Merge updated DeepSeek onboarding base

# Conflicts:
#	.agents/notes/implemented/feature/2026-07-30-deepseek-onboarding-credential-setup.i18n.yaml
#	.agents/notes/implemented/feature/2026-07-30-deepseek-onboarding-credential-setup.md
#	.agents/notes/implemented/feature/2026-07-30-deepseek-onboarding-credential-setup.zh.md
#	packages/client/ui-models/README.i18n.yaml
#	packages/client/ui-models/README.md
#	packages/client/ui-models/README.zh.md
#	packages/client/ui-models/src/client/DeepSeekOnboardingDialog.module.css
#	packages/client/ui-models/src/client/DeepSeekOnboardingDialog.tsx
#	packages/client/ui-models/tests/onboarding-dialog.spec.tsx

apps/web/tests/approval-composer.e2e.ts

@@ -0,0 +1,181 @@
+// Web e2e scenario: the composer-takeover approval panel under a long
+// command. The shipped composition confines bash through the sandbox policy
+// and routes its escalation through the approval seam, so a read-only session
+// asked to write a file produces a REAL pending approval — the panel renders
+// in the browser, the test measures its geometry, answers through it, and the
+// escalated command then runs. Replay is deterministic: the denial, the
+// escalation retry and its command text arrive from replayed chunks, and the
+// answer click is the test's own gesture (the same sanctioned reaction to
+// model content as the question composer: the turn cannot complete without it).
+//
+// Geometry is the point of the scenario. The command is unbounded model text,
+// and before the cap a long one grew the card until the refuse/allow buttons
+// left the viewport — an approval the user could see and not answer.
+import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+import type { Browser, Page } from 'playwright'
+import { chromium } from 'playwright'
+import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
+import type { SessionEvent } from '@deepseek-ai/dsh-session'
+// Empty type import: carries the approval package's session-event merge, so
+// the decided-outcome assertion below type-checks against the real union.
+import type {} from '@deepseek-ai/dsh-user-approval'
+import {
+  assertFixtureInventory, captureStableAria, compareOrRefreshGolden, fixtureUserPrompts,
+  launchWebScaffold, recordFixture, watchConsole, webSnapshotMode, type WebScaffold,
+} from './scaffold.ts'
+import { connectFreshWorkspace, newEnglishPage, saveFailureShot } from './support.ts'
+
+const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/approval-composer', import.meta.url))
+const FIXTURE = join(SNAPSHOT_DIR, 'session.jsonl')
+// The scenario's one golden: the waiting panel. Everything the answered state
+// proves is asserted directly — see the world-state block at the end.
+const UI_EXPECTED = join(SNAPSHOT_DIR, 'ui.expected.md')
+const MODE = webSnapshotMode()
+
+// Irreducible payload: the command has to be long enough to pass the card's
+// height cap, which is the only shape that reproduces an action row pushed off
+// screen. Unrelated tokens, not a repeated word — a repeated word is what the
+// model compressed into `printf 'alpha %.0s' {1..400}` while recording, and a
+// short command proves nothing here. The formula keeps the source small; the
+// model receives the expanded literal it has to put in the command.
+const TOKENS = Array.from({ length: 220 }, (_, index) => `tok${((index + 1) * 7919 % 99991).toString(36)}`).join(' ')
+const PROMPT = `Write a file named notes.txt in the workspace containing exactly this text on one line: ${TOKENS}. Use one bash command with the literal text inline. Then reply with the single word DONE and stop.`
+
+/** Draft used to measure the composer's own text cap: enough lines to pass it. */
+const CAP_PROBE = Array.from({ length: 40 }, (_, index) => `line ${index}`).join('\n')
+
+describe('web e2e: approval takeover keeps its actions reachable', () => {
+  let scaffold: WebScaffold
+  let browser: Browser
+  let page: Page
+  let tripwire: ReturnType<typeof watchConsole>
+  const sessionEvents: SessionEvent[] = []
+
+  beforeAll(async () => {
+    scaffold = await launchWebScaffold(MODE === 'record' ? {} : { replayFixture: FIXTURE, paceMs: 15 })
+    scaffold.ctx.on('session/event', (_session, event: SessionEvent) => { sessionEvents.push(event) })
+    browser = await chromium.launch()
+    page = await newEnglishPage(browser)
+    tripwire = watchConsole(page)
+    await page.goto(scaffold.baseUrl, { waitUntil: 'load' })
+    await page.waitForSelector('[class*="frame"]', { timeout: 30_000 })
+    await connectFreshWorkspace(page)
+  }, 120_000)
+
+  afterAll(async () => {
+    await browser?.close()
+    await scaffold?.close()
+  })
+
+  it('caps the long command, answers through the panel, and runs the escalated command', async () => {
+    onTestFailed(() => saveFailureShot(page, 'web-e2e-approval'))
+    if (MODE !== 'record') {
+      expect(fixtureUserPrompts(await readFile(FIXTURE, 'utf8'))).toEqual([PROMPT])
+    }
+    const input = page.locator('textarea').first()
+    await input.waitFor({ timeout: 10_000 })
+
+    // The composer's own text cap, measured on the live textarea before the
+    // takeover replaces it. The panel's scroll region must stop at the same
+    // height (the designer's requirement: one cap for the composer seat), and
