Merge remote-tracking branch 'origin/master' into feat/web-message-feedback-ui

Keep both Remote contributions master and this branch add: the mount loop now carries commandsRemote, goalsRemote, pluginInventoryRemote, and messageFeedbackRemote, with both new tsconfig references retained.
2026-08-15 21:04:50 +00:00 · 2026-08-12 16:36:10 +08:00
parent 4dcd22d639 b1c13b5ca3
commit c55fca5eda
339 changed files with 7766 additions and 2302 deletions
--- a/apps/cli/composition.md
+++ b/apps/cli/composition.md
@@ -60,6 +60,8 @@ flowchart LR
  cfg --> plugin_dsh_base_sandbox_policy
  plugin_dsh_base_bash_sandbox["bash-sandbox<br/>@deepseek-ai/dsh-bash-sandbox"]
  cfg --> plugin_dsh_base_bash_sandbox
+  plugin_dsh_base_pwsh_sandbox["pwsh-sandbox<br/>@deepseek-ai/dsh-pwsh-sandbox"]
+  cfg --> plugin_dsh_base_pwsh_sandbox
  plugin_dsh_base_approval["approval<br/>@deepseek-ai/dsh-user-approval"]
  cfg --> plugin_dsh_base_approval
  plugin_dsh_base_permission["permission<br/>@deepseek-ai/dsh-permission"]
@@ -68,6 +70,8 @@ flowchart LR
  cfg --> plugin_dsh_base_bash_env
  plugin_dsh_base_tool_bash["tool-bash<br/>@deepseek-ai/dsh-tool-bash"]
  cfg --> plugin_dsh_base_tool_bash
+  plugin_dsh_base_tool_pwsh["tool-pwsh<br/>@deepseek-ai/dsh-tool-pwsh"]
+  cfg --> plugin_dsh_base_tool_pwsh
  plugin_dsh_base_tool_tasks["tool-tasks<br/>@deepseek-ai/dsh-tool-tasks"]
  cfg --> plugin_dsh_base_tool_tasks
  plugin_dsh_base_fs_policy["fs-policy<br/>@deepseek-ai/dsh-fs-policy"]
@@ -194,10 +198,12 @@ flowchart LR
 | `sandbox` | `@deepseek-ai/dsh-sandbox-local` |
 | `sandbox-policy` | `@deepseek-ai/dsh-sandbox-policy` |
 | `bash-sandbox` | `@deepseek-ai/dsh-bash-sandbox` |
+| `pwsh-sandbox` | `@deepseek-ai/dsh-pwsh-sandbox` |
 | `approval` | `@deepseek-ai/dsh-user-approval` |
 | `permission` | `@deepseek-ai/dsh-permission` |
 | `bash-env` | `@deepseek-ai/dsh-bash-env` |
 | `tool-bash` | `@deepseek-ai/dsh-tool-bash` |
+| `tool-pwsh` | `@deepseek-ai/dsh-tool-pwsh` |
 | `tool-tasks` | `@deepseek-ai/dsh-tool-tasks` |
 | `fs-policy` | `@deepseek-ai/dsh-fs-policy` |
 | `tool-fs` | `@deepseek-ai/dsh-tool-fs` |
--- a/apps/cli/config/agent-presets/code/agent.cordis.yml
+++ b/apps/cli/config/agent-presets/code/agent.cordis.yml
@@ -45,11 +45,16 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
 - id: tool-bash
  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'

 # ── filesystem ──────────────────────────────────────────────────────────────

--- a/apps/cli/config/agent-presets/cordis/agent.cordis.yml
+++ b/apps/cli/config/agent-presets/cordis/agent.cordis.yml
@@ -39,11 +39,16 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
 - id: tool-bash
  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'

 # ── filesystem ──────────────────────────────────────────────────────────────

--- a/apps/cli/config/agent-presets/cordis/skills/editing-cordis-compositions/SKILL.md
+++ b/apps/cli/config/agent-presets/cordis/skills/editing-cordis-compositions/SKILL.md
@@ -25,13 +25,13 @@ Two planes, and the choice is not about how "agent-related" something feels —

 A preset is a directory holding one `agent.cordis.yml`, optionally beside a `preset.yml` carrying display metadata — `name` and `description` (and, for shipped presets, a roster `order`). Write the metadata too: a preset without it shows up in every picker as its bare directory name.

-Locally authored presets live one directory per preset under `${DSH_HOME:-$HOME/.dsh}/.agent-presets/`, and the shipped set sits beside the deployment's own config. Use those when the user asks where to look. Both roots are configuration rather than fixed locations, though, and no call reports them — `authorable` says only whether a writable one exists — so take the path you actually read or edit from `list()` or `resolve()`, which is also where `copy()` reports what it just created.
+Locally authored presets live one directory per preset under `${DSH_HOME:-$HOME/.dsh}/.agent-presets/`, and the shipped set sits beside the deployment's own config. Use those when the user asks where to look. A deployment can configure other roots, so the path you read or edit comes from `list()` or `resolve()` — which is also where `copy()` reports what it just created.

 ## The roster service

 `ctx.agentPresets` owns discovery, authoring, and mounting. You reach it by mounting a temporary plugin that injects it and registers a tool for yourself — `cordis_mount` returns only the mount acknowledgement, so a registered tool is how a service answer gets back to you, and it becomes callable on your next step.

-Read `cordis_inspect what:"api" name:"agentPresets"` for the current signatures before writing the code. The four calls this skill relies on:
+Read `cordis_inspect what:"api" name:"agentPresets"` for the current signatures before writing the code. What this skill relies on:

 - `list()` — every preset with its `id`, `trust` (`system` for the shipped set, `user` for authored ones), and the absolute `path` of its composition file. This is how you locate any composition without knowing the install layout; the directory is that path's parent.
 - `read(id)` — one preset's composition text, without a file tool or a path.
--- a/apps/cli/config/agent-presets/standard/agent.cordis.yml
+++ b/apps/cli/config/agent-presets/standard/agent.cordis.yml
@@ -38,11 +38,16 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
 - id: tool-bash
  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'

 # ── filesystem ──────────────────────────────────────────────────────────────

--- a/apps/cli/src/dump-config.ts
+++ b/apps/cli/src/dump-config.ts
@@ -15,7 +15,6 @@ import {
  type ConfigDumpLayer,
 } from '@deepseek-ai/dsh-app-boot'
 import { homePatchPath, prepareProfile, PROFILE_ROOT_FILENAME } from './profile-boot.ts'
-import { resolveWindowsShellLayer } from './windows-shell.ts'

 const NAME = 'dsh'

@@ -34,12 +33,6 @@ export function runDumpConfig(profile: string, defaultOnly: boolean, patches: re
    label: layer.packageName,
    patches: layer.patches,
  }))
-  // The win32 shell platform layer rides between bundles and user layers,
-  // exactly where the boot applies it.
-  const windowsShellLayer = resolveWindowsShellLayer(process.platform, loaded.layers, NAME)
-  if (windowsShellLayer !== undefined) {
-    layers.push({ label: windowsShellLayer.label, patches: windowsShellLayer.patches })
-  }
  if (!defaultOnly) {
    if (existsSync(loaded.patchPath)) {
      layers.push({ label: loaded.patchPath, patches: loaded.patches })
--- a/apps/cli/src/profile-boot.ts
+++ b/apps/cli/src/profile-boot.ts
@@ -29,17 +29,14 @@ import {
  watchUserPatches,
  type Profile,
 } from '@deepseek-ai/dsh-app-boot'
-import { dshHomePath, resolveDshHome } from '@deepseek-ai/dsh-paths'
+import { resolveDshHome } from '@deepseek-ai/dsh-paths'

 /** Shipped agent-preset root: beside this app's own config, in both source and built layouts. */
 const SHIPPED_PRESET_ROOT = fileURLToPath(new URL('../config/agent-presets/', import.meta.url))

-/** Harness-home directory holding locally authored agent presets. */
-const USER_PRESET_DIR = '.agent-presets'
 import { DSH_ENVIRONMENT_KEY, type EnvironmentSnapshot } from '@deepseek-ai/dsh-environment'
 import { provideCmdline } from '@deepseek-ai/dsh-cmdline'
 import { createProcessShutdown, type ProcessShutdown } from './process-shutdown.ts'
-import { resolveWindowsShellLayer } from './windows-shell.ts'

 const NAME = 'dsh'

@@ -110,8 +107,6 @@ interface ComposedProfile {
  profile: Profile
  /** Bundle layers concatenated — the part below the user layers on a live reload. */
  bundlePatches: PatchOptions[]
-  /** The win32 shell platform layer (the base bundle's `windows.cordis.patch.yml`), between bundles and user layers. */
-  windowsShellPatches: PatchOptions[]
  /** The home-level user layer (`$DSH_HOME/cordis.patch.yml`), applied after the profile's own. */
  homePatches: PatchOptions[]
  /** Layers above the user layers on a live reload: `--patch` overlays and the telemetry switch. */
@@ -127,7 +122,6 @@ interface ComposedProfile {
 function allPatches(composed: ComposedProfile): PatchOptions[] {
  return [
    ...composed.bundlePatches,
-    ...composed.windowsShellPatches,
    ...composed.profile.patches,
    ...composed.homePatches,
    ...composed.overlays,
@@ -136,10 +130,10 @@ function allPatches(composed: ComposedProfile): PatchOptions[] {

