Adds two regression tests to crates/tui/src/tui/paste.rs::tests that
nail down what is currently a working code path but was not previously
covered by name:
* `ime_chinese_chars_route_through_to_composer` — simulates the
macOS/Windows IME commit pattern (one `KeyCode::Char(c)` event per
Chinese codepoint with realistic ~50 ms gaps so the paste-burst
heuristic doesn't false-positive). Asserts that "你好世界" lands in
`app.input` verbatim and that `cursor_position` advances by one per
codepoint, not per UTF-8 byte. The non-ASCII branch in
`handle_paste_burst_key` (paste.rs:42) is the structural anchor;
this test pins it so a future "filter to ASCII for the paste-burst
detector" change would surface immediately.
* `bracketed_paste_preserves_chinese_and_mixed_text` — pastes a mix
of CJK and Latin text ("你好世界 hello 世界 café") through the
bracketed-paste path (`insert_paste_text` → `normalize_paste_text`
→ `insert_str`) and confirms every codepoint survives plus the
cursor tracks codepoints, not bytes.
Why these tests, why now: a community report surfaced the question
"can users input Chinese characters" without specifying the exact
failure mode. Code review of the input data path turned up nothing
broken, and these tests confirm the data path is correct end-to-end
for both single-char IME commits and bulk bracketed paste. The tests
serve as evidence (the data path is provably fine) and as a guard
against future regressions to Chinese-input support.
The tests cost nothing at runtime and build under `cfg(test)` only.
If users are still seeing a Chinese-input failure after this lands,
the candidates worth investigating in priority order are: (1) display
layer — `wrap_input_lines` / `cursor_row_col` may be miscounting
double-width CJK cells; (2) terminal-specific delivery — certain
IMEs / terminals don't emit the events crossterm expects; (3) locale
at launch — `LC_ALL=C` in non-interactive shells breaks UTF-8 input
upstream of crossterm.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Post-merge review feedback on #583 surfaced four small accuracy gaps:
1. The narrative docs in `docs/CONFIGURATION.md` and the inline comment
in `config.example.toml` said the notification fires "when a turn
takes longer than a threshold" — but the call site in
`tui/ui.rs:928` is gated on `TurnOutcomeStatus::Completed`. Failed
and cancelled turns are silent on purpose. Spell that out so users
don't expect alerts on long failures.
2. The `notify_done` rustdoc still summarised `Auto` as "Osc9 for known
terminals, Bel otherwise" — internally inconsistent with the new
Windows-aware fallback documented one screen earlier on the
`Method::Auto` enum and on `resolve_method`. Update the public
rustdoc to point at the canonical resolution table on
`resolve_method` and call out the `Off`-on-Windows branch.
3. The `## Key Reference` list in `docs/CONFIGURATION.md` had no entries
for `[notifications].method`, `[notifications].threshold_secs`, or
`[notifications].include_summary`. Other features with a dedicated
subsection (e.g. `[memory].enabled`) are listed there too, so readers
scanning the canonical key list could not discover the notification
knobs. Added the three keys with cross-references to the
Notifications subsection.
4. The Windows-only test only covered the unknown-`TERM_PROGRAM` →
`Off` fallback. The positive path (known OSC-9 terminal still
resolves to `Osc9`) was only tested via `iTerm.app`, which is a
macOS-only program — Windows CI would still pass if the `WezTerm`
arm of the match disappeared. Added
`auto_detect_picks_osc9_for_wezterm_on_windows` so the
WezTerm-on-Windows compatibility guarantee is exercised on the
Windows runner.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
On Windows, the audio stack maps BEL (`\x07`) to the
`SystemAsterisk` / `MB_OK` chime — the same sound applications use
for error popups. So with the previous `Method::Auto` fallback to
`Bel`, every successful turn-completion notification ended up
sounding identical to a software error.
Reported by a community user who described it as "the popup-error
sound from a CAD program I used to use" (#583).
resolve_method() now returns `Off` instead of `Bel` on Windows for
unknown TERM_PROGRAM values. Known OSC-9-capable terminals
(`iTerm.app`, `Ghostty`, `WezTerm`) still resolve to `Osc9` on
every platform, so users running WezTerm on Windows keep getting
real notifications. macOS and Linux behaviour is unchanged.
Windows users who actively want an audible cue can opt back in by
setting `[notifications].method = "bel"` in `~/.deepseek/config.toml`.
Also:
- Documents `[notifications]` in `docs/CONFIGURATION.md` with an
explicit Windows note (the schema was previously undocumented).
- Updates the inline comment in `config.example.toml` so users
reading the seed config see the platform-specific behaviour.
- Splits the existing `auto_detect_picks_bel_for_unknown` test
into a Unix variant (`#[cfg(not(target_os = "windows"))]`) and
adds a new Windows-gated test that asserts the `Off` fallback,
so CI's Windows runner exercises the platform-specific path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The aarch64-unknown-linux-gnu release build for `deepseek-tui` failed in
release.yml run 25327475634 with:
openssl-sys v0.9.111: 'openssl/opensslconf.h' file not found
`crates/tui/src/main.rs` was the only crate in the workspace pulling
`reqwest` with `default-features = false, features = ["native-tls", ...]`
— every other crate (including the dispatcher in `crates/cli`) already
inherits the workspace default `["json", "rustls"]`. The aarch64 leg
builds with `cargo zigbuild --target aarch64-unknown-linux-gnu.2.28`,
whose zig sysroot does not ship openssl headers; the matching native-tls
job for v0.8.9 succeeded by chance against an earlier runner image but
the current `ubuntu-24.04-arm` image no longer satisfies openssl-sys's
header probe under zigbuild.
Switching the TUI's reqwest features from `native-tls` to `rustls` brings
it in line with the rest of the workspace and removes nine crates from
the build graph entirely (`openssl`, `openssl-sys`, `openssl-probe`,
`openssl-macros`, `native-tls`, `hyper-tls`, `tokio-native-tls`,
`foreign-types`, `foreign-types-shared`). reqwest 0.13.1 already uses
`rustls-platform-verifier` for OS trust-store integration, so end-user
TLS behavior against api.deepseek.com remains equivalent.
