English | 简体中文

Featured by the official WeChat account

Listed in the dshfind directory GitHub Trending Daily #7

` forwards native DSH. See [Automation CLI](docs/cli.en.md) for protocol, limits, resume restrictions, and Node/Python/PowerShell integration examples. | Command | Purpose | | --- | --- | | `dsh-tui` / `dst` | Start the TUI; `dst` is a short alias for the same program | | `dsh-tui --resume [id]` · `dsh-tui update` · `dsh-tui doctor` | Resume a session · update the profile and align the launcher · pre-flight environment checks | | `dsh-tui safe` | Read-only diagnostics, plugin inventory and repair guidance; `safe --rescue` builds a clean rescue profile | | `dsh-tui version` · `dsh-tui help` | Launcher and profile versions and usage; both work even without a `dsh` install | Leading DSH options such as `--dump-config` and `--patch ` are forwarded unchanged; other arguments go to the app in `dsh --profile dsh-tui`. Use `dsh-tui -- --resume=sid-1 ./notes` to send `--resume=sid-1 ./notes` as literal prompt text, without selecting a session or workspace. When invoking DSH directly, use `dsh --profile dsh-tui -- -- --resume=sid-1 ./notes`: the first `--` belongs to DSH, the second to the app. Host options can precede a literal prompt: `dsh-tui --patch ./overlay.yml -- --resume=sid-1` applies the overlay and sends `--resume=sid-1` as prompt text without resuming that session. Safe mode: [Getting started](docs/getting-started.en.md). ### Importing conversations from other agents (`dsh-tui migrate`) Bring Claude Code, Codex, OMP, zcode, or Grok Build conversation histories into the DSH session store, then browse and resume them by their original working directory via `/resume`: ```sh dsh-tui migrate # list importable counts per agent (writes nothing) dsh-tui migrate claude-code # import every Claude Code conversation (likewise codex / omp / zcode / grok-build) dsh-tui migrate codex --dry-run # preview what would land, write nothing ``` - **Read-only source**: migration only reads the foreign agent's local store; artifacts are written through the official `JsonlSessionPersistence` backend, so imported sessions are first-class (openable, continuable). - **Idempotent**: one deterministic UUID per source conversation — re-importing skips what is already present instead of stacking duplicates. - **Structure preserved**: user/assistant messages, reasoning traces, tool calls with their results, and the source's context compactions (as native compaction checkpoints) are rebuilt turn by turn; harness-injected machine text opens no turn. An imported session can pick the work straight up. In-TUI browsing: the session screen (`/resume`) shows a tab per agent that has conversations; picking one imports just that conversation and opens it. In-TUI: `/migrate` (optionally `/migrate [--dry-run]`) runs the same import in a child process and reports through the notification flow. CLI alternative: `dsh-tui migrate ...` from any shell runs the same import. Full guide: [Session migration](docs/migrate.en.md). - More agents (pi, opencode, …) extend the adapter registry as adapters land; grok-build reads `GROK_HOME` when set. **VS Code**: use the integrated terminal or the `dsh-tui-vscode` extension. See [VS Code guide](docs/vscode.en.md). **Herdr**: run `dsh-tui` in a [Herdr](https://herdr.dev) pane; `idle` / `working` / `blocked` are reported through its local integration API. **Any terminal**: dsh-tui reports `idle` / `working` / `blocked` / `done` / `error` over the pty with [OSC 7501 (Program Status Protocol)](https://www.superlogical.com/rex/docs/build/program-status), so terminals and agentic inboxes that implement it can show what the session is doing; terminals that do not implement it ignore the sequence. Set `DSH_TUI_PROGRAM_STATUS=0` to turn it off. Bare `--resume` (`-c`, `--continue`) reopens the last session of the backend this launch selected. Startup recovery only ever targets that backend: a backend with no last session, or a derived target that belongs to a different backend than the one that actually booted (an unknown backend id falling back to DSH, `--backend` naming a backend that is not installed, a remembered kernel that is not the marker's source), refuses with a clear error and exit code 1 — never a silent cold start, never another backend's session, never a new session. An explicit `--resume ` passes that id to the selected backend as-is. The one exception is safe mode's "retry normal startup": it retries the kernel and session recorded in `last-run.json`, so a record whose backend is gone degrades to a warning plus a cold start — that retry is the last way back. ### Experimental: Claude backend dsh-TUI can also run its session on Claude: the same interface, driving the Claude Code CLI through the Claude Agent SDK. Your project's `CLAUDE.md`, settings, hooks, MCP servers and plugins load as the CLI loads them. ```sh # once, in the dsh-tui profile directory (the SDK is an optional dependency) cd ~/.dsh/profiles/dsh-tui && pnpm add @anthropic-ai/claude-agent-sdk@0.3.287 dsh-tui --backend claude # or pick Claude in /kernel; that choice is remembered ``` The easiest install: open the kernel picker (the launchpad "Kernel" entry or `/kernel`) and press Enter on the dim Claude row — the wizard locates the profile directory and installs the pinned SDK for you; the command above is its manual equivalent. The confirmation shows the exact package and version. Closing the wizard, including clicking outside it on the launchpad, cancels a pending installation. - **Sign-in**: a `/channel` relay profile, your dsh-auth `anthropic` sign-in (`/login`), `ANTHROPIC_API_KEY` or cloud-provider variables, or an existing `claude login`, in that order. A `claude` on `PATH` is used when present, then one in the native install directory under your home (`~/.local/bin`, or `%USERPROFILE%\.local\bin` on Windows); every candidate has to launch and report a version, and the SDK's bundled binary is used only when none does. - **Works**: streaming, tool cards, approvals and questions, `/model`, `/effort`, Claude's permission modes (`/permission`, `Shift+Tab`), `/compact`, `/context`, `/mcp`, `/resume`, `/fork`, double-`Esc` rewind, subagents, background jobs, images, `/btw`, and the USD cost Claude reports. - **Not available**: DSH-only commands such as `/tree`, `/preset`, `/provider`, `/workspace`, `/agentview` and `/bg`. One process runs one backend; `/kernel` switches by restarting into a new session. - **Startup**: the screen appears before the session opens, with only a light profile composed (this package plus the profile's third-party plugins); see [Claude backend](docs/claude-backend.en.md#known-limitations). The DSH kernel starts from the same entry and loads DSH in the same process behind its first screen; `DSH_TUI_HOST_ENTRY=0` restores the old launch path for every kernel. Details and known limitations: [Claude