 /**
 * Load `name` and compose its effective patch stack: bundle layers in
- * `dsh.profile.bundles` order, the win32 shell platform layer (when the host
- * is Windows), the profile's user layer, the home-level user layer
- * (`$DSH_HOME/cordis.patch.yml` — machine-local preferences that apply to
- * every profile, so it outranks the per-profile layer), `--patch` overlays,
+ * `dsh.profile.bundles` order (the base bundle gates the shell stacks by
+ * platform on its own rows), the profile's user layer, the home-level user
+ * layer (`$DSH_HOME/cordis.patch.yml` — machine-local preferences that apply
+ * to every profile, so it outranks the per-profile layer), `--patch` overlays,
 * then the telemetry switch.
 * @param name - the profile name.
 * @param patchFiles - `--patch` overlay paths, in argv order.
@@ -153,28 +147,27 @@ function composeProfile(
  const homePatches = loadOptionalPatches(NAME, homePatchPath()) ?? []
  const overlays = patchFiles.flatMap(file => loadOverlayPatches(NAME, resolve(file)))
  const bundlePatches = profile.layers.flatMap(layer => layer.patches)
-  const windowsShellPatches = resolveWindowsShellLayer(process.platform, profile.layers, NAME)?.patches ?? []
  const rows = new Map<string, EntryOptions>()
-  for (const row of composeEntries([bundlePatches, windowsShellPatches, profile.patches, homePatches, overlays])) {
+  for (const row of composeEntries([bundlePatches, profile.patches, homePatches, overlays])) {
    if (typeof row.id === 'string') rows.set(row.id, row)
  }
  const composedOverlays = [...overlays]
-  // Preset roots belong to every dsh composition that mounts the roster.
+  // The SHIPPED root is the part of the roster only this app can resolve: it
+  // sits beside this app's own config, in both the source and built layouts.
+  // The writable root the roster appends is `dsh-agent-presets`' own, so a
+  // launcher that never reaches this patch still finds a person's presets.
  if (rows.has('agent-presets')) {
    composedOverlays.push({
      id: 'agent-presets',
      config: {
        ...(rows.get('agent-presets')?.config ?? {}) as Record<string, unknown>,
-        roots: [
-          { path: SHIPPED_PRESET_ROOT, trust: 'system' },
-          { path: dshHomePath(USER_PRESET_DIR), trust: 'user' },
-        ],
+        roots: [{ path: SHIPPED_PRESET_ROOT, trust: 'system' }],
      },
    })
  }
  const telemetryPatch = resolveTelemetryPatch(process.env.DSH_TELEMETRY_DISABLED, rows.has(TELEMETRY_ROW_ID))
  if (telemetryPatch !== undefined) composedOverlays.push(telemetryPatch)
-  return { profile, bundlePatches, windowsShellPatches, homePatches, overlays: composedOverlays, rows }
+  return { profile, bundlePatches, homePatches, overlays: composedOverlays, rows }
 }

 /** Options for {@link runProfile}. */
@@ -246,7 +239,6 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
  // removing the override could never revert the row to the bundle default.
  const composeLive = (): PatchOptions[] => structuredClone([
    ...composed.bundlePatches,
-    ...composed.windowsShellPatches,
    ...loadOptionalPatches(NAME, composed.profile.patchPath) ?? [],
    ...loadOptionalPatches(NAME, homePatchPath()) ?? [],
    ...composed.overlays,
--- a/apps/cli/src/windows-shell.ts
+++ b/apps/cli/src/windows-shell.ts
@@ -1,52 +0,0 @@
-/**
- * The Windows shell platform layer: on win32 hosts the shipped profile
- * compositions swap the POSIX-only bash stack for the sandbox-confined
- * PowerShell stack (`@deepseek-ai/dsh-pwsh-sandbox` +
- * `@deepseek-ai/dsh-tool-pwsh`). The layer is the base bundle's
- * `windows.cordis.patch.yml`, injected by the launcher between the bundle
- * layers and the user layers so a user patch can still override it — the
- * only override channel is composition config, like every other roster
- * decision. POSIX hosts never receive the layer.
- * @module @deepseek-ai/dsh/windows-shell
- */
-
-import { join } from 'node:path'
-import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
-import { loadOverlayPatches, type ProfileLayer } from '@deepseek-ai/dsh-app-boot'
-
-/** The base bundle whose package carries the Windows shell patch. */
-export const BASE_BUNDLE = '@deepseek-ai/dsh-base'
-
-/** The Windows shell patch filename inside the base bundle package. */
-export const WINDOWS_SHELL_PATCH_FILENAME = 'windows.cordis.patch.yml'
-
-/** One Windows shell platform layer: its patch file and parsed patches. */
-export interface WindowsShellLayer {
-  /** The patch file path, used as the config-dump provenance label. */
-  label: string
-  /** The parsed patch entries, applied after the bundle layers. */
-  patches: PatchOptions[]
-}
-
-/**
- * Resolve the Windows shell platform layer for a profile composition.
- * @param platform - the host platform (`process.platform` at call sites).
- * @param layers - the profile's bundle layers, in application order.
- * @param binName - the diagnostic prefix on thrown errors (`dsh`).
- * @returns the pwsh layer on win32, else `undefined`. A custom profile that
- *   mounts no base bundle is skipped (it owns its shell stack); a base
- *   bundle whose Windows shell patch is missing fails loud in
- *   {@link loadOverlayPatches} — the shipped package always carries it, so
- *   a miss is a broken installation.
- */
-export function resolveWindowsShellLayer(
-  platform: NodeJS.Platform,
-  layers: readonly ProfileLayer[],
-  binName: string,
-): WindowsShellLayer | undefined {
-  if (platform !== 'win32') return undefined
-  const base = layers.find(layer => layer.packageName === BASE_BUNDLE)
-  if (base === undefined) return undefined
-  const label = join(base.packageDir, WINDOWS_SHELL_PATCH_FILENAME)
-  return { label, patches: loadOverlayPatches(binName, label) }
-}
--- a/apps/cli/tests/built-bin.e2e.ts
+++ b/apps/cli/tests/built-bin.e2e.ts
@@ -227,8 +227,8 @@ function createStartupFixture(): StartupFixture {
    "export const inject = ['cmdlineArgs']",
    'export function apply(ctx) {',
    "  const program = new Command().name('fixture').option('--generation <value>', 'echoed generation')",
-    '  const values = parseCmdline(ctx, program, parsed => ({ generation: parsed.opts().generation }))',
-    '  if (values !== undefined) ctx.provide(\'fixtureStartup\', values)',
+    "  program.action(() => ctx.provide('fixtureStartup', { generation: program.opts().generation }))",
+    '  parseCmdline(ctx, program)',
    '}',
    '',
  ].join('\n'))
--- a/apps/cli/tests/web-agent-presets.e2e.ts
+++ b/apps/cli/tests/web-agent-presets.e2e.ts
@@ -96,7 +96,11 @@ async function bootWeb(settingsFile: string, extra: PatchOptions[] = []): Promis
    // document overrides.
    {
      id: 'agent-presets',
-      config: { default: 'standard', roots: [{ path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' }] },
+      config: {
+        default: 'standard',
+        roots: [{ path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' }],
+        includeUserRoot: false,
+      },
    },
    ...extra,
  ]
@@ -442,6 +446,7 @@ describe('product subagent rows in user presets', () => {
          { path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' },
          { path: userRoot, trust: 'user' },
        ],
+        includeUserRoot: false,
      },
    }])
  }, 120_000)
@@ -624,6 +629,66 @@ describe('a delegated child', () => {
  })
 })

+describe('a launcher that configures no writable root', () => {
+  // The claim this default exists for, asserted through the real shipped
+  // bundles rather than a hand-built context: `apps/cli` patches in only the
+  // system root, and a person's own presets are found anyway because the
+  // roster derives `<dshHome>/.agent-presets` itself. `$DSH_HOME` is pointed
+  // at a temp home BEFORE boot — the derived root is resolved when the plugin
+  // is constructed, and an unpinned run would read the developer's own.
+  let derivedCtx: Context
+  let previousHome: string | undefined
+
+  beforeAll(async () => {
+    const home = await mkdtemp(join(tmpdir(), 'dsh-preset-derived-'))
+    previousHome = process.env.DSH_HOME
+    process.env.DSH_HOME = home
+    await mkdir(join(home, '.agent-presets', 'derived-mine'), { recursive: true })
+    await writeFile(
+      join(home, '.agent-presets', 'derived-mine', 'agent.cordis.yml'),
+      '- id: tool-todo\n  name: \'@deepseek-ai/dsh-tool-todo\'\n  config:\n    allowParallelInProgress: true\n',
+    )
+    const settingsFile = join(await mkdtemp(join(tmpdir(), 'dsh-preset-derived-settings-')), 'settings.yaml')
+    await writeFile(settingsFile, '{}\n')
+    // Only the shipped root, exactly what `composeProfile` supplies; the
+    // writable one is the roster's own default rather than this patch's job.
+    derivedCtx = await bootWeb(settingsFile, [{
+      id: 'agent-presets',
+      config: {
+        default: 'standard',
+        roots: [{ path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' }],
+        includeUserRoot: true,
+      },
+    }])
+  }, 120_000)
+
+  afterAll(async () => {
+    if (previousHome === undefined) delete process.env.DSH_HOME
+    else process.env.DSH_HOME = previousHome
+    await derivedCtx.fiber.dispose()
+  })
+
+  it('discovers and mounts a preset the person authored under the harness home', async () => {
+    const listed = await derivedCtx.agentPresets.list()
+
+    const mine = listed.find(preset => preset.id === 'derived-mine')
+    expect(mine).toMatchObject({ trust: 'user' })
+    // Omitted rather than undefined: a healthy row carries no `broken` key.
+    expect(mine?.broken).toBeUndefined()
+    expect(derivedCtx.agentPresets.authorable).toBe(true)
+
+    const handle = await derivedCtx.agents.create({
+      sessionId: SessionId('preset-derived-root'),
+      setup: agentCtx => derivedCtx.agentPresets.mount(agentCtx, 'derived-mine').then(() => undefined),
+    })
+    try {
+      expect(toolNames(derivedCtx, handle.agent)).toContain('todo_write')
+    } finally {
+      await handle.dispose()
+    }
+  })
+})
+
 describe('authoring a preset on the shipped composition', () => {
  let authorCtx: Context
  let userRoot: string
@@ -642,6 +707,7 @@ describe('authoring a preset on the shipped composition', () => {
          // nothing is the normal first-run state.
          { path: userRoot, trust: 'user' },
        ],
+        includeUserRoot: false,
      },
    }])
  })
--- a/apps/cli/tests/windows-shell.spec.ts
+++ b/apps/cli/tests/windows-shell.spec.ts
@@ -1,73 +1,38 @@
+/**
+ * The shipped shell composition: the base bundle gates both shell stacks by
+ * platform on its own rows (`disabled: !!js process.platform`), so exactly
+ * one shell stack mounts per host and no separate platform layer exists —
+ * the launcher applies nothing beyond the bundle layers. The spec composes
+ * the REAL shipped bundle layers (dsh-base + dsh-web-app resolved from the
+ * app installation anchor) through the boot's patch algorithm and pins the
+ * effective per-platform roster, the preset-level gates that keep tool-bash
+ * out of win32 sessions and tool-pwsh out of POSIX sessions, and the
+ * cold-start resolution closure for the pwsh rows' bare plugin names.
+ */
+
 import { afterEach, describe, expect, it } from 'vitest'
-import { mkdtempSync, writeFileSync, rmSync, mkdirSync, readFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import type { ProfileLayer } from '@deepseek-ai/dsh-app-boot'
+import yaml from 'js-yaml'
+import { entryListSchema } from '@deepseek-ai/cordis-plugin-include'
+import { evaluate } from '@deepseek-ai/cordis-plugin-loader'
 import { composeEntries, initProfile, loadProfile, PROFILES_DIR } from '@deepseek-ai/dsh-app-boot'
-import {
-  BASE_BUNDLE,
-  resolveWindowsShellLayer,
-  WINDOWS_SHELL_PATCH_FILENAME,
-} from '../src/windows-shell.ts'