Verified locally:
- cargo clippy --workspace --all-targets --all-features --locked passes
- cargo build --release -p deepseek-tui --locked succeeds
- cargo fmt --all -- --check is clean
- no source code in `crates/` references native-tls / openssl directly
This is a release-pipeline-only fix; no user-visible feature changes.
Two related polish items wrapped together because both touch how the
user perceives the model's context behavior.
### Cache awareness in the agent prompt
The system prompt's Context Management section already lives inside
the volatile-content-last invariant — but the model never knew *why*
the prompt is shaped that way, or that it has any agency over keeping
the cache hit rate up.
Added a `### Prompt-cache awareness` subsection (Agent / Yolo modes)
with five concrete dos-and-don'ts:
- Append, don't reorder.
- Don't paraphrase quoted content (refer back by path).
- Use `/compact` as a hard reset, not a tweak.
- Read once, refer back instead of re-reading.
- Watch the `cache hit %` chip — red < 40%, yellow < 80%.
The chip itself already exists in the default footer status set
(`StatusItem::Cache`); the prompt addition closes the loop so the model
treats it as a real signal instead of a passive readout.
### #573 — typing `/mo` + Enter activates the first matching command
Previously a partial slash command + Enter sent the literal `/mo` as a
turn. The popup was already showing `/model` highlighted, so the user
expectation (and the OPENCODE behavior the issue cites) is that Enter
runs the highlight. The fix routes Enter through
`apply_slash_menu_selection` first when the popup is open and the input
starts with `/`. If the popup is empty (no matches) the legacy submit
path still fires — Enter on a non-slash line is unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the user @-mentions a file, score it; on the next mention popup,
re-sort completions so files mentioned often + recently float to the top.
Never-mentioned candidates fall back to the workspace ranker's order
without surprises.
* New `tui/file_frecency.rs` module:
- `FrecencyRecord { path, count, last_used }`, persisted as a JSONL
append at `~/.deepseek/file-frecency.jsonl`.
- `record_mention(path)` bumps the count, stamps the time, appends a
line, and evicts to a 1000-entry cap (matches the issue's acceptance
criterion). Eviction drops the lowest-scored entries.
- `rerank_by_frecency(candidates)` decays each record's score by
`count * exp(-ln(2) * age / HALF_LIFE)` (7-day half-life — same as
the OPENCODE source) and stable-sorts the candidate list.
* Wired into `find_file_mention_completions` so the menu shows
re-ranked entries automatically.
* Wired into both confirmation paths: `apply_mention_menu_selection`
(Enter / Tab on the popup) and `try_autocomplete_file_mention`'s
unique-match shortcut.
I/O is best-effort: a missing home directory, a permission failure,
or a corrupt JSONL line gets silently skipped — frecency loss is never
worth blocking the user's autocomplete.
Two unit tests cover the core: rerank floats a hot path above
never-mentioned ones (and preserves the original order for ties), and
score decay drops a stale-but-popular entry below a fresh one after
~8 half-lives.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The status-toast bus already typed Info/Success/Warning/Error with
configurable per-toast TTL, a 24-bounded queue, and a sync adapter that
migrates legacy `app.status_message` writes — what was missing was
visibility when several events arrive in quick succession. The footer
showed only the most recent and the rest expired silently.
* New `App::active_status_toasts(limit)` returns up to `limit` currently
active toasts (sticky pinned first, then queued newest-last so a stack
reads chronologically). Drains expired toasts off the front as a side
effect — same cleanup as the single-toast path.
* New `render_toast_stack_overlay` renders up to 2 *additional* toasts
as a 1-2 line strip directly above the footer when the queue has 2+
entries. Doesn't touch the layout chunk constraints — it's an
absolute-position overlay, so the chat area never reflows when toasts
arrive or expire. Older entries render dimmed in the level color so
the freshest still draws the eye in the footer line itself.
* `TOAST_STACK_MAX_VISIBLE = 3` (footer line + up to 2 overlay rows).
Anything beyond that ages out silently as before.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New `HookEvent::ShellEnv` fires immediately before each `exec_shell`
invocation. The hook's stdout is parsed as `KEY=VALUE\n` lines and the
resolved env vars are merged on top of the spawned process environment.
Useful for ephemeral credentials (`aws-vault export …`), per-skill
PATH adjustments, short-lived tokens.
* `HookExecutor::collect_shell_env(&context)` runs every matching
`shell_env` hook synchronously, captures stdout, parses it, returns
the merged map. Later hooks override earlier ones.
* `parse_env_lines` tolerates `export KEY=VAL`, quoted values
(`"…"` / `'…'`), comments (`#`), blank lines. Lines without `=` are
silently dropped — easier than failing the whole hook for one stray
human-friendly line. Values are taken verbatim; we don't run the
string through a shell to avoid expansion surprises.
* Resolved KEY names (NEVER values) are written to
`~/.deepseek/audit.log` so a session can be reconciled later
without leaking the secret material.
* Hook failure / timeout contributes no vars — `exec_shell` is never
aborted because of a misbehaving env hook.
Plumbing:
* `RuntimeToolServices` gains an optional
`Arc<HookExecutor>`. Wired in `tui/ui.rs` from the App's existing
`app.hooks` clone. Test contexts default to `None`.
* `ShellManager::execute_with_options_env` and
`execute_interactive_with_policy_env` are new variants that accept
an `extra_env: HashMap<String, String>` and forward it via
`CommandSpec::with_env` so `prepare()` carries it into `ExecEnv.env`.
* The original `execute_with_options` / `execute_interactive_with_policy`
call the new variants with an empty map so existing callers
(including all 5 internal call sites) keep working unchanged.
* `commands/hooks.rs` `event_label` covers the new variant.
Tests cover `parse_env_lines` against realistic hook output (bare
assignments, `export` prefix, quoted values, comments, blanks, malformed
lines). `cargo clippy --workspace --all-targets --all-features --locked --
-D warnings` clean.
