   );
 }
 

electron/bridges/ai/shellUtils.test.cjs

@@ -151,6 +151,64 @@ test("isDefaultPosixPromptLine matches classic user@host prompts", () => {
   assert.equal(isDefaultPosixPromptLine(""), false);
 });
 
+test("isDefaultPosixPromptLine matches the macOS zsh default prompt", () => {
+  for (const prompt of [
+    "hexiao@JosephdeMacBook-Pro-2 ~ %",
+    "hexiao@JosephdeMacBook-Pro-2 ~ % ",
+    "alice@MacBook-Pro ~/src % ",
+    "alice@MacBook-Pro /tmp %",
+    "alice@MacBook-Pro My Project % ",
+    "root@MacBook-Pro ~ # ",
+    "root@MacBook-Pro My Project # ",
+    "(venv) alice@MacBook-Pro ~/src % ",
+  ]) {
+    assert.equal(isDefaultPosixPromptLine(prompt), true, prompt);
+  }
+});
+
+test("zsh default prompt recognition rejects pending input and non-prompt output", () => {
+  for (const line of [
+    "user@host ~ % echo",
+    "user@host ~ %echo",
+    "user@host ~ % printf busy%",
+    "user@host My Project % echo %",
+    "root@host My Project # echo #",
+    "user@host My Project % echo #",
+    "user@host My Project % echo $",
+    "user@host 100%",
+    "user@host 100#",
+    "progress 50 %",
+    "user@host   %",
+    "#",
+    "%",
+    "progress@build 50%",
+  ]) {
+    assert.equal(isDefaultPosixPromptLine(line), false, line);
+    assert.equal(extractTrailingIdlePrompt(`welcome\r\n${line}`), "", line);
+  }
+});
+
+test("extracts the macOS zsh default prompt and preserves trailing whitespace", () => {
+  assert.equal(
+    extractTrailingIdlePrompt("Last login: Mon Oct 26\r\nhexiao@MacBook-Pro ~ % "),
+    "hexiao@MacBook-Pro ~ % ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\nhexiao@MacBook-Pro ~/git %"),
+    "hexiao@MacBook-Pro ~/git %",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\nalice@MacBook-Pro My Project % "),
+    "alice@MacBook-Pro My Project % ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\nroot@MacBook-Pro My Project # "),
+    "root@MacBook-Pro My Project # ",
+  );
+  assert.equal(extractTrailingIdlePrompt("welcome\r\nhexiao@MacBook-Pro ~ % echo"), "");
+  assert.equal(extractTrailingIdlePrompt("welcome\r\nhexiao@MacBook-Pro ~ %\r\n"), "");
+});
+
 test("isDefaultPosixPromptLine matches Alpine host:path prompts without a username", () => {
   for (const prompt of [
     "localhost:~#",

electron/bridges/aiBridge.cjs

@@ -611,11 +611,22 @@ function withContentLength(headers, body) {
 }
 
 async function streamRequest(url, options, event, requestId, skipTLS) {
+  if (requestId.startsWith("agent-model_") && !/^agent-model_[0-9a-f-]{36}_[0-9a-f-]{36}_sdk_/.test(requestId)) {
+    throw new Error("Delegated model request identity invalid");
+  }
   const parsedUrl = new URL(url);
   // Register cancellation before any await so Stop during PAC/proxy lookup works.
   const controller = new AbortController();
   const pluginRuntimeId = /^plugin-model_([A-Za-z0-9-]{1,128})_/.exec(requestId)?.[1];
-  const { idleTimeoutMs, totalTimeoutMs } = pluginRuntimeId
+  const delegatedMatch = /^agent-model_([0-9a-f-]{36})_([0-9a-f-]{36})_sdk_/.exec(requestId);
+  const delegatedId = delegatedMatch?.[1];
+  const delegationTag = delegatedMatch?.[2];
+  const delegatedBridge = delegatedId ? require("./mcpServerBridge.cjs") : null;
+  const assertDelegation = () => delegatedBridge?.assertPluginAgentCaller(`plugin-agent:${delegatedId}`, event.sender.id, delegationTag);
+  assertDelegation();
+  if (delegatedId) delegatedBridge.beginPluginAgentModelRequest(`plugin-agent:${delegatedId}`, event.sender.id, delegationTag);
+  const detachDelegation = delegatedBridge?.onPluginAgentRelease(`plugin-agent:${delegatedId}`, delegationTag, () => controller.abort(createAbortError()));
+  const { idleTimeoutMs, totalTimeoutMs } = pluginRuntimeId || delegatedId
     ? { idleTimeoutMs: Math.min(15_000, Math.max(1, Number(options.idleTimeoutMs) || 15_000)),
         totalTimeoutMs: Math.min(60_000, Math.max(1, Number(options.totalTimeoutMs) || 60_000)) }
     : resolveAIStreamTimeouts(options);
@@ -629,6 +640,7 @@ async function streamRequest(url, options, event, requestId, skipTLS) {
     clearTimeout(idleTimer);
     activeStreams.delete(requestId);
     pluginModelStreamOwners.delete(requestId);
+    detachDelegation?.();
   };
   const noteStreamActivity = () => {
     if (lifecycleFinished) return;
@@ -648,6 +660,9 @@ async function streamRequest(url, options, event, requestId, skipTLS) {
     throw controller.signal.reason instanceof Error ? controller.signal.reason : createAbortError();
   }
 