+    // measuring it here keeps the assertion free of the px value itself.
+    await input.fill(CAP_PROBE)
+    const composerCap = await input.evaluate(el => el.clientHeight)
+    expect(composerCap).toBeGreaterThan(0)
+    await input.fill('')
+
+    // Read-only: the mode whose denial the model escalates from. Switched
+    // through the shipped access-mode chip, not a test-only seam.
+    await page.locator('[aria-label^="Access mode"]').click()
+    await page.getByRole('menuitem', { name: 'Read Only' }).click()
+    await expect.poll(
+      () => page.locator('[aria-label="Access mode, current: Read Only"]').count(),
+      { timeout: 15_000 },
+    ).toBe(1)
+
+    const settled = scaffold.whenTurnSettled(MODE === 'record' ? 240_000 : 60_000)
+    await input.fill(PROMPT)
+    await input.press('Enter')
+
+    // The panel takes over the input area while the tool blocks. Its presence
+    // is a STABLE waiting state (it stays until answered), so waitFor is
+    // race-free.
+    const panel = page.locator('[data-approval-key]')
+    await panel.waitFor({ timeout: MODE === 'record' ? 180_000 : 60_000 })
+    const scroll = panel.locator('[data-approval-scroll]')
+    await expect.poll(() => scroll.getByText(/tok/).count(), { timeout: 15_000 }).toBeGreaterThan(0)
+
+    if (MODE !== 'record') {
+      // This golden owns the stable waiting surface; the answered golden below
+      // owns the resulting transcript.
+      const snapshot = await captureStableAria(page, '[data-approval-key]', scaffold.workspaceCwd)
+      await compareOrRefreshGolden(UI_EXPECTED, snapshot, MODE)
+
+      // The regression this scenario exists for: an uncapped card grew with
+      // the command until the action row left the viewport. Measured at the
+      // lane baseline and at a short viewport, on the live panel.
+      const original = page.viewportSize() ?? { width: 1680, height: 1000 }
+      for (const height of [1000, 700]) {
+        await page.setViewportSize({ width: 900, height })
+        const geometry = await panel.evaluate((root) => {
+          const region = root.querySelector<HTMLElement>('[data-approval-scroll]')
+          const card = region?.parentElement ?? null
+          // Role/text, not the CSS-module class names: the built client hashes those.
+          const buttons = [...root.querySelectorAll<HTMLElement>('button')]
+          const rows = buttons.map(button => button.getBoundingClientRect())
+          return {
+            buttons: buttons.length,
+            capped: region === null ? 0 : region.clientHeight,
+            // A scrolling region proves the cap is genuinely engaged; without
+            // it every assertion below would hold vacuously.
+            scrolls: region === null ? false : region.scrollHeight > region.clientHeight,
+            cardBottom: card === null ? Number.NaN : card.getBoundingClientRect().bottom,
+            actionsTop: Math.min(...rows.map(rect => rect.top)),
+            actionsBottom: Math.max(...rows.map(rect => rect.bottom)),
+            viewport: window.innerHeight,
+          }
+        })
+        expect(geometry.buttons).toBe(2)
+        expect(geometry.scrolls).toBe(true)
+        // One cap for the seat: the panel's text region stops where the
+        // composer draft does (sub-pixel tolerance for the shared padding).
+        expect(Math.abs(geometry.capped - composerCap)).toBeLessThan(1)
+        // Both buttons stay inside the card AND inside the viewport — the
+        // answerable state the cap exists to guarantee.
+        expect(geometry.actionsTop).toBeGreaterThan(0)
+        expect(geometry.actionsBottom).toBeLessThanOrEqual(geometry.viewport)
+        expect(geometry.actionsBottom).toBeLessThanOrEqual(geometry.cardBottom)
+      }
+      await page.setViewportSize(original)
+    }
+
+    await panel.getByRole('button', { name: '允许一次' }).click()
+
+    const sessionId = await settled
+    if (MODE === 'record') {
+      await recordFixture(scaffold, sessionId, FIXTURE)
+      return
+    }
+    // World state: the granted escalation is what let the command run, and the
+    // panel leaves with the regular composer restored. Asserted on the world
+    // and the DOM rather than through a transcript golden — the denied first
+    // attempt renders the OS's own refusal ("Operation not permitted" on
+    // macOS, "Read-only file system" on Linux), so the answered transcript is
+    // not a platform-neutral golden surface.
+    expect(JSON.stringify(sessionEvents.filter(e => e.type === 'approval/decided').at(-1)))
+      .toContain('allowed-once')
+    const written = await readFile(join(scaffold.workspaceCwd, 'workspace', 'notes.txt'), 'utf8')
+    expect(written).toContain(TOKENS.slice(0, 64))
+    await expect.poll(() => page.getByText('DONE', { exact: true }).count(), { timeout: 20_000 }).toBeGreaterThanOrEqual(1)
+    expect(await page.locator('[data-approval-key]').count()).toBe(0)
+    await expect.poll(() => page.locator('textarea').first().isEnabled(), { timeout: 10_000 }).toBe(true)
+    expect(tripwire.pageErrors).toEqual([])
+    expect(tripwire.warnings).toEqual([])
+  }, 300_000)
+
+  it.skipIf(MODE === 'record')('keeps the fixture inventory closed', async () => {
+    await assertFixtureInventory(SNAPSHOT_DIR, ['session.jsonl', 'ui.expected.md'])
+  })
+})