`config.example.toml` documents the new event with an `aws-vault`
example and the audit-logging contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(sandbox): allow ~/.cargo/registry under macOS seatbelt (#558)
Sandboxed shell sessions on macOS were rejecting reads/writes to
~/.cargo/registry/{cache,index,src} and ~/.cargo/git, making
`cargo build`/`cargo publish` unrunnable from inside the TUI's shell tool
(hit while shipping v0.8.9).
* Resolve cargo home via `CARGO_HOME` env (cargo's own override) with a
`$HOME/.cargo` fallback. New helper `resolve_cargo_home()` is shared by
the policy generator and the param table to keep them in lockstep —
emit one without the other and `sandbox-exec` refuses to load the
profile.
* Always allow read access on `(param "CARGO_HOME")`. Grant write access
to the `registry/` and `git/` subpaths whenever the policy isn't
read-only — those directories must be mutable for `cargo` to populate
them on a cache miss.
* Skip the cargo block entirely when neither `CARGO_HOME` nor `HOME` is
set so we never reference an undefined `(param ...)`. (Practically
only fires in stripped CI containers.)
Two tests cover the policy/param sync — one with HOME set, one with
both vars cleared — using a module-local `ENV_LOCK` mutex to serialize
env mutation, mirroring the pattern landed in `main.rs` at d06eaed0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(mcp): graceful SIGTERM shutdown for stdio servers (#420)
Stdio MCP child processes were getting SIGKILL'd via tokio's
`kill_on_drop(true)` on TUI exit. The contract calls for SIGTERM so
well-behaved servers can flush pending state before dying.
Changes:
* New `async fn shutdown(&mut self)` on `McpTransport` (default no-op).
`StdioTransport` overrides it to send SIGTERM via `libc::kill` and
await child exit up to a 2-second grace window before letting drop
fire SIGKILL as the backstop. Graceful path on Unix; on Windows the
`kill_on_drop` (TerminateProcess) path remains unchanged because
there's no SIGTERM-equivalent.
* New `Drop` on `StdioTransport` sends SIGTERM as a fallback for code
paths that didn't call `shutdown` explicitly. Drop is sync, so the
signal arrives microseconds before tokio's own Child drop fires
SIGKILL, but it still gives MCP servers that handle SIGTERM idempotently
a chance to start cleanup.
* New `McpPool::shutdown_all` walks every connection, calls the async
shutdown, and clears the pool.
* The agent engine's run loop calls `shutdown_all` on `Op::Shutdown`
before the pool drops so graceful exit is the default path. Best-effort
— if the pool isn't initialized or the lock is contended, the Drop
fallback still sends SIGTERM.
Test: `stdio_transport_shutdown_terminates_child` spawns a real `cat`
child, calls `shutdown`, asserts the call returns within the grace
window, and confirms the pid is reaped (`kill(pid, 0)` returns ESRCH).
Unix-only — Windows already exercised by the kill_on_drop path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(shell): set PR_SET_PDEATHSIG on Linux to reap orphaned children (#421)
Shell-spawned children survive the TUI on abnormal exit (panic without
unwind, SIGKILL of the parent, OOM). The existing cooperative cancel
path SIGKILLs the whole process group via the cancellation token, but
that only fires when the parent gets to run its drop / cleanup code.
A crashed parent leaves children orphaned to init.
* New `install_parent_death_signal` helper called on every shell
Command setup. On Linux it adds a `pre_exec` hook that runs
`prctl(PR_SET_PDEATHSIG, SIGTERM)` immediately after fork — the
kernel then sends SIGTERM to the child the moment our process exits,
even on SIGKILL of the TUI itself.
* All three Command spawn sites in `tools/shell.rs` (one-shot, wait,
interactive) get the same hook.
* Documented the macOS / Windows gap: those platforms have no kernel
equivalent. The cooperative path still handles normal shutdown;
abnormal exit there is tracked as a watchdog follow-up per the
issue's acceptance criteria.
The pre_exec body is `unsafe`-marked because it runs in the post-fork
async-signal-safe window. The closure only calls `libc::prctl` with
stack-allocated constants; no heap, no locks. Errno is surfaced via
`std::io::Error::last_os_error` but the spawn is not aborted — losing
the safety net is strictly less bad than failing the user's command.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(subagent): interleave Chinese whale names with English in nickname pool
Sub-agent UI labels rotate through `WHALE_NICKNAMES`. The list was
English-only — every spawn produced "Blue", "Humpback", etc. Adding
Simplified-Chinese names (蓝鲸, 座头鲸, 抹香鲸, …) interleaved with the
English ones doubles the pool size and gives a roughly even mix on
each new spawn, with the same wraparound behavior at index >= 48.
Goal is friendly variety, not strict locale matching — a CN-locale user
still gets some English names and vice versa. Pure cosmetic; no
behavioral or persistence-format change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style: cargo fmt for seatbelt cargo home block
* memory: polish help and docs (#569)
- add /memory help and clearer invalid-subcommand guidance
- register /memory in shared slash-command help
- align memory docs with current behavior and config
- add focused tests for help and discovery
* feat(onboarding): language picker step before API key (#566)
First-run users hit Welcome → API key → Trust → Tips with no obvious way
to discover that a Chinese / Japanese / Portuguese UI exists.
Issue #566 surfaced this from a Chinese user. The TUI already has full
translations for `en`, `ja`, `zh-Hans`, `pt-BR` (plus `auto` detection
from `LC_ALL` / `LANG`); the only gap was discoverability.
* New `OnboardingState::Language` variant inserted between Welcome and
ApiKey. `Welcome → Language → ApiKey/Trust/Tips` is the new flow;
`Esc` from Language returns to Welcome.
* New `tui/onboarding/language.rs` panel renders the picker with hotkeys
1-5 for `auto` / `en` / `ja` / `zh-Hans` / `pt-BR`. Each row shows the
native name (日本語, 简体中文, …) plus an English label so the user
doesn't have to read the target language to pick it. The currently
persisted setting is highlighted with a filled bullet.