-const WINDOWS_PATCH = `- id: bash-sandbox
-  disabled: true
- insert:
-    - id: pwsh-sandbox
-      name: '@deepseek-ai/dsh-pwsh-sandbox'
-`
-
-/** One fake bundle layer rooted in a temp directory. */
-function fakeLayer(packageName: string, dir: string): ProfileLayer {
-  return { packageName, packageDir: dir, patchPath: join(dir, 'cordis.patch.yml'), patches: [] }
-}
-
-/** A base bundle layer whose package carries the Windows shell patch. */
-function baseLayerWithPatch(dir: string): ProfileLayer {
-  writeFileSync(join(dir, WINDOWS_SHELL_PATCH_FILENAME), WINDOWS_PATCH)
-  return fakeLayer(BASE_BUNDLE, dir)
-}
-
-describe('resolveWindowsShellLayer', () => {
-  let base: string
-  afterEach(() => { if (base !== undefined) rmSync(base, { recursive: true, force: true }) })
-  const tempBase = (): string => {
-    base = mkdtempSync(join(tmpdir(), 'dsh-windows-shell-'))
-    return base
+/**
+ * The effective disabled state of one row on one platform: a `!!js` expression
+ * evaluates with a platform-scoped `process` so both outcomes pin on any host.
+ */
+function disabledOn(row: { disabled?: unknown }, platform: 'win32' | 'linux'): boolean {
+  const value = row.disabled
+  if (value !== null && typeof value === 'object' && '__jsExpr' in value) {
+    return Boolean(evaluate({ process: { platform } }, (value as { __jsExpr: string }).__jsExpr))
  }
+  return value === true
+}

-  it('never applies on POSIX hosts', () => {
-    expect(resolveWindowsShellLayer('linux', [baseLayerWithPatch(tempBase())], 'dsh')).toBeUndefined()
-    expect(resolveWindowsShellLayer('darwin', [baseLayerWithPatch(tempBase())], 'dsh')).toBeUndefined()
-  })
-
-  it('defaults Windows hosts to the pwsh platform layer', () => {
-    const layer = resolveWindowsShellLayer('win32', [baseLayerWithPatch(tempBase())], 'dsh')
-    expect(layer).toBeDefined()
-    expect(layer?.label.endsWith(WINDOWS_SHELL_PATCH_FILENAME)).toBe(true)
-    expect(layer?.patches).toEqual([
-      { id: 'bash-sandbox', disabled: true },
-      { insert: [{ id: 'pwsh-sandbox', name: '@deepseek-ai/dsh-pwsh-sandbox' }] },
-    ])
-  })
-
-  it('skips custom profiles without a base bundle', () => {
-    const other = fakeLayer('@deepseek-ai/dsh-custom', tempBase())
-    expect(resolveWindowsShellLayer('win32', [other], 'dsh')).toBeUndefined()
-  })
-
-  it('fails loud when the base bundle ships no Windows shell patch', () => {
-    const base = tempBase()
-    mkdirSync(base, { recursive: true })
-    // The overlay loader owns the fail-loud contract: the caller named this
-    // file, so its absence is a misconfiguration, not "no overlay".
-    expect(() => resolveWindowsShellLayer('win32', [fakeLayer(BASE_BUNDLE, base)], 'dsh'))
-      .toThrow(/dsh: failed to read overlay .*windows\.cordis\.patch\.yml/)
-  })
-})
-
-describe('the shipped Windows composition (real bundle layers)', () => {
+describe('the shipped shell composition (real bundle layers)', () => {
  let home: string
  afterEach(() => { if (home !== undefined) rmSync(home, { recursive: true, force: true }) })
  // The app installation anchor, mirroring profile-boot.ts: the bundle layers
@@ -75,65 +40,98 @@ describe('the shipped Windows composition (real bundle layers)', () => {
  // suite composes the shipped patch files, not test fixtures.
  const anchor = fileURLToPath(new URL('../package.json', import.meta.url))

-  it('composes the win32 confined roster through the real patch layers', () => {
+  it('composes the confined pwsh roster on win32 and the bash roster on POSIX from the same rows', () => {
    home = mkdtempSync(join(tmpdir(), 'dsh-windows-home-'))
    initProfile(join(home, PROFILES_DIR, 'web'), ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
    const profile = loadProfile('dsh', 'web', anchor, home)
    const warnings: string[] = []
-    const win32 = resolveWindowsShellLayer('win32', profile.layers, 'dsh')
-    expect(win32).toBeDefined()
    const rows = composeEntries(
-      [...profile.layers.map(layer => layer.patches), win32!.patches],
+      profile.layers.map(layer => layer.patches),
      message => warnings.push(message),
    )
    const byId = new Map(rows.map(row => [row.id, row]))
-    // Only the POSIX bash stack leaves the roster: the permission surface
-    // (sandbox/sandbox-policy/fs-sandbox, permission, approval) stays enabled
-    // exactly as on POSIX — the confined pwsh executor is what changes.
-    for (const id of ['bash-sandbox', 'tool-bash']) {
-      expect(byId.get(id)?.disabled, `row ${id}`).toBe(true)
+    // One shared patch set, two rosters: the shell stacks gate themselves.
+    for (const id of ['bash-sandbox', 'pwsh-sandbox', 'tool-bash', 'tool-pwsh']) {
+      expect(byId.has(id), `row ${id}`).toBe(true)
    }
+    expect(disabledOn(byId.get('bash-sandbox')!, 'win32'), 'bash-sandbox on win32').toBe(true)
+    expect(disabledOn(byId.get('bash-sandbox')!, 'linux'), 'bash-sandbox on linux').toBe(false)
+    expect(disabledOn(byId.get('pwsh-sandbox')!, 'win32'), 'pwsh-sandbox on win32').toBe(false)
+    expect(disabledOn(byId.get('pwsh-sandbox')!, 'linux'), 'pwsh-sandbox on linux').toBe(true)
+    // Host shell-tool rows are disabled on every platform; sessions mount
+    // their own rows instead.
+    expect(byId.get('tool-bash')?.disabled).toBe(true)
+    expect(byId.get('tool-pwsh')?.disabled).toBe(true)
+    // The permission surface never moves: the sandbox/policy rows, the
+    // permission switcher, fs-sandbox, and the approval service stay enabled
+    // exactly as on POSIX — the confined pwsh executor is what changes.
    for (const id of ['permission', 'ui-permission', 'sandbox', 'sandbox-policy', 'fs-sandbox', 'approval']) {
      expect(byId.get(id)?.disabled, `row ${id}`).not.toBe(true)
    }
-    for (const id of ['pwsh-sandbox', 'tool-pwsh']) {
-      expect(byId.has(id), `inserted row ${id}`).toBe(true)
-    }
    // The launcher's cold-start module fallback BFS-links the apps/cli
-    // dependency closure into the profile's node_modules (the pwsh-local
-    // precedent), so every inserted bare plugin must resolve from there.
+    // dependency closure into the profile's node_modules, so every bare
+    // plugin name in the base patch must resolve from there.
    const cliManifest = JSON.parse(readFileSync(anchor, 'utf8')) as { dependencies?: Record<string, string> }
    for (const name of ['@deepseek-ai/dsh-pwsh-sandbox', '@deepseek-ai/dsh-tool-pwsh']) {
      expect(cliManifest.dependencies?.[name], `cold-start closure must reach ${name}`).toBeDefined()
    }
-    // The patch touches only base-owned rows plus inserts, so the full web
-    // profile composes without any no-match warning.
    expect(warnings).toEqual([])
  })