apps/web/tests/details-session-lifecycle.e2e.ts

@@ -3,15 +3,19 @@
 // unselected states, and closes it only when a different Session takes ownership.
 import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
 import type { Browser, Page } from 'playwright'
 import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
 import {
-  acknowledgeReloadConnectionLoss, fixtureUserPrompts, launchWebScaffold, seedSession, watchConsole,
-  webSnapshotMode, type WebScaffold,
+  acknowledgeReloadConnectionLoss, assertFixtureInventory, compareOrRefreshGolden,
+  fixtureUserPrompts, launchWebScaffold, seedSession, watchConsole, webSnapshotMode,
+  type WebScaffold,
 } from './scaffold.ts'
 import { connectFreshWorkspace, newEnglishPage, saveFailureShot } from './support.ts'
 
+const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/details-session-lifecycle', import.meta.url))
+const HANDLES_EXPECTED = join(SNAPSHOT_DIR, 'handles.expected.md')
 const FIXTURE = fileURLToPath(new URL('./snapshots/lifecycle-chrome/session.jsonl', import.meta.url))
 const SEED_FIXTURE = fileURLToPath(new URL('./snapshots/seeded-history/seed.jsonl', import.meta.url))
 const PROMPT = 'Reply with the single word LIGHTHOUSE and stop.'
@@ -25,11 +29,41 @@ async function detailsTrack(page: Page): Promise<number> {
   })
 }
 
+/** First AppFrame grid track in CSS pixels. */
+async function sidebarTrack(page: Page): Promise<number> {
+  return await appFrame(page).evaluate((element) => {
+    const tracks = getComputedStyle(element).gridTemplateColumns.split(' ')
+    return Number.parseFloat(tracks[0] ?? 'NaN')
+  })
+}
+
 /** AppFrame is the only product element with an inline grid track template. */
 function appFrame(page: Page) {
   return page.locator('[style*="grid-template-columns"]').first()
 }
 