* Selecting a hotkey calls the new `App::set_locale_from_onboarding`
which writes through `Settings::set("locale", …)` + `Settings::save`
and re-resolves `app.ui_locale` immediately so the rest of onboarding
renders in the chosen language. Pressing Enter keeps the current
setting (defaults to `auto`).
* `onboarding_step` now reports `1/N` … `N/N` correctly with the new
step inserted (Welcome=1, Language=2, ApiKey=3 if needed, …).
* Doesn't expand the supported-locale set — the QA-pending list in
`localization::PLANNED_QA_LOCALES` is unchanged. We only show what
ships with full coverage today.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: 20bytes <133551439+20bytes@users.noreply.github.com>
- add /memory help and clearer invalid-subcommand guidance
- register /memory in shared slash-command help
- align memory docs with current behavior and config
- add focused tests for help and discovery
Bridge work to unblock whalescale-desktop's Settings/Composer/Archived-chats
flows without requiring a daemon recompile per dev-port or client-side
aggregation.
#561 / whalescale#255 — CORS allow-list configurable
* Add `[runtime_api] cors_origins` config field, `--cors-origin URL`
(repeatable) flag on `deepseek serve --http`, and `DEEPSEEK_CORS_ORIGINS`
env var. User entries stack on top of the built-in defaults
(localhost:3000, localhost:1420, tauri://localhost). Resolution preserves
first-seen order and drops empty/duplicate values; invalid HeaderValues
log a warning and are skipped.
* Refactor `cors_layer()` to read merged origins from `RuntimeApiState`.
#562 / whalescale#256 — `PATCH /v1/threads/{id}` accepts the full editable
field set
* Extend `UpdateThreadRequest` with `allow_shell`, `trust_mode`,
`auto_approve`, `model`, `mode`, `title`, `system_prompt`. Each is
optional; missing means no change. Empty-string clears `title`/
`system_prompt`. Empty `model`/`mode` rejected with 400.
* Add `title: Option<String>` to `ThreadRecord` (additive, no schema bump
per documented criteria — old readers ignore the field without
misinterpretation). `list_threads_summary` now returns the user-set title
when present, falling back to the derived input-summary title.
* `thread.updated` event payload now carries a `changes` map with only the
fields that actually changed.
#563 / whalescale#260 — list-archived-only filter
* New `archived_only=true` query param on `GET /v1/threads` and
`GET /v1/threads/summary`. Backed by a new `ThreadListFilter` enum
(`ActiveOnly` | `IncludeArchived` | `ArchivedOnly`). `archived_only`
takes precedence over `include_archived`. Default behavior unchanged.
#564 / whalescale#261 — `GET /v1/usage` aggregation
* New `RuntimeThreadManager::aggregate_usage` walks all threads/turns,
filters by inclusive `since`/`until` RFC 3339 bounds, accumulates token
totals + cost (via `pricing::calculate_turn_cost_from_usage`), and
groups by `day` (default), `model`, `provider`, or `thread`.
* New `GET /v1/usage` route. `since`/`until`/`group_by` query params,
`since > until` and unknown `group_by` rejected with 400. Empty time
ranges yield empty `buckets` (never 404).
5 new tests cover preflight Allow-Origin echoing for both default and
extra origins, the extended PATCH field set + clear-by-empty + 400 paths,
the archived_only filter on list + summary endpoints, and the
/v1/usage envelope + validation errors. Existing 13 runtime_api tests
continue to pass; the parity gates and full workspace test suite are clean.
`docs/RUNTIME_API.md` and `config.example.toml` updated to document the
new params, body shape, endpoint, and CORS knob.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The shell tool's `cwd` / `working_dir` parameter was accepted raw
without any workspace boundary check, unlike file tools which all go
through `ToolContext::resolve_path()`. This allowed the AI model to
execute shell commands from arbitrary directories outside the workspace.
Reuse the existing `resolve_path()` validation so that:
- Paths outside the workspace root are rejected with `PathEscape`
- `trust_mode = true` still bypasses the check (consistent behavior)
- `trusted_external_paths` entries are respected automatically
- Default behavior (no cwd argument) remains unchanged
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
`resolve_api_key_source_reports_env_when_set` and
`resolve_api_key_source_prefers_config_over_env` both mutate
DEEPSEEK_API_KEY in process-global env. With cargo test's default
parallelism they race — one test reads while the other's set is still
active — causing intermittent CI failures on Linux (passes locally).
Fix: module-level `static ENV_LOCK: Mutex<()>`, both tests acquire
before touching env. `unwrap_or_else(|p| p.into_inner())` recovers
from poisoning so a panic in one test doesn't cascade.
Closes the CI failure introduced in the v0.8.9 cut (4511ea76); does
not affect runtime behavior — `Config::default()` is still empty and
`resolve_api_key_source` semantics are unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Auto-mode reserved 25% of the sidebar height for each of Plan / Todos
/ Tasks / Agents regardless of content, so on a typical 32-row sidebar
each slot was ~8 rows. With Todos/Tasks/Agents empty (the common case
when a goal is set but no checklist exists), Plan ended up with ~5
content rows of its 8-row slot consumed by header + token bar +
separator, and steps got silently clipped — the user-reported
"sidebar broken / Plan disappearing".
Build the constraint list dynamically: include a slot only for panels
that actually have content. Plan always renders (it owns the
session-wide empty hint). Todos/Tasks/Agents collapse to zero rows
when empty, letting the visible panels share the full height.
The panic hook only popped kitty keyboard flags, disabled raw mode,
and left the alt-screen. Bracketed paste (`\e[?2004h`) and SGR mouse
capture (`\e[?1006h`) stayed on, so any panic would leave the user's
parent shell stuck wrapping pastes in `\e[200~…\e[201~` and printing
`\e[<…M` mouse events. Mirror the clean-shutdown teardown so the
shell is fully restored even when the TUI crashes.
`ViewStack::handle_paste` interpreted `ViewAction::None` (the trait
default) as "the modal consumed the paste," so any modal that didn't
override `handle_paste` — command palette, model picker, approval
dialog, pager, etc. — silently dropped every paste while it was on
top. The call site at `tui/ui.rs::Event::Paste` then took the
"consumed" branch and skipped the composer insert.