backend](docs/claude-backend.en.md). ### Experimental: native Codex backend Run your own Codex through `codex app-server`, sharing its configuration, login, instructions, skills, hooks, MCP and native threads: ```sh npm install -g @openai/codex@0.160.1 dsh-tui --backend codex dsh-tui --backend codex --resume ``` Protocol baseline **0.160.1**, minimum **0.144.0**; other versions may show drift. `CODEX_EXECUTABLE` selects a binary; `/kernel` remembers the backend. `codex resume ` can open the same thread after the other writer exits. This is not `migrate codex`, which imports history into DSH. With native credentials, a writer conflict for an idle thread retained by the official background server triggers a reconnection to that server. Managed subscription credentials and `/channel` connections use private app-server processes. Streaming/tool cards, approvals, questions, steer/queue/interrupt, model and effort controls, Plan, `/review`, `/diff`, `/usage`, `/init`, skills and MCP share the existing UI. Async questions open the questionnaire while Codex continues working; answers steer the turn (or queue if unavailable), and dismissing the question leaves work running. **Shift+Tab only toggles Plan**, keeping its underlying permission preset; Full Access requires an explicit choice. Existing Codex settings are respected, not overwritten with defaults. `/login` offers ChatGPT OAuth, a device code or an API key (the last writes to Codex’s own credential store). Relay `/channel` connections take precedence; managed subscription tokens are only injected on first-party routes. dsh-TUI does not write `~/.codex/config.toml` or log out your native Codex account. A provider `env_key` from your own config (e.g. `DEEPSEEK_API_KEY`) that the shell did not export is injected from the DSH credential store when the ref is stored there — the active store first, then the default `~/.dsh` one — so keep the key in the store, no per-shell export needed. When nothing can supply it, the session still starts and the reason is reported once as a start notice: Codex itself rejects every turn of that provider. For Claude and Codex, `/channel` tokens (`CHANNEL_*` refs) belong to the active `DSH_HOME` only. Disconnecting a channel cannot revive a token from the default home; reconnect it in the active home if needed. Provider `env_key` credentials retain the fallback described above. TPS includes hidden reasoning time and excludes tool execution time. Live text estimates are corrected when Codex reports output token usage. Decode spans of 500ms or less are excluded from TPS samples; token and cost totals still include all reported usage. Native browsing/archive, fork/conversation rewind (the first message requires Codex app-server 0.160.1+), paged history, images, subagents, polled background terminals, goals and `/btw`/`/recap` use the existing surfaces. `/logout` removes only the matching dsh-auth credential; already-loaded managed tokens require a normal restart, not native logout. The real 0.160.1 app-server passed nine credential-free offline checks and eight daemon-resume checks, with no model turn or charge; real subscription login, credentialed model calls and real-TTY interaction were not run. Only Codex identification/title changes automatically, not palette or companion. Using ChatGPT subscription tokens in third-party clients is subject to OpenAI’s terms. Full instructions and current boundaries: [Codex backend](docs/codex-backend.en.md). ### Experimental: DSH Agent Teams DSH's experimental Agent Teams lets the session's agent (the Lead) create named teammates that share the working directory, message each other and coordinate on a shared task board. It ships with dsh, is off by default, and `/plugin list` advertises it. Switch it on: ```sh /plugin enable @deepseek-ai/dsh-experimental-agent-team-profile ``` The switch enables or disables the bundle in the profile, so it persists across restarts, and on a `dsh --profile` launch it applies at once — running sessions included: the model is told which tools came and went. `/team` appears in Help and `/` completion only once the team service is mounted, and only reports: `/team` (or `/team status`) shows the bundle, the service and this session's teammates. `/team on|off` was removed; typing it points at `/plugin enable|disable`. Turning the bundle off while teammates run asks first, and switching off stops them: the team service releases the teammates still running as it unloads. Inside a teammate session the other teammates' runs are not visible, so the question counts them as possibly running. The team record stays in the session and comes back when the bundle is enabled again. If the running DSH does not ship the bundle (`/plugin list` stays silent), switch DSH to one of the supported lines first (`0.2.1-rc.5`, `0.2.1-rc.4`, `0.2.1-rc.3`, `0.2.1-rc.2`, `0.2.1-alpha.5`, `0.2.0-rc.1` or `0.2.0-rc.2`). To install it into the profile explicitly, run `dsh plugin --profile dsh-tui add @deepseek-ai/dsh-experimental-agent-team-profile@`: the team packages ship in lockstep with DSH and pin their DSH peers exactly, so the version must match. While a request carries `spawn_teammate`, dsh-TUI drops `subagent` / `subagent_fork` from it, and the team's `send_message` / `list_agents` / `interrupt_agent` / `wait_agent` take the place of the legacy controls of the same names, so `spawn_teammate` is the delegation tool; with the team off the legacy tools are back. Subagents that are not team members (workflow, ralph) keep `subagent`. A teammate shows up as a subagent row, a message between members as a `✉ ` bubble in the receiving session (a teammate's received messages show on its subagent detail as agent messages), and the other team tools as one-line cards (`send_message` with its target and `sent`). The agents dashboard (Ctrl+A) and the agents side panel switch to a team view: each teammate under its member name with `running` / `idle` / `provisioning` / `failed` (a teammate whose turn ended is idle — a message wakes it — not done), the Lead line, the remaining subagents, a read-only task board (status, owner, `blocked`, write-scope warnings) and a banner when the team record was rejected. Limits: the switch covers the whole profile, not one session (a launch without the profile plugin service, or without hot reload, needs `dsh plugin` and a restart); there is no "enter teammate session" yet, and `/export` leaves team messages out. Upstream limits apply: teammates share one working directory, a team lives in one process, and a task owner is never released automatically. Subagent failure badges and the Companion error state share session-scoped unread status. Opening that child’s detail or main view acknowledges only that failure; a new run or failure alerts again. Acknowledgements survive panel remounts and session switches during this process, but a cold restart starts unread. Opening the dashboard alone does not acknowledge every child. Task status stays failed. ## Keybindings & Mouse `Enter` send · `Tab` complete · `Ctrl+Enter` interrupt and send · `Alt+Up` recall the last message · `Esc` closes local layers before interrupting a running turn, double-`Esc` rewinds on empty idle input · `Ctrl+B` side panel · `Ctrl+O` details · `Ctrl+R` history (`↑`/`↓` and `Ctrl+R` are scoped to the current project) · `Ctrl+V` paste · `Ctrl+Shift+E` fullscreen draft editor · `?