+/** Render the two boundary affordances without platform-dependent coordinates. */
+async function handleSnapshot(page: Page): Promise<string> {
+  const handles = await page.locator('[class*="handle"]').evaluateAll(elements =>
+    elements.map(element => ({
+      side: element.getAttribute('data-side'),
+      cursor: getComputedStyle(element).cursor,
+      pillGenerated: getComputedStyle(element, '::after').content !== 'none',
+    })))
+  return [
+    '# AppFrame drag handles',
+    '',
+    ...handles.flatMap(handle => [
+      `## ${handle.side}`,
+      '',
+      '- hit strip present: true',
+      `- cursor: ${handle.cursor}`,
+      `- pill generated: ${String(handle.pillGenerated)}`,
+      '',
+    ]),
+  ].join('\n').trimEnd()
+}
+
 describe.skipIf(MODE === 'record')('web e2e: details panel follows the current Session lifecycle', () => {
   let scaffold: WebScaffold
   let browser: Browser
@@ -65,6 +99,18 @@ describe.skipIf(MODE === 'record')('web e2e: details panel follows the current S
 
     await expect.poll(() => detailsTrack(page), { timeout: 5_000 }).toBe(0)
     expect(await page.getByText('详情', { exact: true }).isVisible()).toBe(false)
+    await compareOrRefreshGolden(HANDLES_EXPECTED, await handleSnapshot(page), MODE)
+
+    const sidebarBefore = await sidebarTrack(page)
+    const sidebarHandle = page.locator('[data-side="sidebar"]')
+    const sidebarBox = await sidebarHandle.boundingBox()
+    expect(sidebarBox).not.toBeNull()
+    const dragStartX = sidebarBox!.x + sidebarBox!.width / 2
+    await page.mouse.move(dragStartX, sidebarBox!.y + 200)
+    await page.mouse.down()
+    await page.mouse.move(dragStartX + 70, sidebarBox!.y + 200, { steps: 6 })
+    await page.mouse.up()
+    await expect.poll(() => sidebarTrack(page), { timeout: 5_000 }).toBe(sidebarBefore + 70)
 
     const warningStart = tripwire.warnings.length
     await page.reload({ waitUntil: 'load' })
@@ -101,5 +147,6 @@ describe.skipIf(MODE === 'record')('web e2e: details panel follows the current S
     await expect.poll(() => detailsTrack(page), { timeout: 5_000 }).toBe(0)
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['handles.expected.md'])
   }, 90_000)
 })

apps/web/tests/seeded-history.e2e.ts

@@ -3,7 +3,9 @@
 // else covers: sidebar cold listing, the implicit resume/attach inside the
 // history RPC, history-page tool views, and the client fold of historical
 // events — with ZERO model calls in replay (no replay fixture; a stray stream
-// fails loud on the open llm seam). The seed is a recorded fixture under the
+// fails loud on the open llm seam). The cold session also carries the one
+// keyless command-row surface: an Access-chip pick runs `/permission` on the
+// host, so the settled row's copy has a golden here. The seed is a recorded fixture under the
 // same record discipline as every other: DSH_SNAPSHOT=record drives the turn
 // live through the composer (real read tool against seeded workspace files)
 // and harvests seed.jsonl; replay/refresh seed it cold and only render.
@@ -24,6 +26,9 @@ import { newEnglishPage, saveFailureShot } from './support.ts'
 const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/seeded-history', import.meta.url))
 const SEED = fileURLToPath(new URL('./snapshots/seeded-history/seed.jsonl', import.meta.url))
 const UI_EXPECTED = fileURLToPath(new URL('./snapshots/seeded-history/ui.expected.md', import.meta.url))
+// The command-row golden: the same conversation after one /permission switch,
+// which is the only surface that shows a settled command row's copy.
+const COMMAND_ROW_EXPECTED = fileURLToPath(new URL('./snapshots/seeded-history/command-row.expected.md', import.meta.url))
 const MODE = webSnapshotMode()
 const SEED_ID = 'seeded-history-web-e2e'
 
@@ -225,11 +230,33 @@ describe('web e2e: seeded history renders through cold resume', () => {
     await expect.poll(() => page.getByText('a.txt', { exact: false }).count(), { timeout: 5_000 }).toBeGreaterThan(0)
   })
 