-  it('leaves POSIX untouched and base-only profiles compose without warnings', () => {
+  it('base-only profiles carry both stacks with the same platform gating', () => {
    home = mkdtempSync(join(tmpdir(), 'dsh-windows-home-'))
-    initProfile(join(home, PROFILES_DIR, 'web'), ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
-    const profile = loadProfile('dsh', 'web', anchor, home)
-    // POSIX: no platform layer, the bash stack stays enabled.
-    const posixRows = composeEntries(profile.layers.map(layer => layer.patches))
-    const posixById = new Map(posixRows.map(row => [row.id, row]))
-    expect(posixById.get('bash-sandbox')?.disabled).not.toBe(true)
-    expect(posixById.has('pwsh-local')).toBe(false)
-    expect(posixById.has('pwsh-sandbox')).toBe(false)
-
-    // A base-only custom profile (the DEFAULT_PROFILE_BUNDLES template): the
-    // patch touches only base-owned rows (bash-sandbox/tool-bash) plus its
-    // inserts, so the composition produces no no-match warning.
    initProfile(join(home, PROFILES_DIR, 'base-only'), ['@deepseek-ai/dsh-base'])
-    const baseOnly = loadProfile('dsh', 'base-only', anchor, home)
-    const baseWarnings: string[] = []
-    const win32 = resolveWindowsShellLayer('win32', baseOnly.layers, 'dsh')
-    expect(win32).toBeDefined()
-    composeEntries(
-      [...baseOnly.layers.map(layer => layer.patches), win32!.patches],
-      message => baseWarnings.push(message),
+    const profile = loadProfile('dsh', 'base-only', anchor, home)
+    const warnings: string[] = []
+    const rows = composeEntries(
+      profile.layers.map(layer => layer.patches),
+      message => warnings.push(message),
    )
-    expect(baseWarnings).toEqual([])
+    const byId = new Map(rows.map(row => [row.id, row]))
+    for (const id of ['bash-sandbox', 'tool-bash', 'pwsh-sandbox', 'tool-pwsh']) {
+      expect(byId.has(id), `row ${id}`).toBe(true)
+    }
+    // No web overlay: the tool rows keep their own gating too.
+    expect(disabledOn(byId.get('tool-bash')!, 'win32'), 'tool-bash on win32').toBe(true)
+    expect(disabledOn(byId.get('tool-bash')!, 'linux'), 'tool-bash on linux').toBe(false)
+    expect(disabledOn(byId.get('tool-pwsh')!, 'win32'), 'tool-pwsh on win32').toBe(false)
+    expect(disabledOn(byId.get('tool-pwsh')!, 'linux'), 'tool-pwsh on linux').toBe(true)
+    expect(warnings).toEqual([])
+  })
+})
+
+describe('shipped agent presets gate both shell tools by platform', () => {
+  const presetRoot = resolve(fileURLToPath(new URL('../package.json', import.meta.url)), '..', 'config', 'agent-presets')
+
+  it.each(['standard', 'code', 'cordis'])('preset %s gates its shell tool rows by platform', (preset) => {
+    const entries: unknown = yaml.load(
+      readFileSync(join(presetRoot, preset, 'agent.cordis.yml'), 'utf8'),
+      { schema: entryListSchema },
+    )
+    if (!Array.isArray(entries)) throw new TypeError(`preset ${preset} must parse to an entry array`)
+    for (const [id, win32] of [['tool-bash', true], ['tool-pwsh', false]] as const) {
+      const row = entries.find((entry): entry is Record<string, unknown> => (
+        typeof entry === 'object' && entry !== null && (entry as Record<string, unknown>).id === id
+      ))
+      if (row === undefined) throw new TypeError(`preset ${preset} must mount ${id}`)
+      expect(row.disabled).toMatchObject({ __jsExpr: expect.any(String) as string })
+      // A platform-scoped context pins both outcomes on every host.
+      const expression = (row.disabled as { __jsExpr: string }).__jsExpr
+      expect(Boolean(evaluate({ process: { platform: 'win32' } }, expression)), `${id} on win32`).toBe(win32)
+      expect(Boolean(evaluate({ process: { platform: 'linux' } }, expression)), `${id} on linux`).toBe(!win32)
+    }
+  })
+
+  it('minimal mounts no shell tool row at all (its shell is the PTY stack)', () => {
+    const entries: unknown = yaml.load(
+      readFileSync(join(presetRoot, 'minimal', 'agent.cordis.yml'), 'utf8'),
+      { schema: entryListSchema },
+    )
+    if (!Array.isArray(entries)) throw new TypeError('minimal preset must parse to an entry array')
+    for (const id of ['tool-bash', 'tool-pwsh']) {
+      expect(entries.some(entry => (
+        typeof entry === 'object' && entry !== null && (entry as Record<string, unknown>).id === id
+      )), `${id} must be absent from minimal`).toBe(false)
+    }
  })
 })
--- a/apps/web/tests/built-boot.snapshot.ts
+++ b/apps/web/tests/built-boot.snapshot.ts
@@ -21,7 +21,12 @@ it('boots the built plugin graph and renders a fixture session end to end', asyn

  // The sidebar renders from the boot graph: every inject layer activated.
  const tree = await screen.findByRole('tree', { name: 'Sessions' }, { timeout: 10_000 })
-  await within(tree).findByText('4 sessions')
+  // The compact layout dropped group session counts; the fixture workspace
+  // group row renders immediately with its sessions beneath it.
+  const fixtureGroup = (await within(tree).findAllByText('fixture'))
+    .map(el => el.closest<HTMLElement>('[role="treeitem"]'))
+    .find(el => el?.getAttribute('aria-expanded') !== null)
+  if (fixtureGroup === undefined) throw new Error('fixture Workspace group missing')

  // The resident fixture has both a question and an approval; composer routing
  // exposes the question first, and the assembled workspace plugin mirrors that
--- a/apps/web/tests/chat-long-interactions.e2e.ts
+++ b/apps/web/tests/chat-long-interactions.e2e.ts
@@ -77,8 +77,13 @@ async function nextPaint(page: Page): Promise<void> {
 }

 async function openSeed(page: Page): Promise<void> {
-  await page.getByText(/^\d+ sessions?$/, { exact: true }).waitFor({ timeout: 30_000 })
-  const search = page.getByRole('textbox', { name: 'Search name, keywords...', exact: true })
+  // The compact layout dropped group session counts; the seeded baseline is
+  // the Ungrouped bucket once cold summaries load.
+  await page.getByText('Ungrouped', { exact: true }).waitFor({ timeout: 30_000 })
+  // Search collapsed into a header action; expand it before filling.
+  const searchButton = page.getByRole('button', { name: 'Search sessions' })
+  if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+  const search = page.getByRole('textbox', { name: 'Search sessions...', exact: true })
  await search.fill(FIXTURE.markers.user(1))
  const results = page.getByRole('tree', { name: 'Search results' }).getByRole('treeitem')
  await results.first().waitFor({ timeout: 60_000 })
--- a/apps/web/tests/chat-scroll-contract.e2e.ts
+++ b/apps/web/tests/chat-scroll-contract.e2e.ts
@@ -168,8 +168,10 @@ async function launchScrollWorld(options: ScrollWorldOptions): Promise<ScrollWor
    await page.goto(scaffold.baseUrl, { waitUntil: 'load' })
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
    // Session-list bootstrap can replace the controlled search state. Wait
-    // for the seeded baseline before openSeed starts the lazy content query.
-    await page.getByText(/^\d+ sessions?$/, { exact: true }).waitFor({ timeout: 30_000 })
+    // for the seeded baseline before openSeed starts the lazy content query
+    // (the compact layout dropped group session counts; the Ungrouped bucket
+    // row is the barrier).
+    await page.getByText('Ungrouped', { exact: true }).waitFor({ timeout: 30_000 })
    return {
      events,
      page,
@@ -258,7 +260,10 @@ async function conversationTurns(page: Page): Promise<number> {
 }