` shortcuts · `←` open the session manager (DSH backgrounds the current session first). In both the launchpad and chat, `Ctrl+U` deletes from the caret to the current line start, preserving text to the right and whole image chips. It edits only the focused input. In the launchpad input, `Shift+Enter` (or `Option+Enter`) opens chat and inserts a newline at the caret, keeping the draft and staged images unsent. Continue typing there, then press `Enter` to send. In both the launchpad and chat, `Alt/Option+←/→` moves by whitespace-delimited words and `Alt/Option+Backspace` deletes the previous word, like `Ctrl+W`. On macOS, configure your terminal to send Option as Meta. Use `Alt+Up` / `Alt+Down` to page through question text and details, or approval previews on very short terminals, without moving the choice focus; these keys are remappable in `/settings` → `Shortcuts`. Fullscreen also supports the wheel over the preview. Complete OAuth links remain readable when browser and clipboard helpers are unavailable. Text, cursor position and staged image attachments on the launchpad or in chat while the backend starts are preserved when the session becomes ready. Press `Enter` after it is ready to send; an earlier `Enter` preserves the draft without queuing it. Opening a new session while startup is pending clears the previous draft and its images. The goal bar stays on one summary line: hovering truncated goal text in fullscreen or split shows the whole objective, and a bare `/goal` prints the full status — objective, phase, rounds or budget, available commands — as a transcript block in the `/plugins` shape. Inline mode sees no pointer events, so that block is how its users read a long objective. While the model is working: `Enter` steers, `Tab` queues a follow-up, `Ctrl+Enter` interrupts and sends. Input that names a command is still a command — with or without arguments — so `/model` or `/new` reach their own gate (and the `/` overlay sinks the commands that affect the running conversation) instead of silently becoming an interruption; only text that is not a command — and a direct skill gesture such as `/skill-name …` — steers. Windows Neovim/Vim terminals identified by `NVIM` or `VIM_TERMINAL` retain VT input instead of enabling ConPTY mode 9001. For another incompatible embedded host, set `DSH_TUI_DISABLE_WIN32_INPUT_MODE=1` before launch (PowerShell: `$env:DSH_TUI_DISABLE_WIN32_INPUT_MODE="1"`). The same gate applies at startup and after resume. Native Windows Terminal, conhost and VS Code keep their existing mode unless disabled; the opt-out can remove modified-Enter reporting. On native Windows, fragmented Win32 input records are reassembled across short input delays instead of appearing as numeric protocol text. The platform check only reports that this machine might run the private mode (win32-input-mode); a bare `ESC[` fragment is held only after one record has actually been decoded, while a fragment whose own shape is already record-specific holds on its own (which is how even the first record can survive a split). Windows terminals that never enter the mode (mintty, GitBash) therefore keep the classic VT path: a lone `Esc` keeps its normal response time, and a letter typed after a timed-out `ESC[` is not swallowed. Incomplete records are held for a bounded recovery window (1 second from first capture, never extended by later input; 64 bytes max); past either bound the hold ends and input is handled as before. Unrecognized complete CSI sequences are not inserted as text; after a damaged CSI prefix, a bare ASCII letter can be consumed as its terminator, while normal Win32 key records and bracketed-paste text retain their own boundaries. A session's very first record can still leave residue if it is split before its record-specific shape forms; once any record has been decoded, every split position is covered. Inside the recovery window, literal input starting with `[digit;…` cannot be told apart from a protocol prefix — it may be held, or re-joined to a preceding `Esc`. To type it, wait for the window to close, or avoid that shape right after `Esc`. Terminal replies that arrive split are reassembled the same way (native Windows ConPTY is the common source): while the app still has a query awaiting its answer, an unfinished DA1 / DA2 / DSR / DECRPM / XTVERSION tail — even one split again after the introducer `Esc` was flushed — is held across input delays, but only while its shape can still complete into the response type that query expects. It is then consumed as the reply it completes instead of entering the prompt as protocol text. That claim is evidence-gated, and this is the difference from earlier builds: no query awaiting an answer means nothing is claimed, so a literal `[?61;4c` typed right after `Esc` still enters the prompt exactly as before. The window is bounded like the record hold (about a second, never extended by later input; 64 bytes max); past either bound it ends, and bytes still shaped like an unfinished reply prefix are dropped rather than shown. Inside that window, with a query of the matching response type outstanding, same-shaped literal input can still be claimed as a reply; to type it, wait for the window to close (about a second), or avoid that shape while a query is outstanding. Fragmented SGR mouse reports no longer land in the prompt as text: an incomplete report header is held until the rest arrives, and a report that completes is handled as a mouse event. The hold is armed only while mouse reporting is actually active (fullscreen, with mouse tracking enabled); inline sessions and terminals that never enable tracking keep the existing behavior. The claim window is bounded from first capture (at most 1 second; 64 bytes max), and a continuation arriving inside it is still claimed rather than replayed. Release has no timer: once a parse call sees either bound exceeded, it replays the held bytes as ordinary keys in arrival order — literal input can be delayed, but is never dropped. A completed text-only assistant reply containing only a leading `⏵` status line remains visible in the conversation and can be selected for copying. Live status lines and status lines followed by a real answer stay out of the transcript body. Plugin slash-command results, including errors, remain as local transcript blocks for scrolling and copying during the current session. Indentation and line breaks are preserved. Each report retains at most 200 