+  it.skipIf(MODE === 'record')('an Access-chip switch lands one command row: bare name, non-repeating settlement text', async () => {
+    onTestFailed(() => saveFailureShot(page, 'web-e2e-seeded-command-row'))
+    // The Access chip submits `/permission <preset>` — a host command with no
+    // model call, so the settled row renders keylessly over this cold history.
+    // The row copy is the assertion: `permission · preset workspace-write`,
+    // where neither half repeats the other (the dispatched `/` and its
+    // argument stay out of the title, and the settlement text never restates
+    // the command's own name).
+    await page.getByRole('button', { name: 'Access mode, current: Danger Full Access' }).click()
+    await page.getByRole('menuitem', { name: 'Workspace Write' }).click()
+    await page.getByRole('button', { name: 'Access mode, current: Workspace Write' }).waitFor({ timeout: 10_000 })
+    // Scoped to the row itself, so unrelated page text that happens to read
+    // `permission` (a future resident slash menu) cannot satisfy or break it.
+    const row = page.locator('[data-variant="others"]').filter({ hasText: 'preset workspace-write' })
+    await expect.poll(() => row.count(), { timeout: 10_000 }).toBe(1)
+    expect(await row.getByText('permission', { exact: true }).count()).toBe(1)
+    expect(await row.getByText('/permission workspace-write', { exact: true }).count()).toBe(0)
+    const snapshot = (await captureStableAria(page, '[class*="centerCol"]', scaffold.workspaceCwd))
+      .split(SEED_ID).join('{{seededId}}')
+    await compareOrRefreshGolden(COMMAND_ROW_EXPECTED, snapshot, MODE)
+  }, 60_000)
+
   it.skipIf(MODE === 'record')('issued zero model calls and stayed clean', async () => {
     // No replay fixture was installed and the llm seam is open — any stray
     // stream would have failed the turn loudly. Cleanliness pins the wire.
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
-    await assertFixtureInventory(SNAPSHOT_DIR, ['seed.jsonl', 'ui.expected.md'])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['command-row.expected.md', 'seed.jsonl', 'ui.expected.md'])
   })
 })

apps/web/tests/snapshots/approval-composer/ui.expected.md

@@ -0,0 +1,4 @@
+- text: 等待审批
+- group "审批详情": "escalate sandbox to workspace-write: Need to write the notes.txt file as requested by the user. echo 'tok63z tokc7y tokibx tokofw tokujv tok10nu tok16rt tok1cvs tok1izr tok1p3q tok1v7p tok21bo tok2a4 tok8e3 tokei2 tokkm1 tokqq0 tokwtz tok12xy tok191x tok1f5w tok1l9v tok1rdu tok1xht tok23ls tok4k8 tokao7 tokgs6 tokmw5 tokt04 tokz43 tok1582 tok1bc1 tok1hg0 tok1njz tok1tny tok1zrx tokqd tok6uc tokcyb tokj2a tokp69 tokva8 tok11e7 tok17i6 tok1dm5 tok1jq4 tok1pu3 tok1vy2 tok2221 tok30h tok94g tokf8f toklce tokrgd tokxkc tok13ob tok19sa tok1fw9 tok1m08 tok1s47 tok1y86 tok24c5 tok5al tokbek tokhij toknmi toktqh tokzug tok15yf tok1c2e tok1i6d tok1oac tok1ueb tok20ia tok1gq tok7kp tokdoo tokjsn tokpwm tokw0l tok124k tok188j tok1eci tok1kgh tok1qkg tok1wof tok22se tok3qu tok9ut tokfys tokm2r toks6q tokyap tok14eo tok1ain tok1gmm tok1mql tok1suk tok1yyj tok252i tok60y tokc4x toki8w tokocv tokugu tok10kt tok16os tok1csr tok1iwq tok1p0p tok1v4o tok218n tok273 tok8b2 tokef1 tokkj0 tokqmz tokwqy tok12ux tok18yw tok1f2v tok1l6u tok1rat tok1xes tok23ir tok4h7 tokal6 tokgp5 tokmt4 toksx3 tokz12 tok1551 tok1b90 tok1hcz tok1ngy tok1tkx tok1zow toknc tok6rb tokcva tokiz9 tokp38 tokv77 tok11b6 tok17f5 tok1dj4 tok1jn3 tok1pr2 tok1vv1 tok21z0 tok2xg tok91f tokf5e tokl9d tokrdc tokxhb tok13la tok19p9 tok1ft8 tok1lx7 tok1s16 tok1y55 tok2494 tok57k tokbbj tokhfi toknjh tokktng tokzrf tok15ve tok1bzd tok1i3c tok1o7b tok1uba tok20f9 tok1dp tok7ho tokdln tokjpm tokptl tokvxk tok121j tok185i tok1e9h tok1kdg tok1qhf tok1wle tok22pd tok3nt tok9rs tokfvr toklzq toks3p toky7o tok14bn tok1afm tok1gjl tok1mnk tok1srj tok1yvi tok24zh tok5xx tokc1w toki5v toko9u tokudt tok10hs tok16lr tok1cpq tok1itp tok1oxo tok1v1n tok215m tok242 tok881 tokec0 tokfz tokqjy tokwnx' > notes.txt"
+- button "拒绝"
+- button "允许一次"