+  try { assertDelegation(); }
+  catch (error) { finishLifecycle(); throw error; }
+
   const { resolveOutboundHttpAgent } = require("./httpNetworkProxyAgent.cjs");
   let proxyAgent;
   try {
@@ -731,6 +746,7 @@ async function streamRequest(url, options, event, requestId, skipTLS) {
     if (proxyAgent) reqOpts.agent = proxyAgent;
 
     try {
+      assertDelegation();
       req = lib.request(parsedUrl, reqOpts,
         (res) => {
         if (streamFinished) {
@@ -795,7 +811,7 @@ async function streamRequest(url, options, event, requestId, skipTLS) {
         res.on("data", (chunk) => {
           if (streamFinished) return;
           noteStreamActivity();
-          if (pluginRuntimeId) {
+          if (pluginRuntimeId || delegatedId) {
             pluginResponseBytes += Buffer.byteLength(chunk);
             if (pluginResponseBytes > 131_072) {
               failStream(new Error("Plugin model stream byte budget exceeded"));

electron/bridges/aiBridge.test.cjs

@@ -46,6 +46,7 @@ function loadBridgeWithMocks(options = {}) {
       clearPendingApprovals() {},
       cleanupScopedMetadata: async () => {},
       cleanup() {},
+      ...options.mcpServerBridge,
     },
       "../cli/discoveryPath.cjs": {
       getCliLauncherPath: () => "/tmp/netcatty-tool-cli",
@@ -1725,6 +1726,61 @@ async function withCapturingServer(t, options, respond) {
   };
 }
 
+test("delegated model stream release aborts its actual HTTP request and stale turns fail before HTTP", { timeout: 5_000 }, async (t) => {
+  const { randomUUID } = require("node:crypto");
+  const id = randomUUID(); const tag = randomUUID(); const chatId = `plugin-agent:${id}`;
+  let live = true; let release; let detached = 0; let requests = 0;
+  let resolveAccepted; const accepted = new Promise((resolve) => { resolveAccepted = resolve; });
+  const ctx = await withCapturingServer(t, { mcpServerBridge: {
+    beginPluginAgentModelRequest: () => {},
+    assertPluginAgentCaller: (actual, sender, actualTag) => {
+      assert.equal(actual, chatId); assert.equal(sender, 1);
+      if (!live || actualTag !== tag) throw Error("Agent turn unavailable");
+    },
+    onPluginAgentRelease: (_id, _tag, cancel) => { release = cancel; return () => detached++; },
+  } }, (res) => {
+    requests++; res.writeHead(200, { "content-type": "text/event-stream" });
+    res.write('data: {"synthetic":true}\n\n'); resolveAccepted();
+  });
+  try {
+    const invoke = (turnTag) => ctx.ipcMain.handlers.get("netcatty:ai:chat:stream")({ sender: ctx.sender }, {
+      requestId: `agent-model_${id}_${turnTag}_sdk_fixture`, url: `${ctx.baseURL}/v1/chat/completions`,
+      headers: { "content-type": "application/json" }, body: '{"stream":true}', providerId: "content-length",
+    });
+    const ended = new Promise((resolve) => ctx.onStreamEvent((channel) => {
+      if (channel === "netcatty:ai:stream:error" || channel === "netcatty:ai:stream:end") resolve();
+    }));
+    const pending = invoke(tag); await accepted; live = false; release();
+    await pending; await ended;
+    assert.equal(detached, 1); assert.equal(requests, 1);
+    const stale = await invoke(randomUUID());
+    assert.equal(stale.ok, false); assert.equal(requests, 1);
+  } finally { ctx.restore(); }
+});
+
+test("delegated compaction fetch uses the same exact-turn cancellation", { timeout: 5_000 }, async (t) => {
+  const { randomUUID } = require("node:crypto"); const id = randomUUID(); const tag = randomUUID();
+  let live = true; let release; let detached = 0; let requests = 0;
+  let accepted; const started = new Promise((resolve) => { accepted = resolve; });
+  const ctx = await withCapturingServer(t, { mcpServerBridge: {
+    beginPluginAgentModelRequest: () => {},
+    assertPluginAgentCaller: (chatId, sender, actualTag) => {
+      assert.equal(chatId, `plugin-agent:${id}`); assert.equal(sender, 1);
+      if (!live || actualTag !== tag) throw Error("Agent unavailable");
+    },
+    onPluginAgentRelease: (_id, _tag, cancel) => { release = cancel; return () => detached++; },
+  } }, (res) => { requests++; res.writeHead(200, { "content-type": "application/json" }); res.write('{"synthetic":'); accepted(); });
+  try {
+    const invoke = () => ctx.ipcMain.handlers.get("netcatty:ai:fetch")({ sender: ctx.sender }, {
+      requestId: `agent-model_${id}_${tag}_fetch_fixture`, url: `${ctx.baseURL}/v1/chat/completions`, method: "POST",
+      headers: { "content-type": "application/json" }, body: '{"messages":[]}', providerId: "content-length",
+    });
+    const pending = invoke(); await started; assert.equal(ctx.received.body.toString(), '{"messages":[]}');
+    live = false; release(); assert.equal((await pending).ok, false); assert.equal(detached, 1);
+    assert.equal((await invoke()).ok, false); assert.equal(requests, 1); assert.equal(ctx.ipcMain.handlers.has("netcatty:ai:chat:cancel"), true);
+  } finally { ctx.restore(); }
+});
+
 test("streaming AI requests send Content-Length instead of chunked encoding", { timeout: 5_000 }, async (t) => {
   const ctx = await withCapturingServer(t, {}, (res) => {
     res.writeHead(200, { "content-type": "text/event-stream" });