 async function openSeed(page: Page, fixture: ChatScrollFixture, tailMarker?: string): Promise<void> {
-  const search = page.getByRole('textbox', { name: 'Search name, keywords...', exact: true })
+  // Search collapsed into a header action; expand it before filling.
+  const searchButton = page.getByRole('button', { name: 'Search sessions' })
+  if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+  const search = page.getByRole('textbox', { name: 'Search sessions...', exact: true })
  // Cold summaries initially show the temporary workspace basename, so the
  // persisted first-message marker is the stable user-facing identity. The
  // query itself triggers lazy content-index reconciliation; no transient
--- a/apps/web/tests/composer-tab-geometry.e2e.ts
+++ b/apps/web/tests/composer-tab-geometry.e2e.ts
@@ -249,7 +249,10 @@ async function compareTabsWithoutReservation(page: Page): Promise<TabComparison>
 * @param page - the page under test.
 */
 async function openSeededSession(page: Page): Promise<void> {
-  const search = page.getByRole('textbox', { name: 'Search name, keywords...', exact: true })
+  // Search collapsed into a header action; expand it before filling.
+  const searchButton = page.getByRole('button', { name: 'Search sessions' })
+  if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+  const search = page.getByRole('textbox', { name: 'Search sessions...', exact: true })
  await search.fill(FIXTURE.markers.user(1))
  const results = page.getByRole('tree', { name: 'Search results' }).getByRole('treeitem')
  const deadline = Date.now() + 60_000
--- a/apps/web/tests/lifecycle-chrome.e2e.ts
+++ b/apps/web/tests/lifecycle-chrome.e2e.ts
@@ -197,8 +197,13 @@ describe('web e2e: lifecycle & chrome (workspace flow / reload / dark mode)', ()
  it.skipIf(MODE === 'record')('materialized a real Workspace and Session over the wire', async () => {
    onTestFailed(() => saveFailureShot(page, 'web-e2e-lifecycle-materialize'))
    // Browser: the sidebar tree now carries the auto-created workspace group
-    // with its one session, and the opened session is the selected row.
-    await expect.poll(() => page.getByText('1 session', { exact: true }).count(), { timeout: 15_000 }).toBeGreaterThanOrEqual(1)
+    // with its one session, and the opened session is the selected row. The
+    // compact layout dropped group session counts, so the group row itself is
+    // the barrier.
+    await expect.poll(
+      () => page.locator('[role="treeitem"][aria-expanded]').filter({ hasText: 'workspace' }).count(),
+      { timeout: 15_000 },
+    ).toBeGreaterThanOrEqual(1)
    await expect.poll(() => page.locator('[role="treeitem"][aria-selected="true"]').count(), { timeout: 10_000 }).toBe(1)
    await expect.poll(() => page.getByText('LIGHTHOUSE', { exact: true }).count(), { timeout: 15_000 }).toBeGreaterThanOrEqual(1)
    // Host: the session's durable header cwd is the folder the workspace
--- a/apps/web/tests/navigation-panes.e2e.ts
+++ b/apps/web/tests/navigation-panes.e2e.ts
@@ -53,7 +53,10 @@ async function assertBaselineSucceeded(response: Response, method: string): Prom

 async function ensureSeedOpen(page: Page): Promise<void> {
  const chat = page.getByRole('tab', { name: 'Chat', exact: true })
-  const search = page.getByPlaceholder('Search name, keywords', { exact: false })
+  // Search is a collapsed header action; expand it so the input is actionable.
+  const searchButton = page.getByRole('button', { name: 'Search sessions' })
+  if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+  const search = page.getByPlaceholder('Search sessions', { exact: false })
  if (await chat.count() === 0) {
    await search.fill('WATERFALL')
    const result = page.getByRole('tree', { name: 'Search results' }).getByRole('treeitem')
@@ -119,8 +122,9 @@ describe('web e2e: navigation & panes over a rich seeded session', () => {
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
    // The frame mounts before the asynchronous session-list baseline lands.
    // Search must target the settled seeded row, not the startup input that
-    // the ready projection replaces.
-    await page.getByText('1 session', { exact: true }).waitFor({ timeout: 30_000 })
+    // the ready projection replaces (the compact layout dropped group session
+    // counts; the Ungrouped bucket row is the barrier).
+    await page.getByText('Ungrouped', { exact: true }).waitFor({ timeout: 30_000 })
  }, 120_000)

  afterEach(async () => {
@@ -176,9 +180,13 @@ describe('web e2e: navigation & panes over a rich seeded session', () => {
  it.skipIf(MODE === 'record')('finds an unopened seeded session by message content and opens it', async () => {
    onTestFailed(() => saveFailureShot(page, 'web-e2e-navigation-search'))
    // The API baselines can settle before React commits their projection. The
-    // seeded count is the final user-visible barrier before editing search.
-    await page.getByText('1 session', { exact: true }).waitFor({ timeout: 30_000 })
-    const search = page.getByPlaceholder('Search name, keywords', { exact: false })
+    // seeded Ungrouped bucket row is the final user-visible barrier before
+    // editing search (the compact layout dropped group session counts).
+    await page.getByText('Ungrouped', { exact: true }).waitFor({ timeout: 30_000 })
+    // Search is a collapsed header action; expand it so the input is actionable.
+    const searchButton = page.getByRole('button', { name: 'Search sessions' })
+    if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+    const search = page.getByPlaceholder('Search sessions', { exact: false })
    // The cold row has not been opened, so only the persisted log can satisfy
    // this query. First search lazily reconciles the SQLite content index.
    await search.fill('zzzqx-no-such-session')
--- a/apps/web/tests/onboarding-usable-provider.e2e.ts
+++ b/apps/web/tests/onboarding-usable-provider.e2e.ts
@@ -0,0 +1,128 @@
+// Keyless browser e2e: a user who configures some OTHER provider is not asked
+// for the official DeepSeek key again, and the first-run setup card is a card
+// they can close. The shipped DeepSeek adapter stays mounted without a
+// credential throughout, so the only thing that ends onboarding here is the
+// pi-ai route the user configures through the real wire. Zero model calls:
+// configuration is pure settings/credentials/llm-domain traffic.
+import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+import type { Browser, Page } from 'playwright'
+import { chromium } from 'playwright'
+import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
+import {
+  acknowledgeReloadConnectionLoss, assertFixtureInventory, captureStableAria, compareOrRefreshGolden,
+  launchWebScaffold, watchConsole, webSnapshotMode, type WebScaffold,
+} from './scaffold.ts'
+import { ZH_BROWSER_LOCALE, saveFailureShot } from './support.ts'
+
+const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/onboarding-usable-provider', import.meta.url))
+const DISMISSED_EXPECTED = join(SNAPSHOT_DIR, 'dismissed.expected.md')
+const MODE = webSnapshotMode()
+const CREDENTIAL_STEP = '添加一个 API Key 开始使用'
+
+describe.skipIf(MODE === 'record')('web e2e: another usable provider ends first-run onboarding', () => {
+  let scaffold: WebScaffold
+  let browser: Browser
+  let page: Page
+  let tripwire: ReturnType<typeof watchConsole>
+
+  beforeAll(async () => {
+    scaffold = await launchWebScaffold({ deepSeekMissingCredential: true })
+    browser = await chromium.launch()
+    // The scenario asserts the shipped Chinese copy, so the browser asks for it.
+    page = await browser.newPage({ viewport: { width: 1440, height: 960 }, locale: ZH_BROWSER_LOCALE })
+    tripwire = watchConsole(page)
+    await page.goto(scaffold.baseUrl, { waitUntil: 'load' })
+    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
+  }, 120_000)
+
+  afterAll(async () => {
+    await browser?.close()
+    await scaffold?.close()
+  })
+
+  it('closes the setup card without discarding the add card beside it', async () => {
+    onTestFailed(() => saveFailureShot(page, 'web-e2e-onboarding-setup-card-cancel'))
+    const credentialStep = page.getByRole('region', { name: CREDENTIAL_STEP })
+    await credentialStep.waitFor({ timeout: 15_000 })
+    await credentialStep.getByRole('button', { name: '前往配置' }).click()
+    await credentialStep.waitFor({ state: 'detached', timeout: 15_000 })
+
+    const settings = page.getByRole('dialog', { name: '设置' })
+    await settings.waitFor({ timeout: 10_000 })
+    // Nothing is reachable yet, so DeepSeek presents itself as its open card.
+    const setupKey = settings.getByRole('textbox', { name: 'API 密钥', exact: true })
+    await setupKey.waitFor({ timeout: 10_000 })
+
+    const add = settings.getByRole('button', { name: '添加提供方' })
+    await expect.poll(async () => add.isEnabled(), { timeout: 10_000 }).toBe(true)
+    await add.click()
+    const pick = settings.getByLabel('提供方')
+    await pick.waitFor({ timeout: 10_000 })
+    await pick.selectOption('minimax-cn')
+    await expect.poll(
+      async () => settings.getByRole('textbox', { name: 'API 密钥', exact: true }).count(),
+      { timeout: 10_000 },
+    ).toBe(2)
+
+    // Cancelling the setup card is the regression: it used to leave itself open
+    // and close the add card, discarding that draft.
+    await settings.getByRole('button', { name: '取消', exact: true }).first().click()
+    expect(await settings.getByLabel('提供方').count()).toBe(1)
+    await expect.poll(
+      async () => settings.getByRole('textbox', { name: 'API 密钥', exact: true }).count(),
+      { timeout: 10_000 },
+    ).toBe(1)
+    // DeepSeek is now an ordinary row: a missing-key dot and an Edit button.
+    await settings.getByRole('button', { name: '编辑 DeepSeek (deepseek-official)' }).waitFor({ timeout: 10_000 })
+    const dismissed = await captureStableAria(page, '[role="dialog"]', scaffold.workspaceCwd)
+    await compareOrRefreshGolden(DISMISSED_EXPECTED, dismissed, MODE)
+
+    expect(tripwire.warnings).toEqual([])
+    expect(tripwire.pageErrors).toEqual([])
+  }, 60_000)
+
+  it('stops prompting for DeepSeek once the other provider can serve requests', async () => {
+    onTestFailed(() => saveFailureShot(page, 'web-e2e-onboarding-other-provider'))
+    const settings = page.getByRole('dialog', { name: '设置' })
+    await settings.getByRole('textbox', { name: 'API 密钥', exact: true }).fill('sk-e2e-minimax')
+    await settings.getByRole('button', { name: '保存', exact: true }).click()
+    await settings.getByText('已保存 minimax-cn。', { exact: true }).waitFor({ timeout: 15_000 })
+
+    // Only minimax-cn is reachable; DeepSeek still holds no credential.
+    const document = await readFile(join(scaffold.harnessHome, 'settings.yaml'), 'utf8')
+    expect(document).toContain('apiKeyEnv: MINIMAX_CN_API_KEY')
+    const credentials = await readFile(join(scaffold.harnessHome, '.credentials.yaml'), 'utf8')
+    expect(credentials).toContain('MINIMAX_CN_API_KEY: sk-e2e-minimax')
+    expect(credentials).not.toContain('DEEPSEEK_API_KEY')
+
+    const warningsBefore = tripwire.warnings.length
+    await page.reload({ waitUntil: 'load' })
+    acknowledgeReloadConnectionLoss(tripwire, warningsBefore)
+    await page.waitForSelector('[class*="frame"]', { timeout: 15_000 })
+    // The regression: the step read only the official route's credential, so a
+    // fully configured user was taken over on every blank session.
+    await expect.poll(
+      async () => page.getByRole('region', { name: CREDENTIAL_STEP }).count(),
+      { timeout: 10_000 },
+    ).toBe(0)
+    expect(await page.locator('[class*="onboardingStage"]').count()).toBe(0)
+    expect(await page.locator('#root').evaluate(root => (root as HTMLElement).inert)).toBe(false)
+
+    // The Models page agrees: DeepSeek stays a row rather than reopening its
+    // setup card over a user who already has somewhere to send a request.
+    await page.getByRole('button', { name: '设置', exact: true }).click()
+    await settings.waitFor({ timeout: 10_000 })
+    await settings.getByRole('button', { name: '模型' }).click()
+    await settings.getByRole('button', { name: '编辑 DeepSeek (deepseek-official)' }).waitFor({ timeout: 10_000 })
+    expect(await settings.getByRole('textbox', { name: 'API 密钥', exact: true }).count()).toBe(0)
+
+    expect((await page.content()).includes('sk-e2e-minimax')).toBe(false)
+    expect(tripwire.pageErrors).toEqual([])
+  }, 60_000)
+
+  it('keeps the fixture inventory closed', async () => {
+    await assertFixtureInventory(SNAPSHOT_DIR, ['dismissed.expected.md'])
+  })
+})
--- a/apps/web/tests/plugin-config.e2e.ts
+++ b/apps/web/tests/plugin-config.e2e.ts
@@ -56,9 +56,9 @@ describe('web e2e: plugin configuration section', () => {
    await page.getByRole('button', { name: '设置', exact: true }).click()
    const dialog = page.getByRole('dialog', { name: '设置' })
    await dialog.waitFor({ timeout: 10_000 })
-    await dialog.getByRole('button', { name: '插件' }).click()
+    await dialog.getByRole('button', { name: '插件配置', exact: true }).click()
    await expect
-      .poll(() => dialog.getByRole('button', { name: '插件' }).getAttribute('aria-current'), { timeout: 5_000 })
+      .poll(() => dialog.getByRole('button', { name: '插件配置', exact: true }).getAttribute('aria-current'), { timeout: 5_000 })
      .toBe('true')
    return dialog
  }
--- a/apps/web/tests/pwsh-terminal.e2e.ts
+++ b/apps/web/tests/pwsh-terminal.e2e.ts
@@ -68,8 +68,11 @@ describe.skipIf(MODE === 'record' || !HAS_PWSH)('web e2e: pwsh calls use the bas
    onTestFailed(() => saveFailureShot(page, 'web-e2e-pwsh-terminal'))
    // Open the seeded session through content search: the sidebar groups
    // sessions by workspace and its row order is world-dependent, while the
-    // search index covers the seeded log deterministically.
-    const search = page.getByPlaceholder('Search name, keywords', { exact: false })
+    // search index covers the seeded log deterministically. Search is a
+    // collapsed header action; expand it so the input is actionable.
+    const searchButton = page.getByRole('button', { name: 'Search sessions' })
+    if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+    const search = page.getByPlaceholder('Search sessions', { exact: false })
    await search.fill('Run a PowerShell command')
    const result = page.getByRole('tree', { name: 'Search results' }).getByRole('treeitem')
    await expect.poll(() => result.count(), { timeout: 15_000 }).toBe(1)
--- a/apps/web/tests/scaffold.ts
+++ b/apps/web/tests/scaffold.ts
@@ -385,7 +385,11 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
    // able to change a golden.
    {
      id: 'agent-presets',
-      config: { default: 'standard', roots: [{ path: SHIPPED_PRESET_DIR, trust: 'system' }] },
+      config: {
+        default: 'standard',
+        roots: [{ path: SHIPPED_PRESET_DIR, trust: 'system' }],
+        includeUserRoot: false,
+      },
    },
    { id: 'session-persistence-jsonl', config: { root: persistenceRoot } },
    { id: 'session-query-sqlite', config: { path: ':memory:', openAt: 'first-search' } },
@@ -445,7 +449,9 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
    ] },
    ...options.agentPresets === undefined
      ? []
-      : [{ id: 'agent-presets', config: options.agentPresets }],
+      // Never the derived harness-home root: a developer's own presets must not
+      // be able to change a golden, whatever roots a scenario asks for.
+      : [{ id: 'agent-presets', config: { ...options.agentPresets, includeUserRoot: false } }],
    ...options.toolsMode === undefined ? [] : [{ id: 'tools', config: { mode: options.toolsMode } }],
    ...options.cordisTools === true
      ? [{ insert: [{ id: 'tool-cordis', name: 'cordis:tool-cordis' }] }]
--- a/apps/web/tests/settings-chrome.e2e.ts
+++ b/apps/web/tests/settings-chrome.e2e.ts
@@ -23,6 +23,8 @@ import { ZH_BROWSER_LOCALE, saveFailureShot } from './support.ts'