lines, 65,536 UTF-16 code units and 4,000 terminal cells per line, plus a visible truncation marker. The local display rows are not sent as model input or replayed as conversation history. The backend may separately persist command audit events and their results. Older local report blocks are evicted within the shared 600-row budget. Explicit built-in report layouts (such as `/goal`) keep their existing formatting. Mouse (fullscreen): drag to select and copy, double/triple click to select a word or line, click tool cards, timeline ticks and `[Image #N]` previews. Automatic copies keep the text selected; press `Esc` to clear it or start a new selection to replace it. Selection highlighting skips trailing padding and blank rows while preserving spaces within text and code indentation. Inline mode uses the terminal's native selection. When a fullscreen selection starts in a code block's body, soft-wrapped rows join without adding frame padding or newlines, in both light and full frames. Hard line breaks and the existing hard-line inset remain part of screen copying. During a fullscreen text drag, the native cursor follows the selected text's edge using your terminal's enabled cursor animation or trail effects. Moving into trailing padding or blank rows keeps it at the nearest selected text edge. Releasing or cancelling the drag restores the focused input's caret. File paths in prose can open the file-action menu; automatic detection does not extract a path from inside a slash-delimited token such as `working/idle/needs-input` or a date such as `2024/01/15`. **Pasting**: the launchpad accepts clipboard images and pasted image paths as `[Image #N]` attachments; `Enter` sends them with the first message. Commands that do not accept images preserve the draft and its attachments. Image chips behave like chat: arrows step across them, Backspace at the end or Delete at the start removes the whole image, and Ctrl+W never splits a chip. Text pasted on the launchpad is folded to one line. In chat, native and bracketed paste keeps ordinary text and newlines, and never submits itself on arrival. On Windows terminals that deliver a paste as win32-input-mode key records, a record stream leaked into the payload is decoded back into the characters its `Uc` field encodes — newlines included — so the composer's line count matches what was pasted; only records with no character meaning are stripped (a multi-line paste no longer leaves stray `_`), and a complete record is always consumed before an ESC-less tail, so no payload character is deleted along with an orphan escape. Pasted CRLF collapses to a single newline; genuine underscores and bracketed-paste text are untouched. **Dropped files**: a native Windows desktop drop (Windows Terminal / OpenConsole) arrives as an OSC 8 hyperlink; the parser restores its `file://` URI to a decoded local path before paste hygiene runs, so the `]8;id=…;` parameter bytes never reach the draft. Image paths enter the existing image staging pipeline; other files are inserted as a referenceable path (a path containing whitespace arrives in the composer's quoted `"…"` single-token form). Only `file://` URIs are restored, and it is fail-closed: a remote authority/UNC, a payload carrying several distinct URIs, or a URI that carries several tokens is refused and stays literal text rather than guessed. Fullscreen drag-copy uses the final highlight. If a live row changed during a drag, move the selection back to stable text to establish a new baseline. A stationary selection whose copied text changes is still refused; automatic scroll/resize does not clear that protection. The pixel whale, large title and context/TPS colors follow the same terminal color depth as other text: monochrome, 16-color, 256-color or truecolor. Apple Terminal and tmux use the shared fallback; `NO_COLOR` and `FORCE_COLOR` retain the existing shared color policy. If resume reports that another DSH process owns the writer, release the session in that process (for example, dsh web) and retry in the same TUI. The foreground session stays intact; do not delete session or lock files to bypass single-writer protection. Full reference: [Interaction and commands](docs/interaction.en.md). ## Built-in Commands `/resume` · `/home` · `/agentview` · `/bg` · `⌸` open the same session manager: workspace rail, live state, filter, ★ pins. Also `/model` `/new` `/compact` `/export` `/btw` `/tree` `/fork` `/rewind` `/settings` `/setup` `/status` `/cost` `/jobs` `/skills` `/mcp` `/provider` `/auth` `/login` `/update`. On DSH, `/fork` keeps the current session open and creates a resumable copy; a copy with history records its parent and appears in the same session family. `/dsh`, `/codex`, and `/claude` switch directly to the named kernel, just like choosing it in `/kernel`: the choice is remembered and the process restarts into a new session. A running turn blocks switching; choosing the current kernel keeps the session. Availability checks and the Claude install wizard follow the same picker flow. `/model` shows models and reasoning effort on one page. DSH has provider tabs with **Recently used** first, moving the current model to the top; `Tab` / `Shift+Tab` select the next / previous provider. Codex and Claude open their model catalogs directly, without provider or recents tabs. `↑/↓` select a model, `←/→` adjust its effort, `Enter` applies the model and any explicit effort draft, and `Esc` cancels. Changing only the model preserves the backend's preference handling. Mouse users can click the available tabs, models, effort levels, and select/cancel hints; clicking an effort level immediately applies the focused model and that effort and closes the picker. The wheel moves through models. Short terminals keep the focused model and select/cancel actions visible, hiding descriptions and neighboring models first, then the effort row when only two rows remain. Shortcuts sit below the title and effort levels have their own section; DSH, Claude, and Codex use the terminal background while covering the text underneath. In `/provider`'s model list, focus a model and press `Tab` to edit its context window, max output tokens, reasoning efforts, and image input capability. The session manager focuses the most recently used session in the current workspace; if there is no history, it focuses the new-session card. Moving between the workspace rail and session list preserves the selected session, including when the mouse enters the list. Switching to another workspace selects its latest session; switching back also starts from its latest session instead of restoring an earlier selection. Press `←` to move to the workspace rail. DST preloads the session list in the background after startup and updates the cache on success. The manager paints the last successful list immediately. Opening `/resume` while that read is pending shares the request and receives results that