Switch the trait method to return `bool` (default `false` =
not consumed). `ProviderPickerView::handle_paste` now returns `true`
only when it actually appended to its key-entry buffer. Pin the
default-behavior contract with a regression test.
ratatui's buffer drops the bare ESC byte but happily paints every
other byte of an escape (`[`, `0`, `;`, `m`, OSC payloads, etc.) into
a buffer cell. That drifts columns by the escape-body length and
produces user-reported corruption like `526sOPEN` instead of
`526 OPEN` when shell tools (`gh`, `git` with color forced on, PTY
runs) emit ANSI in stdout.
Two changes:
- Default OSC 8 emission off on every platform until it can be emitted
out-of-band of the ratatui buffer pipeline. macOS users with a
conformant terminal can still opt in via `[ui] osc8_links = true`.
- Add `osc8::strip_ansi_into` (handles CSI, OSC, DCS/SOS/PM/APC, and
standalone two-byte ESC) and apply it in `output_rows` so shell
tool output is sanitized before it enters the transcript. Raw bytes
remain available to spillover and the model.
Tests cover SGR stripping, OSC 8 wrappers, control-byte handling, and
preservation of `\n` / `\r` / `\t`.
Thread the /goal objective from the TUI into engine prompt assembly so follow-up turns can see the current session objective. Add prompt and engine regression tests that pin the session_goal block and verify empty goals are skipped.
Same root cause as the RLM gap fixed in the previous commit
(child-token usage falling through the cracks), but for engine-
internal background calls — compaction summaries, seam recompaction,
and cycle briefings. They use `flash_client.create_message` directly
to avoid bloating the engine event channel and never feed
`response.usage` into `App::accrue_session_cost`. A long session
that fired auto-compaction or cycle-restart under-reported cost by
however many tokens those calls consumed.
5 leak sites fixed in this commit:
- `compaction.rs:894` (auto-compaction summary)
- `seam_manager.rs:330,425,518` (3 seam recompaction paths)
- `cycle_manager.rs:384` (cycle briefing turn)
Why a side-channel and not a plumbed callback: the leaky callers
are engine-internal helpers without a direct handle to `App` or
the engine's event channel. A side-channel (`cost_status::report` /
`drain`, mirroring `retry_status`) keeps the change surface tiny —
one new `report` line per call site — and any future background
caller (summarizers, retrieval helpers) gets accrued for free.
Mechanism:
- New `cost_status` module: `OnceLock<Mutex<f64>>` backed pool;
`report(model, &usage)` adds via `pricing::calculate_turn_cost_from_usage`,
`drain()` reads-and-zeros.
- TUI render loop drains once per tick (in the same idle-tick spot
as `tick_quit_armed`) and folds the result into
`App::accrue_subagent_cost` so the high-water mark stays monotonic.
- Three unit tests pin the contract: report accumulates, drain
zeros, unknown models are no-ops.
CLI one-shot leakers (`run_review`, `run_one_shot`,
`run_one_shot_json`, doctor health probe) intentionally NOT
patched — they don't run inside an interactive session, so they
don't affect the dashboard. They could be added later for parity
with `deepseek doctor --json` cost-reporting, but that's separate.
Combined with the prior `tool_routing::accrue_child_token_cost_if_any`
fix for `rlm`, this closes every TUI-internal cost-tracking gap I
could find. The dashboard should now match DeepSeek website billing
within the usual rounding (cache-hit vs miss heuristics aside).
Verified
========
- `cargo fmt --all -- --check`
- `cargo clippy --workspace --all-targets --all-features --locked -- -D warnings`
- `cargo test --workspace --all-features --locked`
- 3 new tests for the cost_status module pass.
Three foreground-visible v0.8.8 regressions surfaced after the
GitHub Release went up. v0.8.8 was taken back down (release
deleted, tag deleted) so this lands cleanly on a re-tag.
1. Worked-chip claimed model work that never happened
=====================================================
`footer_worked_chip` read `App::session_started_at.elapsed()`, so a
TUI that had been open and idle for 4 minutes rendered "worked 4m"
even though no turn had ever fired. The label literally says
"worked" — it should track real model work, not idle uptime.
Fix:
- Add `App::cumulative_turn_duration: Duration`, init to zero.
- Increment on `EngineEvent::TurnComplete` from the just-finished
turn's elapsed time (the same value already captured for the
desktop-notification path).
- Drop the now-unused `session_started_at` field.
- `FooterProps::from_app` reads `cumulative_turn_duration`. The
60s threshold inside `footer_worked_chip` stays — it now means
"60s of real model work," not "60s since launch."
New regression test pins the invariant: idle app with zero
cumulative turn time → empty chip; 90s of real work → "worked 1m 30s."
2. RLM child-token cost wasn't reaching `session_cost`
=======================================================
A user reported the dashboard showing $0.15 spent for a session
that the DeepSeek website billed at $3+. Sub-agent token usage
already feeds the parent's cost via `MailboxMessage::TokenUsage`
(#166), but the `rlm` tool spawns its own DeepSeek calls under
`child_model` and reports them only in display metadata
(`input_tokens` / `output_tokens`) that nothing consumes for
billing. A session that uses RLM heavily under-reports cost
linearly with the child token count.
Fix: define a contract — tools that spawn their own LLM calls
populate `metadata.child_input_tokens` / `child_output_tokens` /
`child_prompt_cache_hit_tokens` / `child_prompt_cache_miss_tokens`
/ `child_model`. `tool_routing::accrue_child_token_cost_if_any`
runs after every `handle_tool_call_complete`, reads those fields,
and routes the cost through `accrue_subagent_cost`. RLM's
metadata block is updated to populate the contract.
Generic on purpose — future tools that spawn LLM calls (batch
summarizers, retrieval helpers) get accrued for free.