 const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/settings-chrome', import.meta.url))
 const DIALOG_EXPECTED = join(SNAPSHOT_DIR, 'dialog.expected.md')
+const PLUGINS_EXPECTED = join(SNAPSHOT_DIR, 'plugins.expected.md')
+const PLUGIN_ROW_SELECTOR = '[data-plugin-entry$="ui-settings"]'
 const MODE = webSnapshotMode()

 describe('web e2e: settings modal and General preferences', () => {
@@ -92,6 +94,28 @@ describe('web e2e: settings modal and General preferences', () => {
    await dialog.getByRole('button', { name: '模型' }).click()
    await expect.poll(() => dialog.getByRole('button', { name: '模型' }).getAttribute('aria-current'), { timeout: 5_000 }).toBe('true')
    expect(await dialog.getByRole('button', { name: '通用设置' }).getAttribute('aria-current')).toBeNull()
+    // Plugins is a read-only projection of the same assembled Loader tree.
+    // Capture one stable shipped row rather than the whole inventory so adding
+    // an unrelated plugin does not rewrite this surface's golden.
+    await dialog.getByRole('button', { name: '插件', exact: true }).click()
+    await dialog.getByRole('heading', { name: '插件', exact: true }).waitFor({ timeout: 10_000 })
+    const pluginRow = dialog.locator(PLUGIN_ROW_SELECTOR)
+    await pluginRow.waitFor({ timeout: 10_000 })
+    const expectedPluginCount = [...scaffold.ctx.loader.entries()]
+      .filter(entry => !entry.options.group)
+      .length
+    expect(await dialog.getByRole('searchbox', { name: '搜索插件' }).count()).toBe(1)
+    expect(await dialog.locator('[data-plugin-entry]').count()).toBe(expectedPluginCount)
+    expect(await dialog.locator('[data-plugin-count]').getAttribute('data-plugin-count'))
+      .toBe(String(expectedPluginCount))
+    expect(await dialog.getByRole('button', { name: '插件', exact: true }).getAttribute('aria-current')).toBe('true')
+    expect(await dialog.getByRole('button', { name: '模型' }).getAttribute('aria-current')).toBeNull()
+    const pluginsSnapshot = await captureStableAria(
+      page,
+      PLUGIN_ROW_SELECTOR,
+      scaffold.workspaceCwd,
+    )
+    await compareOrRefreshGolden(PLUGINS_EXPECTED, pluginsSnapshot, MODE)
    // Close path 1: Escape.
    await page.keyboard.press('Escape')
    await expect.poll(() => page.getByRole('dialog', { name: '设置' }).count(), { timeout: 5_000 }).toBe(0)
@@ -454,6 +478,6 @@ describe('web e2e: settings modal and General preferences', () => {

  it.skipIf(MODE === 'record')('keeps the fixture inventory closed', async () => {
    expect(tripwire.warnings).toEqual([])
-    await assertFixtureInventory(SNAPSHOT_DIR, ['dialog.expected.md'])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['dialog.expected.md', 'plugins.expected.md'])
  })
 })
--- a/apps/web/tests/sidebar-scrollbar.e2e.ts
+++ b/apps/web/tests/sidebar-scrollbar.e2e.ts
@@ -349,9 +349,9 @@ async function pointAt(page: Page, where: 'list' | 'away'): Promise<void> {