have already arrived. This first-paint snapshot survives restarts on DSH, Claude and Codex and is isolated by backend and storage directory. With or without a snapshot, all three backends prioritize the current workspace before filling in other workspaces. Fresh sessions and titles merge into the list immediately; cached rows from other workspaces remain until the full read finishes. Background updates preserve a session the user has selected manually. Claude and Codex first request up to 32 recent sessions within their native cwd scope: Claude's SDK includes Git worktrees in the same repository, while Codex matches the session cwd exactly. Codex listings reuse the running connection and read the first 32 regular results alongside the state DB shortcut, then fill in later pages. The browser groups sessions by their own cwd. DSH resolves the current workspace's metadata first and publishes it before reading other workspaces' logs, even when it has fewer than 32 sessions. Titles that require a deeper DSH log scan appear first with a fallback name and update in place when recovery finishes. The session manager shows the selected workspace's absolute path once, beneath the source tabs (wrapping when needed; hover reveals exceptionally long paths). Session rows show their title and essential status/time instead of repeating the directory; DSH size and model remain in the title tooltip. With DSH's current JSONL backend, startup and `/new` keep initial permission events in memory until further session activity saves the complete log. Flushing a session that holds only initialization leaves it unstored. Restarting an unstored empty session starts fresh. Removing a workspace registration keeps its sessions accessible under a "History only" directory in the rail. History-only directories offer edit and new-session actions; rename and remove are available for registered workspaces. If a `/resume` attempt fails or is cancelled before switching, it releases any session occupancy acquired by that attempt so the session can be retried. **Background jobs**: card headers open the focused task panel. Click the card body or use `Ctrl+O` to toggle the command between its first statement and full script. Commands and output use separate colored edges with `❯` (`>` on Windows) and `≡` on their first rows; output always stays at the latest two visible rows. `/jobs` and the side panel keep the full output scrollable, while `e` toggles the focused command. Consecutive blank script lines collapse to one. **Background sessions**: On the DSH backend, `/bg` or `←` on an empty prompt backgrounds the current session and opens the session manager; `Esc` returns to it. Background sessions run in this process and stop when the TUI exits. Logs survive. On Claude/Codex, those entries open the session manager without backgrounding the session. Full commands: [Interaction and commands](docs/interaction.en.md). ## Configuration & Extensions Agent presets, themes, MCP servers, environment variables: [Configuration](docs/configuration.en.md) · [Themes](docs/themes.en.md). With the DeepSeek brand, Companion skins `deepy` and `whaleGirl` replace the maid portrait; choose `whale` and enable Maid portrait to use it. Claude uses its own artwork; Codex uses its own raster portrait or the maid character-art fallback. Both brands ignore these settings for splash artwork. See [Configuration](docs/configuration.en.md). DSH profiles inherit official reporting defaults: DeepSeek API requests carry plugin package identities and incremental Session logs to the configured `baseURL`, including third-party gateways, while OpenTelemetry uploads a Session-log prefix only after explicit feedback. User overrides remain supported; see [reporting settings](docs/configuration.en.md#official-request-metadata-and-feedback-reporting). ## How It Works ```text dsh profile → dsh-base → dsh-TUI Cordis patch → agent preset + DSH services → session/event → Channel projection → React components → Ink/Yoga renderer → terminal ``` The TUI handles interaction and presentation. The session log is the source of truth. DSH services own models, tools, and persistence. Long sessions render in O(visible window). Runtime path, module boundaries, performance notes and persistence locations: [Architecture and limitations](docs/architecture.en.md). ## Known Limitations - Injected plugin context has no standalone display; it counts into the context segments. - `/model` changes the next request’s route in the same session; history and session ID are preserved. The last used route is recorded when the next request starts. DSH versions before `0.1.2-alpha.3` refuse switching and prompt an upgrade because their subagents inherit the original route. - `Ctrl+V` needs platform clipboard tools; unsupported bitmap formats are rejected. - Windows Terminal/ConPTY sixel frames check the last transmitted raster’s cursor position before parking, using measured cell geometry and encoded band controls. Detected drift uses the same physical clear and redraw as `Ctrl+L`. Probes allow one pending reply (500 ms), skip resize/handoff, and pause for 60 seconds after an unanswered query or three repairs within 10 seconds. Set `DSH_TUI_SIXEL_CURSOR_HEAL=0` to disable; `DSH_TUI_DEBUG` records probe/recovery decisions. This bounded mitigation cannot detect every kind of pixel corruption or repair ConPTY itself. - Shutdown drains only the actual renderer-owned input after terminal cleanup and a 150-ms settle window. Embedders retaining only `unmount` keep that input lease; wrappers replacing the method must pass the renderer’s `shutdownInput` lease to `finishExit`. Custom input drains its own buffered bytes; a device-specific kernel drain can be supplied as the bounded synchronous `render({ drainStdin })` callback. Revoked/replaced owners and non-TTY input are not drained. The window does not guarantee arbitrary SSH latency. - Local Windows copying uses PowerShell with UTF-8 stdin. Copies run in order; each PowerShell attempt has a two-second timeout (Windows PowerShell, then PowerShell 7). If both fail, OSC 52 remains the fallback and requires terminal support. SSH never writes the remote native clipboard. - Catchable exits explicitly end synchronized output (DEC 2026) as part of terminal cleanup, even without a final frame. SIGKILL, native aborts and a fully blocked JavaScript event loop cannot guarantee in-process cleanup; recovery then requires the terminal or an external supervisor. - While the TUI owns an active raw input, it reasserts OS raw mode on input-gap/focus recovery and every five seconds without waiting for a key. This repairs externally reset cooked/ECHO state even when Node still reports `isRaw=true`; recovery may take one interval while the event loop runs. The periodic check stops during editor pauses and shutdown/handoff and does not resend display protocols. - A dropped file is restored from its OSC 8 `file://` URI alone: multi-file drops, non-Windows terminal drop encodings and terminator-less truncated frames are not covered, and the hyperlink's own display name is never used. - A background session lives inside this process and stops when the TUI exits. - `/thinking` is not persisted; the kernel `minimal` agent preset (极简模式, one persistent-shell tool) mounts no compaction and does not prune tool results — a long session can hit the context limit, oversized tool output stays in the context in full, and `/compact` plus the questionnaire are unavailable under it (Help and `/` completion mark the entry, and entering the preset says so once); that is a different thing from the `/settings → Minimal UI` (极简界面) display switch; `/update` needs a `dsh --profile` launch and is refused while a turn is running. - The status-bar `≈¥` and `/cost` are session estimates that include subagent usage (priced per each agent's model × peak/idle × cache components); unofficial or unlisted models show tokens only and are marked unpriced. **The platform bill is authoritative.** - Fragmented SGR mouse reports are covered at the mechanism level with controlled fixture comparisons; the reporter environments (macOS → SSH, WSL2 with `dsh web`) have not been re-tested. Full list: [Architecture and limitations → Known limitations](docs/architecture.en.md#known-limitations). ## Development `pnpm dev` keeps the full install/build/pack checks by default. For explicit local iteration, set `DSH_TUI_DEV_FAST=1` (for example, `DSH_TUI_DEV_FAST=1 pnpm dev -- --no-launch`). A miss runs frozen install, `compile`, pack without repeating `prepare`, and isolated profile installation. An unchanged hit skips all four stages only while source/config and compiler-loader contents, Node/pnpm/npm/dsh versions, compiled and vendor output, the tarball, and the installed package/profile match. Replacing pnpm/npm/dsh without changing its reported version requires one normal (non-fast) development run. Internal document links such as `CLAUDE.md -> AGENTS.md` are fingerprinted; external, excluded, dangling or cyclic links and unreadable inputs disable reuse with a diagnostic. Failures invalidate the success stamp before work begins. The script prints stage durations and cache hits. Run normal `pnpm build` and focused regressions before publishing; fast mode does not change release gates. The monorepo development host (`pnpm tui`, `scripts/run.ts`) enables heap forensics only with `DSH_TUI_HEAP_WATCH=1`; unset it or use `0` to disable it. It samples every 15 seconds and takes one snapshot at each heap threshold of 1024, 1536, 2048, 2560 and 3072 MiB. Its own completed files in `$DSH_HOME` retain at most four 64-KiB logs and two snapshots totaling at most 1024 MiB. `DSH_TUI_HEAP_MAX_MB` changes the snapshot budget (integer 1–16384; invalid values use 1024). A single oversized snapshot is removed too; the latest diagnostic may therefore be a log only. Snapshot creation still blocks and uses extra memory and temporary disk space; this does not fix memory leaks. Files use a process-unique `dsh-tui-heap-watch-` prefix. Manual/legacy files are untouched; incomplete `.writing` files are removed only after their owner PID is confirmed absent. Live or uncheckable owners are preserved, and cleanup failures are nonfatal, so quotas apply to successful cleanup of completed files, not peak usage or uncertain crash leftovers. CI uses Node 24 and pnpm 11. The package supports Node `^22.19 || >=24`. The launcher checks the manifest’s Node range before loading the application. Known unsupported versions (including Node 23 and prereleases) stop with Node upgrade instructions. Missing or unrecognized ranges allow startup for compatibility with migrated launchers; `doctor` reports that compatibility cannot be determined. `help` and `version` remain available. TUI entry points use production React even when the workspace sets `NODE_ENV=development`. For renderer debugging, explicitly set `DSH_TUI_REACT_DEV=1` (for example, `DSH_TUI_REACT_DEV=1 pnpm dev` or `DSH_TUI_REACT_DEV=1 pnpm tui`). This selects development React before it loads; its render instrumentation can accumulate memory in long sessions. ```sh pnpm install --frozen-lockfile pnpm build pnpm smoke ``` `lib/types/` is ignored generated output. `pnpm build` recompiles it from a clean output directory and runs the build gates. **Git URL installs are not supported.** The source manifest keeps `@dsh-std/*` as workspace deps and `vendor/dsh-std` as a submodule. pnpm ≥11 also refuses git-hosted `prepare` scripts by default. Install the registry package instead: `dsh plugin --profile dsh-tui add @deepseek-harness-tui/dsh-tui`. Rendering, questionnaire, or tool-card changes also need the matching regression scripts. ## Plugin Ecosystem Plugin development: [admission & development guide](tui-profile/docs/plugin-admission-and-development.md) · [plugin-template](https://github.com/dsh-tui-ecosystem/plugin-template) · [dsh-tui-ecosystem](https://github.com/dsh-tui-ecosystem). Reference implementation: `dsh-working-activity`. Exported plugin subcomponents are admitted using the nearest package manifest of their ESM entry, including import-only and conditional exports; they do not inherit an outer package's identity. A backend plugin (the `tui.dsh/v1alpha1` `Backend` contribution family) is in the kernel picker after a restart: the boot scans the bundles the profile declares, admits and registers each package-root `dsh-plugin.json` declaration, and reads the implementation from the package's `backend` export — importing that module only when the backend is actually selected. Each bundle may declare one backend, and its handler id must match the declaration. Entries awaiting authorization are neither probed nor loaded, including when explicitly requested at startup. Seam grading and API notes: [Plugin development](docs/plugins.en.md). The organization maintains the listing only; it does not endorse community plugins. Installing a plugin from inside the TUI: `/plugin install `. It goes through the host's profile plugin manager — a pre-install notice, a trust confirmation, cancellable progress, build-script approval and exact-version exemptions. Packages on the first-party feed this package ships (`tui-profile/feed/first-party.json`, pinned per release and decided offline) skip the trust confirmation, and only a spec that names that exact version qualifies: a bare name, a tag or a range is resolved again at install time, so it is confirmed with the person instead. What was confirmed is what gets installed — the run pins the exact `name@version` the inspection read — and a turn that is still running refuses the install (finish it, or `/new`, first). The same actions remain available from the CLI (`dsh plugin --profile dsh-tui …`). The confirmation lists the permissions the package declares; `Enter` installs **and grants** — the grant is written