3. OSC 8 hyperlinks corrupting Windows console rendering
========================================================
A Windows user reported the model-name strip showing
"eepseek-v4-flash" (leading `d` consumed) and three overlapping
copies of the composer panel. Likely cause: legacy `cmd.exe` and
pre-Win11 PowerShell consoles don't always honor the OSC 8 string
terminator (`ESC \`) cleanly, and v0.8.8 emitted OSC 8 by default.
Fix: default `osc8_links` to `false` on Windows targets only
(`!cfg!(windows)`). Mac/Linux still default-on. Windows users on
modern terminals (Windows Terminal, Alacritty, WezTerm) can opt
back in via `[ui] osc8_links = true`.
Doesn't address the rest of the rendering corruption — that
needs a Windows machine to reproduce — but the OSC 8 escape was
the most likely culprit and disabling it on Windows is a strict
no-op for terminals that *don't* support it.
Verified
========
- `cargo fmt --all -- --check`
- `cargo clippy --workspace --all-targets --all-features --locked
-- -D warnings`
- `cargo test --workspace --all-features --locked`
- New regression test for worked-chip pins the bug.
- Workspace `version = "0.8.8"` in root `Cargo.toml`.
- 31 internal `deepseek-*` path-dep version pins across the
9 crates that declare them.
- `npm/deepseek-tui/package.json` `version` and
`deepseekBinaryVersion` both updated.
- `Cargo.lock` regenerated for the new workspace version.
- `CHANGELOG.md` `[Unreleased]` heading promoted to
`[0.8.8] - 2026-05-03`.
`scripts/release/check-versions.sh` reports the workspace, npm
wrapper, and lockfile all aligned. Pushing this to `main` should
fire `auto-tag.yml`, which creates the `v0.8.8` tag with
`RELEASE_TAG_PAT`. The tag triggers `release.yml` to build the
matrix and draft the GitHub Release. The npm wrapper publish
remains manual (npm 2FA OTP requirement).
What ships in v0.8.8
====================
The full polish stack already merged via PRs #514 (stabilization),
#515 (OSC 8 hyperlinks), #517 (inline diff render), #518 (user
memory MVP), #519 (foreground polish + per-project overlay +
security + Windows redraw fix), and #508 (Linux ARM64 prebuilts +
install docs). See `CHANGELOG.md` and the README "What's new in
v0.8.8" section for the full list.
The previous commit gated `prune_older_than_keeps_fresh_files_drops_stale_ones`
on `#[cfg(unix)]` because the mtime-backdate helper relies on
`utimensat`, which doesn't exist on Windows. That left the
`#[cfg(not(unix))]` stub of `filetime_set_modified` with zero callers
on Windows, and `-D dead-code` (implied by `-D warnings`) refused to
compile the test binary on Windows runners.
Drop the Windows stub entirely. The `cfg(unix)` test is the only
caller; `cfg(not(unix))` builds need nothing in its place.
Restores PR #519 Windows CI to green.
CI surfaced two Windows-only failures in `tools::truncate::tests`:
1. `write_spillover_creates_directory_and_writes_file` asserted
`path.to_string_lossy().contains(".deepseek/tool_outputs")`. On
Windows the path separator is `\`, so the substring match never
matched even though the file lived in the correct directory.
Replace with a `path.components()` walk that checks for the two
directory names individually — passes on Windows, Linux, and macOS.
2. `prune_older_than_keeps_fresh_files_drops_stale_ones` relied on
`filetime_set_modified` to backdate a file by 30 days. The helper
is implemented with `utimensat` on Unix and is a no-op on Windows,
which means the prune step had no stale file to drop and the
`assert_eq!(pruned, 1)` always failed. The mtime invariant is
already covered by Linux + macOS in CI; gate the test on
`cfg(unix)` rather than ship a no-op Windows variant that can't
fail meaningfully.
Restores PR #519 CI to green so the v0.8.8 release can land.
Resolves the post-#514/#517/#518 conflicts:
- CHANGELOG.md: kept both polish-stack and Linux ARM64 entries under
[Unreleased]; reordered so the ARM64/install-message Changed/Docs
sections precede the Releases footer.
- config.example.toml: kept both the `instructions = [...]` example
and the `[memory]` opt-in stanza in sequence.
- crates/tui/src/config.rs: kept both `instructions_paths()` (#454)
and `memory_enabled()` (#489) on the Config impl.
- crates/tui/src/prompts.rs: extended
`system_prompt_for_mode_with_context_and_skills` to take BOTH
`instructions: Option<&[PathBuf]>` and `user_memory_block:
Option<&str>`. Section 2.5a renders instructions; 2.5b renders the
memory block — both above the skills block so KV prefix caching
still wins.
- crates/tui/src/core/engine.rs: thread both args through the two
call sites.
- crates/tui/src/prompts.rs: update the `system_prompt_for_mode_with_context`
forwarder and the test caller to pass `None` for the new arg.
- .gitignore: ignore `.claude/*.local.md` and `*.local.json` so
local ralph / Claude-Code notes can't leak into commits.
Folds in two valid suggestions from the gemini-code-assist review on #519:
- `client.rs`: collapse the duplicated `LlmError → label` match and the
`human_retry_reason` body into a single
`retry_reason_label_and_human(err) -> (&'static str, String)` helper.
- `widgets/footer.rs::retry_banner_spans`: merge the two separate
`match &props.retry` blocks into one that returns both `(label, color)`.
Behavior is unchanged; refactor is a pure DRY win.
CI surfaced the failure: `Test (ubuntu-latest)` panicked in
`is_command_available_detects_present_and_absent_binaries` with
"POSIX `sh` should be on PATH". Root cause: Ubuntu's `/bin/sh` is
`dash`, and `dash --version` exits with status 2 ("invalid option")
because dash doesn't recognize the flag. The previous helper invoked
`Command::new(name).arg("--version").output()` and treated a non-zero
exit as "missing", which incorrectly classified every `dash`-style
shell as absent. macOS happens to use bash as `sh`, which honors
`--version`, so the bug was invisible locally.
Fix: skip the probe entirely. Walk `$PATH` for an executable file
with the given name. Windows additionally probes `name + .exe` when
`name` has no extension so `gh` resolves as `gh.exe` the same way the
shell would. No behavior change on the happy path; the only change
is that present-but-`--version`-rejecting binaries (dash, busybox,
some embedded shells) are now correctly classified as available.