 /**
 * Reveal the seeded rows: every seeded session is unattached, so they all sit
- * in the collapsed Ungrouped bucket. Converges on expanded rather than
- * clicking once — startup auto-selection can expand the bucket first, and a
- * second click would collapse it again. Hand-rolled polling because
+ * in the collapsed Ungrouped bucket. Open the bucket, then use its transient
+ * Show-more control because an open group intentionally renders only five
+ * rows by default. Hand-rolled polling because
 * `expect.poll` is test-scoped and this runs in `beforeAll`.
 * @param page - the page under test.
 */
@@ -364,6 +364,12 @@ async function expandSeededSessions(page: Page): Promise<void> {
    if (await bucket.getAttribute('aria-expanded') !== 'true') {
      await page.getByText('Ungrouped', { exact: true }).click()
    }
+    const showMore = page.getByRole('button', { name: /Show \d+ more sessions/ })
+    if (await bucket.getAttribute('aria-expanded') === 'true'
+      && await rows.count() <= SEED_COUNT / 2
+      && await showMore.count() > 0) {
+      await showMore.click()
+    }
    if (await bucket.getAttribute('aria-expanded') === 'true' && await rows.count() > SEED_COUNT / 2) return
    if (Date.now() > deadline) {
      throw new Error(`Ungrouped bucket never revealed more than ${SEED_COUNT / 2} rows`)
--- a/apps/web/tests/snapshots/agent-preset-authoring/created.expected.md
+++ b/apps/web/tests/snapshots/agent-preset-authoring/created.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/agent-preset-authoring/damaged.expected.md
+++ b/apps/web/tests/snapshots/agent-preset-authoring/damaged.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/agent-preset-authoring/section.expected.md
+++ b/apps/web/tests/snapshots/agent-preset-authoring/section.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/lifecycle-chrome/hero.expected.md
+++ b/apps/web/tests/snapshots/lifecycle-chrome/hero.expected.md
@@ -5,17 +5,17 @@
  - img
  - text: New Session
 - text: Workspaces
- button "Group by":
+- button "Search sessions":
+  - img
+- textbox "Search sessions..."
+- button "View options":
  - img
 - button "Add workspace":
  - img
- button "Search sessions":
-  - img
- textbox "Search name, keywords..."
 - tree "Sessions":
-  - treeitem "workspace 1 session" [expanded]:
+  - treeitem "workspace" [expanded]:
    - img
-    - text: workspace 1 session
+    - text: workspace
  - treeitem "New Session" [selected]
 - button "Settings":
  - img
--- a/apps/web/tests/snapshots/lifecycle-chrome/plan-active.expected.md
+++ b/apps/web/tests/snapshots/lifecycle-chrome/plan-active.expected.md
@@ -5,17 +5,17 @@
  - img
  - text: New Session
 - text: Workspaces
- button "Group by":
+- button "Search sessions":
+  - img
+- textbox "Search sessions..."
+- button "View options":
  - img
 - button "Add workspace":
  - img
- button "Search sessions":
-  - img
- textbox "Search name, keywords..."
 - tree "Sessions":
-  - treeitem "workspace 1 session" [expanded]:
+  - treeitem "workspace" [expanded]:
    - img
-    - text: workspace 1 session
+    - text: workspace
  - treeitem "New Session" [selected]
 - button "Settings":
  - img
--- a/apps/web/tests/snapshots/message-actions/fork.expected.md
+++ b/apps/web/tests/snapshots/message-actions/fork.expected.md
@@ -1,7 +1,7 @@
 - tree "Sessions":
-  - treeitem "Ungrouped 3 sessions" [expanded]:
+  - treeitem "Ungrouped" [expanded]:
    - img
-    - text: Ungrouped 3 sessions
-  - treeitem "Use the read tool twice (2) now" [selected]
-  - treeitem "Use the read tool twice (1) now"
+    - text: Ungrouped
  - treeitem "Use the read tool twice 1min"
+  - treeitem "Use the read tool twice (1) now"
+  - treeitem "Use the read tool twice (2) now" [selected]
--- a/apps/web/tests/snapshots/models-settings/configured.expected.md
+++ b/apps/web/tests/snapshots/models-settings/configured.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/models-settings/declared-edit.expected.md
+++ b/apps/web/tests/snapshots/models-settings/declared-edit.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/models-settings/declared.expected.md
+++ b/apps/web/tests/snapshots/models-settings/declared.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/models-settings/empty.expected.md
+++ b/apps/web/tests/snapshots/models-settings/empty.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/onboarding-deepseek-config/models.expected.md
+++ b/apps/web/tests/snapshots/onboarding-deepseek-config/models.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/onboarding-usable-provider/dismissed.expected.md
+++ b/apps/web/tests/snapshots/onboarding-usable-provider/dismissed.expected.md
@@ -0,0 +1,74 @@
+- dialog "设置":
+  - navigation:
+    - text: 设置
+    - button "通用设置":
+      - img
+      - text: 通用设置
+    - button "模型":
+      - img
+      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
+    - button "Agent 预设":
+      - img
+      - text: Agent 预设
+    - button "插件配置":
+      - img
+      - text: 插件配置
+  - button "打开配置文件"
+  - button "关闭":
+    - img
+    - text: 关闭
+  - heading "模型" [level=2]
+  - paragraph: 填入各提供方的 API 密钥即可使用其模型。
+  - list:
+    - listitem:
+      - text: DeepSeek
+      - img "API 密钥缺失"
+      - button "编辑 DeepSeek (deepseek-official)": 编辑
+  - text: 提供方
+  - combobox "提供方":
+    - option "amazon-bedrock"
+    - option "ant-ling"
+    - option "anthropic"
+    - option "azure-openai-responses"
+    - option "cerebras"
+    - option "cloudflare-ai-gateway"
+    - option "cloudflare-workers-ai"
+    - option "deepseek"
+    - option "fireworks"
+    - option "github-copilot"
+    - option "google"
+    - option "google-vertex"
+    - option "groq"
+    - option "huggingface"
+    - option "kimi-coding"
+    - option "minimax"
+    - option "minimax-cn" [selected]
+    - option "mistral"
+    - option "moonshotai"
+    - option "moonshotai-cn"
+    - option "nvidia"
+    - option "openai"
+    - option "openai-codex"
+    - option "opencode"
+    - option "opencode-go"
+    - option "openrouter"
+    - option "qwen-token-plan"
+    - option "qwen-token-plan-cn"
+    - option "together"
+    - option "vercel-ai-gateway"
+    - option "xai"
+    - option "xiaomi"
+    - option "xiaomi-token-plan-ams"
+    - option "xiaomi-token-plan-cn"
+    - option "xiaomi-token-plan-sgp"
+    - option "zai"
+    - option "zai-coding-cn"
+  - text: API 密钥
+  - textbox "API 密钥":
+    - /placeholder: 输入 API 密钥，或留空使用环境认证
+  - group: 自定义设置
+  - button "取消"
+  - button "保存"
--- a/apps/web/tests/snapshots/plugin-config/section.expected.md
+++ b/apps/web/tests/snapshots/plugin-config/section.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/settings-chrome/dialog.expected.md
+++ b/apps/web/tests/snapshots/settings-chrome/dialog.expected.md
@@ -7,6 +7,9 @@
    - button "模型":
      - img
      - text: 模型
+    - button "插件":
+      - img
+      - text: 插件
    - button "Agent 预设":
      - img
      - text: Agent 预设
--- a/apps/web/tests/snapshots/settings-chrome/plugins.expected.md
+++ b/apps/web/tests/snapshots/settings-chrome/plugins.expected.md
@@ -0,0 +1,6 @@
+- listitem:
+  - button "ui-settings, 已挂载, 已启用":
+    - strong: ui-settings
+    - img "已挂载"
+    - text: 已启用
+    - img
--- a/apps/web/tests/snapshots/sidebar-subagent-activity/owner-running.expected.md
+++ b/apps/web/tests/snapshots/sidebar-subagent-activity/owner-running.expected.md
@@ -1,6 +1,6 @@
 - tree "Sessions":
-  - treeitem "workspace 2 sessions" [expanded]:
+  - treeitem "workspace" [expanded]:
    - img
-    - text: workspace 2 sessions
-  - treeitem "1 subagent running Delegate a background task. now"
+    - text: workspace
  - treeitem "New Session" [selected]
+  - treeitem "1 subagent running Delegate a background task. now"
--- a/apps/web/tests/snapshots/subagent-conversation/fork.expected.md
+++ b/apps/web/tests/snapshots/subagent-conversation/fork.expected.md
@@ -1,6 +1,6 @@
 - tree "Sessions":
-  - treeitem "workspace 2 sessions" [expanded]:
+  - treeitem "workspace" [expanded]:
    - img
-    - text: workspace 2 sessions
-  - treeitem "Explain event sourcing in one (1) now" [selected]
+    - text: workspace
  - treeitem "Ask a research subagent to now"
+  - treeitem "Explain event sourcing in one (1) now" [selected]
--- a/apps/web/tests/snapshots/subagent-conversation/sidebar.expected.md
+++ b/apps/web/tests/snapshots/subagent-conversation/sidebar.expected.md
@@ -1,5 +1,5 @@
 - tree "Sessions":
-  - treeitem "workspace 1 session" [expanded]:
+  - treeitem "workspace" [expanded]:
    - img
-    - text: workspace 1 session
+    - text: workspace
  - treeitem "Ask a research subagent to now"
--- a/apps/web/tests/startup-auto-selection.e2e.ts
+++ b/apps/web/tests/startup-auto-selection.e2e.ts
@@ -68,6 +68,13 @@ describe('web e2e: startup auto-selection', () => {
  it('keeps the resident Hero and composer nodes when the first Workspace session appears', async () => {
    onTestFailed(() => saveFailureShot(page, 'web-e2e-first-workspace-stable-tree'))
    await page.locator(`${ROOT_PHASE}[data-phase="hero"]`).waitFor({ timeout: 15_000 })
+    const headline = page.getByText('Into the Unknown', { exact: true })
+    const fish = headline.locator('xpath=preceding-sibling::span[1]/*[name()="svg"]')
+    const fishHitbox = fish.locator('..')
+    expect(await fish.evaluate(node => getComputedStyle(node).color))
+      .toBe(await headline.evaluate(node => getComputedStyle(node).color))
+    await fishHitbox.hover()
+    expect(await fish.evaluate(node => getComputedStyle(node).animationName)).not.toBe('none')
    await page.evaluate(() => {
      const refs = {
        root: document.querySelector('div[data-phase="hero"]'),
--- a/apps/web/tests/subagent-conversation.e2e.ts
+++ b/apps/web/tests/subagent-conversation.e2e.ts
@@ -31,6 +31,8 @@ const ONE_SHOT_LABEL = 'event-sourcing reviewer'
 const NESTED_LABEL = 'example editor'
 const PARENT_PROMPT = 'Ask a research subagent to explain event sourcing.'
 const INITIAL_PROMPT = 'Explain event sourcing in one sentence.'
+/** The grandchild's own first message; its arrival is what says its history finished loading. */
+const NESTED_PROMPT = 'Give one concrete event sourcing example.'
 const FOLLOWUP = 'Now give the same explanation to a human reader.'
 const POST_FORK_FOLLOWUP = 'Continue the original conversation after the fork.'