to `~/.dsh-tui/extension-grants.json` before the install starts, and a failed install rolls that write back. A registry package's declaration cannot be read before it lands, so a `grant` step follows a successful install: `Enter` grants, `Esc` skips (the install stays). Declared permissions this host does not know are skipped and named. On a terminal too short for a permission row, the list folds to a count or the key hint carries the count; the package identity, the notice and the keys stay visible. A spec names one of three things: ```sh /plugin install /path/to/repo /plugin install https://github.com/exam/ple.git /plugin install @scope/package@1.2.3 ``` Typing `/plugin install ` lists these three shapes in the completion popup, and the same shapes follow the installed names on `/plugin info `. They are examples, never candidates: `Tab` leaves the draft exactly as it is, and `Enter` runs the line you typed — the subcommand's usage line while the spec is still empty, your own spec once it is not. No example can therefore be inserted or installed by accident, and a real path that merely starts like one is never swallowed. During installation, `esc` attempts cancellation and keeps the pane open until the write settles; if cancellation is too late, it waits for the installation to finish. During exemption registration, it waits for the current write and stops subsequent grants and the retry. Exemptions already written remain. Failed installs show up to six redacted log lines; lines larger than 16 KiB are omitted with a notice. Managing what is installed: `/plugin remove `, `/plugin enable ` and `/plugin disable `. A bundle is a composition layer and a row is one patch entry, so the two are separate actions, and a bundle name is matched before any row identity. A module name shared by multiple rows requires a specific row ID. **Gate 2 refuses the three ways this app could switch itself off** — removing or disabling the bundle that provides it, the host layer `dsh-base`, or one of its own rows — and says which rule it broke, without calling the service at all; that holds whether or not hot reload is live, which is the path the host's own guard misses. `enable` is never refused by gate 2 (it is the repair action). Every enable and removal asks first; `disable` asks only about a host-layer row. The host does not attest installed package sources, so even an exact feed match requires confirmation before enabling. These three actions have no cancellation — the service offers none — so `esc` only closes the pane while the write finishes and reports itself into the transcript. Enable and disable have no CLI verb either (the service writes them into the profile's own files). **Grants follow the lifecycle**: `enable` enables and grants the declared permissions, `disable` disables and revokes the permissions that component declared, and `remove` **deletes the component's `grants`/`denies` entries** after the removal — grants are keyed by component id, so leaving them behind lets any later package reusing that id inherit them silently; a reinstall asks again. Backend data directories, storage namespaces and the effect ledger stay, and the residue report names each source by its path. A failed grant write never blocks an install or enable — it is reported instead. Grants are behavioural constraints, not a security boundary. `/plugin list` also advertises the experimental features DSH ships, leaves off by default, and this app knows how to drive (currently Agent Teams, Auto review, Session search and Git worktrees), each with its switch and usage line. A DSH installation that does not ship one shows no such section. ## Documentation - **Start** — [Getting started](docs/getting-started.en.md) · [VS Code](docs/vscode.en.md) - **Use** — [Keys and commands](docs/interaction.en.md) · [User guide](docs/user-guide.en.md) · [Themes](docs/themes.en.md) - **Configure** — [Configuration](docs/configuration.en.md) - **Internals** — [Architecture and limitations](docs/architecture.en.md) · [Session mounting](docs/session-mount-runtime.en.md) - **Plugins** — [Admission and development](tui-profile/docs/plugin-admission-and-development.md) · [Seams](docs/plugins.en.md) - **Contribute** — [Contributing](docs/contributing.en.md) · [Roadmap](docs/roadmap.en.md) · [Community](docs/community-management.en.md) Everything, bilingual: [docs/README.md](docs/README.md). ## Community - **Ecosystem organization**: [dsh-tui-ecosystem](https://github.com/dsh-tui-ecosystem) hosts community plugins, templates, and the curated list. Come ship a plugin, pitch an idea, or just hang out 🐋 - **Chat groups** (Chinese-language): usage questions, plugin ideas, and feature wishes are all welcome. - **Code of conduct**: please read the [Contributor Covenant Code of Conduct](CODE_OF_CONDUCT.en.md) before taking part. | WeChat group (dsh-TUI community 4) | QQ group (ID 572549239) | | :---: | :---: | | | | > The WeChat QR code expires roughly every 7 days; if it stops working, use > the QQ group (572549239) or open an issue to nudge us for a refresh. ## Permissions and Security Boundary > **Windows security warning:** the Windows profile defaults to `danger-full-access` with approval set to `never`, so tools have unrestricted access. Inspect and tighten the profile before starting next to sensitive credentials or in an untrusted repository. No sandbox of its own: dsh-TUI uses the active DSH profile's filesystem, shell, sandbox and approval policies. Permission presets come from the DSH `permissionPresets` registry. **Permission persistence** (all three backends): the Claude and Codex backends keep their `/permission` picks in `~/.dsh-tui/backends//prefs.json`; the DSH pick is kept at `~/.dsh-tui/permission.json`. Every durable preset switch teaches it (picker, typed `/permission`, Shift+Tab static modes, or a switch the official command performed on its own), and a session that never customized its permission planes starts on the remembered preset — applied through the same official switch path. "Never customized" is about the user: the composition writes its own default preset into every fresh session at creation, and those events do not count. Plan-mode transients and the experimental Auto review preset (see below) are excluded, a `DSH_PERMISSION_MODE` launch pin (this run's initial permission plane) outranks the file, and an identity the mounted roster no longer offers is skipped. **Auto review** (DSH, experimental): `/plugin list` advertises it; after `/plugin enable @deepseek-ai/dsh-experimental-auto-review`, the `auto` preset (shown as "Auto review", tagged `EXP`) appears in `/permission` and its completions live, and disappears when the plugin is removed. It is session-only: the model reviews every tool call before it runs, there is no file sandbox, and each call costs one extra model request; its approval prompts show the localized reason, and a subagent denial