Restores PR #519 CI to green so the v0.8.8 release can land.
`crates/tui/src/ui.rs` exposed two `#[allow(dead_code)]` helpers
(`spinner`, `progress_bar`) that nothing in the workspace called.
The `indicatif` dep was only there to back those helpers. Delete
the module file, remove `mod ui;` from `main.rs`, and drop
`indicatif` from the TUI crate's Cargo.toml.
Cargo.lock loses 4 crates (`indicatif`, `console`, `encode_unicode`,
`unit-prefix`), trimming compile time and binary size. Note that the
real TUI rendering module lives at `crates/tui/src/tui/ui.rs` and is
unaffected — the deleted file was a separate module that hadn't
been wired into anything.
User feedback (Windows 10 PowerShell + WSL, Telegram thread): typing
through `/skill` feels visibly laggy because every keystroke shrinks
the matched-entry list, which shrinks the composer panel, which
forces the chat area above to repaint cells. On Unix terminals the
work is invisible; on the Windows console backend the per-cell write
cost makes it noticeable.
Fix: when the slash- or mention-menu is open, `desired_height`
reserves the panel's worst-case envelope (`composer_max_height`) for
the whole menu session instead of tracking the matched-entry count.
The chat-area Rect stays stable, so ratatui's diff renderer skips
the cells above the composer entirely. The menu itself still renders
only the entries that actually match — extra rows are panel padding
inside the same Rect.
`render()` and `cursor_pos` route through the same locked-budget
calculation so the input stays at the top of the panel and the
cursor lands on the row the input is drawn on. New unit test pins
the invariant: 5-match and 1-match menus produce the same composer
height; closing the menu releases the reserved rows.
The `// === Backward Compatibility - Sync API (Legacy) ===` block in
`mcp.rs` was tagged `TODO(integrate): Wire legacy sync API into CLI
subcommands or remove` and had zero callers — the actual CLI flows
went through the async `add_server_config` / `remove_server_config`
helpers months ago. Delete the unused structs (`McpServerInput`,
`LegacyMcpServer`, `LegacyMcpConfig`), pub fns (`list`, `add`,
`remove`, `call_tool`), private helpers (`load_legacy`,
`save_legacy`, `parse_env`, `send_request_sync`,
`read_response_with_timeout`, `read_response_sync`, `next_id`), and
the unix-only test that only exercised the dead timeout helper.
Module doc loses the "backward compatibility with existing sync
API" bullet. `std::io::{BufRead, BufReader, Write}`,
`std::process::{Command, Stdio}`, `std::sync::{Arc, Mutex}`, and
`std::time::{SystemTime, UNIX_EPOCH}` are no longer needed at the
top level (the async path uses the tokio versions and only
`Duration` from `std::time`).
`normalize_command` now strips heredoc bodies before shlex tokenization
so a user's `auto_allow = ["cat > file.txt"]` pattern matches the
heredoc form `cat <<EOF > file.txt\nbody\nEOF` cleanly. Recognises the
common forms (`<<DELIM`, `<<-DELIM`, `<<'DELIM'`, `<<"DELIM"`) while
leaving the here-string operator (`<<<`) untouched.
Six unit tests cover: simple body strip, dash form, quoted delimiter,
non-heredoc passthrough, here-string preservation, and the end-to-end
pattern-match path.
Corporate users behind TLS-inspecting proxies (Zscaler, Netskope,
Palo Alto, in-house mitmproxy fleets) need to add the proxy's
intermediate CA to the trusted-roots set so the deepseek client
doesn't fail with `unable to get local issuer certificate`.
The reqwest builder already trusts the platform's system store
via native-tls. This adds opt-in support for the conventional
`SSL_CERT_FILE` env var so users can point at their own bundle:
* New `add_extra_root_certs(builder, path)` helper reads the
file, tries `Certificate::from_pem_bundle` (covers single-cert
files too), falls back to `from_der` for binary cert files.
* Wired into `build_http_client` when `SSL_CERT_FILE` is set
and non-empty. Failures log a warning via the existing
`logging::warn` channel and return the builder unchanged —
the existing system trust still applies, so a malformed env
var degrades gracefully instead of bricking the launch.
* Each successful load logs `info` with the cert count so
operators can confirm their bundle was picked up.
Documented in `docs/CONFIGURATION.md`'s environment-variables
list alongside the existing TLS-related notes.
No new dependency — reqwest's `native-tls` feature already
exposes `Certificate::from_pem_bundle` / `from_der`.
Continues #417 by closing the value-level escalation case for
the two pure-loosening values:
* `approval_policy = "auto"` would auto-approve every tool
call that the user's stricter setting (\`suggest\`, \`never\`,
etc.) was prompting on. Pure escalation; project should
never be able to set this.
* `sandbox_mode = "danger-full-access"` exits the workspace
sandbox entirely. Pure escalation; project should never be
able to set this.
Both denies are unconditional at project scope — the user's
prior value (or absence) doesn't matter. The denied value
emits a stderr warning so users see the deny.
Sub-tightening comparisons (e.g. user `"never"` → project
`"on-request"` is allowed even though it loosens) stay
v0.8.9 follow-up because they need a richer ordering check
across all `approval_policy` / `sandbox_mode` values.
Tests:
* `project_overlay_denies_approval_auto_and_sandbox_danger_values`
exercises both escalation values in the same merge and
confirms a non-escalation field on the same project file
still applies.
* `project_overlay_preserves_user_strict_value_when_project_tries_to_loosen`
exercises the belt-and-suspenders case: user has
`approval_policy = "never"`, project tries `"auto"`, the
user's strict value survives.
A malicious `<workspace>/.deepseek/config.toml` could escalate
privileges via the per-project overlay shipped in #485:
* `api_key` / `base_url` / `provider` — exfiltrate prompts to
an attacker-controlled endpoint by swapping the user's
credentials and target host.