@@ -176,7 +178,7 @@ describe('web e2e: persisted subagent conversation and human continuation', () =
        seq: 1,
        time: authoredAt + 1,
        data: {
-          content: [{ type: 'text', text: 'Give one concrete event sourcing example.' }],
+          content: [{ type: 'text', text: NESTED_PROMPT }],
          source: { kind: 'user' },
        },
        surfaceOp: 'append',
@@ -404,6 +406,11 @@ describe('web e2e: persisted subagent conversation and human continuation', () =
    )
    await nestedRow.click()
    await page.getByText('The parent session is offline; reopen it to continue sending messages.').waitFor()
+    // The offline banner renders from the descriptor alone, so it says nothing
+    // about the transcript below it. The golden pins that transcript, and
+    // `captureStableAria` calls two identical polls stable — including two of
+    // "Loading history…". Wait for the message the golden asserts.
+    await page.getByText(NESTED_PROMPT).waitFor()
    const hierarchy = page.getByRole('navigation', { name: 'Session hierarchy' })
    const crumbs = await hierarchy.getByRole('button').allTextContents()
    expect(crumbs.slice(-2)).toEqual([LABEL, NESTED_LABEL])
--- a/apps/web/tests/trajectory-virtualization.e2e.ts
+++ b/apps/web/tests/trajectory-virtualization.e2e.ts
@@ -59,7 +59,10 @@ interface RowAnchor {
 }

 async function openSeed(page: Page): Promise<void> {
-  const search = page.getByRole('textbox', { name: 'Search name, keywords...', exact: true })
+  // Search collapsed into a header action; expand it before filling.
+  const searchButton = page.getByRole('button', { name: 'Search sessions' })
+  if (await searchButton.getAttribute('aria-expanded') !== 'true') await searchButton.click()
+  const search = page.getByRole('textbox', { name: 'Search sessions...', exact: true })
  await search.fill(FIXTURE.markers.user(1))
  const result = page.getByRole('tree', { name: 'Search results' }).getByRole('treeitem')
  await expect.poll(() => result.count(), { timeout: 60_000 }).toBe(1)
@@ -182,7 +185,9 @@ describe('web e2e: Trajectory virtualization over tail-paged history', () => {
    tripwire = watchConsole(page)
    await page.goto(scaffold.baseUrl, { waitUntil: 'load' })
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
-    await page.getByText('1 session', { exact: true }).waitFor({ timeout: 30_000 })
+    // The compact layout dropped group session counts; the seeded baseline is
+    // the Ungrouped bucket once cold summaries load.
+    await page.getByText('Ungrouped', { exact: true }).waitFor({ timeout: 30_000 })
  }, 120_000)

  afterAll(async () => {
--- a/apps/web/tests/workflow-run.e2e.ts
+++ b/apps/web/tests/workflow-run.e2e.ts
@@ -74,12 +74,16 @@ describe.skipIf(MODE === 'record')('web e2e: durable workflow run in Chat', () =
    await input.fill(prompt)
    await input.press('Enter')

-    const workflow = page.getByRole('button', { name: /^snapshot-flow/ })
+    const workflow = page.locator('[data-workflow-run][data-run-status="running"]')
    await workflow.waitFor({ timeout: 30_000 })
-    expect(await workflow.getAttribute('aria-expanded')).toBe('true')
-    const phase = page.getByRole('button', { name: /^Run/ })
-    await phase.waitFor({ timeout: 15_000 })
-    await phase.click()
+    const disclosures = workflow.locator('[data-disclosure-row]')
+    await disclosures.nth(1).waitFor({ timeout: 15_000 })
+    expect(await disclosures.nth(0).getAttribute('role')).toBeNull()
+    expect(await disclosures.nth(0).getAttribute('aria-expanded')).toBeNull()
+    expect(await disclosures.nth(1).getAttribute('role')).toBeNull()
+    expect(await disclosures.nth(1).getAttribute('aria-expanded')).toBeNull()
+    expect(await disclosures.nth(0).evaluate(element => getComputedStyle(element).cursor)).not.toBe('pointer')
+    expect(await disclosures.nth(1).evaluate(element => getComputedStyle(element).cursor)).not.toBe('pointer')
    const member = page.getByRole('button', { name: /^Open Reply with exactly the word/ })
    await member.waitFor({ timeout: 15_000 })
    await member.focus()
@@ -139,15 +143,20 @@ describe.skipIf(MODE === 'record')('web e2e: durable workflow run in Chat', () =
    const sessions = page.getByRole('tree', { name: 'Sessions' })
    await sessions.getByRole('treeitem', { name: /Use the workflow tool exactly/ }).click()
    await settled
+    await page.locator('[data-workflow-run][data-run-status="completed"]').waitFor()

    expect(await page.locator('[data-chat-flow-kind="tool-call"]').count()).toBeGreaterThanOrEqual(1)
    expect(await page.locator('[data-chat-flow-kind="workflow-run"]').count()).toBe(1)
    const terminalWorkflow = page.getByRole('button', { name: /^snapshot-flow/ })
    await terminalWorkflow.waitFor()
-    if (await terminalWorkflow.getAttribute('aria-expanded') !== 'true') await terminalWorkflow.click()
+    expect(await terminalWorkflow.getAttribute('aria-expanded')).toBe('false')
+    expect(await terminalWorkflow.evaluate(element => getComputedStyle(element).cursor)).toBe('pointer')
+    await terminalWorkflow.click()
    const terminalPhase = page.getByRole('button', { name: /^Run/ })
    await terminalPhase.waitFor()
-    if (await terminalPhase.getAttribute('aria-expanded') !== 'true') await terminalPhase.click()
+    expect(await terminalPhase.getAttribute('aria-expanded')).toBe('false')
+    expect(await terminalPhase.evaluate(element => getComputedStyle(element).cursor)).toBe('pointer')
+    await terminalPhase.click()
    await page.getByText(CHILD_PROMPT, { exact: false }).waitFor()
    await expect.poll(
      () => page.getByRole('button', { name: /^Open Reply with exactly the word/ }).count(),
@@ -165,6 +174,7 @@ describe.skipIf(MODE === 'record')('web e2e: durable workflow run in Chat', () =
    await workflow.click()
    const phase = page.getByRole('button', { name: /^Run/ })
    await phase.waitFor()
+    expect(await phase.getAttribute('aria-expanded')).toBe('false')
    await phase.click()
    await page.getByText(CHILD_PROMPT, { exact: false }).waitFor()
    expect(await page.getByRole('button', { name: /^Open Reply with exactly the word/ }).count()).toBe(0)
--- a/apps/web/tests/workspace-management.e2e.ts
+++ b/apps/web/tests/workspace-management.e2e.ts
@@ -372,21 +372,22 @@ describe('web e2e: workspace management (create / rename / flat view / hover aff
    // Grouped default: workspace group rows render (the seeded session sits
    // under Ungrouped; the created workspaces are empty groups).
    await expect.poll(() => page.getByText('Workspaces', { exact: true }).count(), { timeout: 10_000 }).toBe(1)
-    await page.getByRole('button', { name: 'Group by' }).click()
+    // Grouping and ordering moved into the View options menu.
+    await page.getByRole('button', { name: 'View options' }).click()
    await page.getByRole('menuitem', { name: 'In one list' }).click()
    // Flat mode: the section label flips and the seeded session is a
    // top-level row with no group headers above it.
    await expect.poll(() => page.getByText('Sessions', { exact: true }).count(), { timeout: 10_000 }).toBeGreaterThanOrEqual(1)
    await expect.poll(() => page.getByText('Ungrouped', { exact: true }).count(), { timeout: 5_000 }).toBe(0)
    await expect.poll(() => page.locator('[role="treeitem"]').count(), { timeout: 10_000 }).toBeGreaterThanOrEqual(1)
-    expect(await page.evaluate(() => localStorage.getItem('dsh.workspace.view'))).toContain('flat')
+    expect(await page.evaluate(() => localStorage.getItem('dsh.workspace.view.v4'))).toContain('flat')
    // Persisted across reload; then restore grouped for inter-spec hygiene.
    const warningStart = tripwire.warnings.length
    await page.reload({ waitUntil: 'load' })
    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
    acknowledgeReloadConnectionLoss(tripwire, warningStart)
    await expect.poll(() => page.getByText('Ungrouped', { exact: true }).count(), { timeout: 15_000 }).toBe(0)
-    await page.getByRole('button', { name: 'Group by' }).click()
+    await page.getByRole('button', { name: 'View options' }).click()
    await page.getByRole('menuitem', { name: 'WorkSpace' }).click()
    await expect.poll(() => page.getByText('Ungrouped', { exact: true }).count(), { timeout: 10_000 }).toBeGreaterThanOrEqual(1)
    expect(tripwire.pageErrors).toEqual([])
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -42,6 +42,7 @@
    "tests/default-model.e2e.ts",
    "tests/declared-reasoning.e2e.ts",
    "tests/onboarding-deepseek-config.e2e.ts",
+    "tests/onboarding-usable-provider.e2e.ts",
    "tests/remote-welcome.e2e.ts",
    "tests/workspace-management.e2e.ts",
    "tests/replay-round-trip.e2e.ts",