reads "Auto review denied; not executed". Picking it in the picker first shows a risk confirmation (`Enter` enables, `Esc` goes back; in fullscreen its Enable / Go back rows are clickable); a typed `/permission auto` switches directly. Once the current session has selected it, the picker skips the confirmation and Shift+Tab stops skipping it. **Session search** (DSH, experimental): `/plugin list` advertises it; after `/plugin enable @deepseek-ai/dsh-experimental-session-search`, an agent gains five read-only tools (`session_search`, `session_event_search`, `session_trace`, `session_event_trace`, `session_event_read`) over earlier sessions in the same workspace — cross-session access requires an identical `cwd`. The index is in memory and is built on the first search; nothing is written to disk. This app keeps the kernel Minimal preset at its single persistent-shell tool, so Minimal never shows these five tools or their usage guidance. **Git worktrees** (DSH, experimental): `/plugin list` advertises it; after `/plugin enable @deepseek-ai/dsh-experimental-tool-worktree`, an agent gains `create_worktree`, which creates a new Git branch and a checkout under `.agents/worktrees/` of the current repository (from `HEAD` or a local revision; uncommitted files stay in the source checkout) and moves the session into it — the status line, Git branch and `@` completion follow, while the session stays registered under its project. Its card reads `Worktree("")` with the checkout path and base revision. Nothing is cleaned up: remove the checkout with `git worktree remove ` and the branch separately with `git branch -D ` (the agent leaves with `working_directory`; once the checkout is gone, the next request returns the session to the project). A leftover branch makes a later `create_worktree` with the same name fail. Calling it from inside a worktree nests the new checkout under that worktree. Moving does not change file permissions or already-open terminals. This app hides `create_worktree` from the kernel Minimal preset and the bundled liangshen preset: their persistent shell (liangshen's on macOS and Linux) keeps the directory it started in, so after a move it would still edit the source checkout. **Upstream auto-retry** (DSH): whenever a session binds (boot, `/model` switch, resume), the TUI seeds a retry policy — 5 attempts, transport-drop-aware failure codes including `STREAM_CLOSED` (a dropped upstream stream) — on **the provider route that session actually uses**, through the official `llm-pi-ai` settings section (the policy the kernel's `llm-retry` plugin executes). Only routes without an explicit `retryPolicy` are seeded — dormant channels are never written — and `upstreamRetry: false` in cordis.yml opts out. Details: [Permissions and security boundary](docs/architecture.en.md#permissions-and-security-boundary). ## Acknowledgments - The pixel whale's 22 hand-drawn frames and its idle behaviors are ported from **[dsh-ui-whale](https://github.com/lhh010/dsh-ui-whale)**. The frames were drawn cell by cell in Excel. The idle behaviors are fin flutters, tail thumps, sleep Z's, and click hearts. dsh-ui-whale is the DeepSeek Harness web whale-pet plugin by [@lhh010](https://github.com/lhh010), BSD-3-Clause. Thank you for the art and the inspiration 🐋💜 ## Friends' Links Community, related projects, and companion tools built by friends: [see the links page](docs/links.md) ## Stars [](https://star-history.com/#ccch1mneyyy/dsh-TUI&Date) --- ## Maintainers

ccch1mneyyy Core development & maintenance

CikeSeven Performance & stability

T-Auto Architecture & ecosystem adaptation

AdamPlatin123 Security & interaction

Nagi-ovo Test infrastructure & terminal rendering

※ In no particular order --- ## Contributors [](https://github.com/ccch1mneyyy/dsh-TUI) ## License [MIT](LICENSE) ### Storage migration and read budgets The SQLite migration script uses the official `node:sqlite.backup()` API on supported Node 22.19+ and Node 24+ builds. It probes that capability before opening the source read-only and includes committed WAL data in a consistent snapshot; it never copies a live database/WAL pair by hand. A build missing the API reports a migration-specific prerequisite. Session-tree reads validate packed rows and check their entire member count against the remaining scan budget before expanding events. Oversized rows report truncation; malformed rows report failure. The logical budget does not eliminate physical JSON/frame parsing or validation. Development `@deepseek-ai/*` release-age exceptions list only exact package versions in the current lockfile (including the legacy SQLite island); all other versions retain the 24-hour delay. Regenerate with `node scripts/verify-release-age-cohort.mjs --write` after an intentional lockfile update, then review the cohort diff. ### Bounded update installation `/update` and `dsh-tui update` give each profile installer invocation a **30-minute wall-clock limit**. Set `DSH_TUI_UPDATE_TIMEOUT_MS` to a positive integer in milliseconds to change it (invalid values use the default). Output activity does not reset this deadline; a quiet but healthy installation can use the full limit. Only the final process exit code establishes success: a printed `Done` does not. Ctrl+C cancels the owned installer. On POSIX, cancellation terminates its own process group, then force-kills remaining descendants after two seconds. Windows uses a dedicated PowerShell/native supervisor with a private Job Object. The installer joins that job atomically while suspended; verified membership is required before it runs. The supervisor retains the job handle after the root exits, so cancellation and timeout also terminate orphaned descendants holding output pipes. It does not enable job breakaway or kill processes by name or an exited root PID. Windows requires Windows 10 / Server 2016 or later and Windows PowerShell with `Add-Type`/native interop available. Startup or job-membership failures stop the installation before running an unowned installer. A cleanup failure is reported as unconfirmed, never as proof that all writes stopped. Timeout, cancellation, or unconfirmed cleanup returns nonzero and prevents retries, stale-file removal, repair, and TUI replacement. A partial installation may remain: check/repair that profile before using the recovery command printed at update start and on failure. `~/.dsh-tui/restart.log` records installer category, PID, termination reason and last output timestamp before any restart. The focused **Windows installer process ownership** workflow runs the real native regression on `windows-latest`, with Node 24 and no dependency installation. To run it locally on Windows: `node scripts/verify-update-process-windows.mjs`. It checks orphan descendants, timeout/cancellation, nested jobs, failure diagnostics, streams, arguments and an unrelated process; a Linux run explicitly skips native acceptance.