* `mcp_config_path` — point the MCP loader at a config that
spawns arbitrary stdio servers under the user's identity.
Adds a `DENY_AT_PROJECT_SCOPE` allowlist-by-omission to
`merge_project_config`. The four credential / redirect keys
are silently dropped from the overlay; a stderr warning fires
when one is present so a user who *did* expect the override
sees the deny instead of a silent discard:
warning: project-scope config key `api_key` is ignored —
set it in `~/.deepseek/config.toml` instead.
The remaining override surface (model, approval_policy,
sandbox_mode, notes_path, reasoning_effort, max_subagents,
allow_shell, instructions array) is unchanged. Note that this
slice does NOT yet block escalation via value comparison — a
project setting `approval_policy = "auto"` still wins over a
user's stricter `"never"`. That richer check is filed as a
v0.8.9 follow-up.
Tests:
* `project_overlay_overrides_model_but_denies_provider`
replaces the previous test that asserted provider WOULD
override (now reversed).
* New `project_overlay_denies_dangerous_credentials_and_redirects`
models the attacker scenario directly: project sets all four
denied keys, asserts the user's pre-existing values survive
and the project's are discarded.
CHANGELOG documents the deny-list rationale and lists which
fields remain overridable.
`apply_spillover` has a defensive branch that handles a tool
whose `result.metadata` is something other than a JSON object
(rare — most use the `json!({})` pattern — but legal per
`serde_json::Value`). The branch wraps the prior payload under
a `_prior` key so callers that introspect can recover the
original data, then attaches `spillover_path` to the new
object.
That branch had no test coverage. Adds
`apply_spillover_wraps_non_object_metadata_under_prior_key`
which:
* Constructs a `ToolResult` with array-shaped metadata
(`json!(["unexpected", "array", "payload"])`).
* Triggers spillover with a 200 KiB body.
* Asserts the prior array round-trips under `_prior`.
* Asserts `spillover_path` lands alongside.
Pure additive coverage; no production change. Defends the
recovery path against a future refactor that might assume
metadata is always an object.
The CI runs `cargo doc --workspace --no-deps` with
`RUSTDOCFLAGS=-Dwarnings`. Two doc-comment links broke the
build:
* `commands/session.rs::prune` referenced
`[\`SessionManager::prune_sessions_older_than\`]` which
rustdoc tries to resolve as an item in scope. Without
importing `SessionManager` into the doc-comment scope, the
link was unresolvable. Fix by qualifying with the full
module path: `[\`crate::session_manager::SessionManager::…\`]`.
* `config.rs::max_subagents` had a free-form `[subagents]`
reference that rustdoc parsed as an intra-doc link. Wrap it
in backticks so it renders as inline code instead.
No code change. Pure rustdoc hygiene; CI gate passes again.
After popping, the user wants to know whether to keep popping
or move on. Currently the message just shows the restored
preview — silent on stash depth. Adds a parenthetical:
Restored stashed draft: <preview> (3 more parked)
Restored stashed draft: <preview> (1 more parked)
Restored stashed draft: <preview> (stash now empty)
Mirrors the queue-edit confirmation pattern so users get
consistent depth feedback whether they're popping a draft or
editing a queued message.
The #487 fix relies on `save_offline_queue_state` correctly
stamping the session id so the load path's mismatch check has
something to compare against. The existing
`test_offline_queue_round_trip_and_clear` covers
serialization + clear but doesn't pin the session_id stamping
behavior.
Adds `test_offline_queue_stamps_session_id_on_save` which
exercises three cases:
* `save(state, Some("session-A"))` → loaded session_id is
`Some("session-A")`. The stamp made it to disk.
* `save(state, Some("session-B"))` → re-saving replaces the
stamp; loaded session_id is `Some("session-B")`. No stale
ID lingers.
* `save(state, None)` → loaded session_id is `None`. The UI's
load path treats this as legacy-unscoped and refuses to
restore (fail-closed), which is what protects users from
pre-#487 queues leaking into new chats.
Pure additive coverage. The 2 existing offline-queue tests
pass unchanged.
Replaces the legacy compaction template with the spec'd
Goal / Constraints / Progress (Done / In Progress / Blocked) /
Key Decisions / Next step structure.
The richer Progress sub-bullets help long resumed sessions
distinguish "what's verified done" from "what's mid-flight" —
useful when the model writes `.deepseek/handoff.md` before a
long break. The previous Active-task / Files-touched /
Key-decisions / Open-blockers / Next-step framing collapsed
"in progress" and "blocked" into a single "open blockers"
heading, which lost the lineage of "I started X, hit Y,
then…" trails.
Backwards compat: existing `.deepseek/handoff.md` files
continue to render fine because the loader
(`prompts.rs::load_handoff_block`) injects them as plain
markdown — the template only guides what NEW handoffs look
like.
The "pinned-tool-output configurability" half of #429's spec
remains a v0.8.9 follow-up because it requires changes to
`cycle_manager.rs` compaction logic itself; the template
restructure is independently shippable and is the bigger UX
delta in practice.
Tests: existing `compact_template_is_included_in_full_prompt`
updated to assert the new section headings and the nested
Progress sub-bullets. All 24 prompt tests pass.
Hook failures were silent — the executor returned a `HookResult`
with `success=false`, but every call site discards it with
`let _ = ...`. Operators tailing `deepseek` had no visibility
into hook errors short of running each hook command by hand.
Centralizes the logging inside `HookExecutor::execute` so every
fire site benefits without sprinkling instrumentation. Logs
through `tracing::warn!` with structured fields (`hook`,
`event`, `exit_code`, `duration_ms`, `error`, `stderr_head`)
so operators can `RUST_LOG=warn deepseek` and immediately see
which hooks are misbehaving.
Successful runs log nothing — `tool_call_before` /
`tool_call_after` fire on every tool dispatch, so per-call
success logging would be unreadably noisy.
No behavioral change for users with no hooks (the function
fast-paths out before reaching this branch). No behavioral
change for users with passing hooks. Failed hooks still
respect `continue_on_error` and the surrounding loop is
unchanged.
Hunter Bown