apps/web/tests/snapshots/details-session-lifecycle/handles.expected.md

@@ -0,0 +1,7 @@
+# AppFrame drag handles
+
+## sidebar
+
+- hit strip present: true
+- cursor: col-resize
+- pill generated: false

apps/web/tests/snapshots/navigation-panes/trajectory.expected.md

@@ -11,7 +11,7 @@
       - cell "SYSTEM"
       - cell "Initial System Prompt"
     - 'row "USER, NavScenario: first run bash to print exactly NAVIGATION_OK, then read nav-a.md and nav-b.md using two read calls in ONE assistant message, then reply with the single word FIRST_DONE and stop."':
-      - cell "Turn 1 USER"
+      - cell "Turn 1 USER": USER
       - 'cell "NavScenario: first run bash to print exactly NAVIGATION_OK, then read nav-a.md and nav-b.md using two read calls in ONE assistant message, then reply with the single word FIRST_DONE and stop."'
     - 'row "Request 1, ASSISTANT, The user wants me to follow a specific navigation scenario. Let me: Run bash to print \"NAVIGATION_OK\" Read nav-a.md and nav-b.md in two read calls in ONE message Reply with \"FIRST_DONE\" Let me start with the bash command and the reads."':
       - 'cell "Request #1 ASSISTANT"':
@@ -33,7 +33,7 @@
         - text: ASSISTANT
       - cell "FIRST_DONE"
     - 'row "USER, Reply in markdown with: a level-2 heading \"Navigation Summary\", a bulleted list of exactly two items, and a fenced code block containing echo WATERFALL. Then stop."':
-      - cell "Turn 2 USER"
+      - cell "Turn 2 USER": USER
       - 'cell "Reply in markdown with: a level-2 heading \"Navigation Summary\", a bulleted list of exactly two items, and a fenced code block containing echo WATERFALL. Then stop."'
     - row "Request 3, ASSISTANT, Navigation Summary alpha nav beta nav echo WATERFALL":
       - 'cell "Request #3 ASSISTANT"':

apps/web/tests/snapshots/plan-review/approved.expected.md

@@ -5,7 +5,7 @@
     - tab "Chat" [selected]
     - tab "Trajectory"
 - img
-- text: "/plan Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. Plan mode on. Use /plan off to leave. Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
+- text: "plan Plan mode on. Use /plan off to leave. Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
 - button "复制":
   - img
 - button "在新对话中分支":

apps/web/tests/snapshots/seeded-history/command-row.expected.md

@@ -0,0 +1,49 @@
+- banner:
+  - navigation "Session hierarchy":
+    - button "Use the read tool twice" [disabled]
+  - tablist:
+    - tab "Chat" [selected]
+    - tab "Trajectory"
+- text: "Use the read tool twice in one assistant message: read a.txt and b.txt. Then reply with the single word DONE and stop. {{clock}}"
+- button "复制":
+  - img
+- button "在新对话中分支":
+  - img
+- button "编辑":
+  - img
+- button "Think The user wants me to read a.txt and b.txt, then reply with \"DONE\". Let me do both reads in parallel.":
+  - img
+  - img
+  - text: Think The user wants me to read a.txt and b.txt, then reply with "DONE". Let me do both reads in parallel.
+- img
+- text: Read
+- button "a.txt"
+- img
+- text: Read
+- button "b.txt"
+- button "Think Both files have been read. a.txt contains \"alpha\" and b.txt contains \"beta\". I'll now reply with DONE as instructed.":
+  - img
+  - img
+  - text: Think Both files have been read. a.txt contains "alpha" and b.txt contains "beta". I'll now reply with DONE as instructed.
+- paragraph: DONE
+- button "复制":
+  - img
+- button "在新对话中分支":
+  - img
+- text: {{clock}}
+- button "上下文注入":
+  - img
+  - img
+  - text: 上下文注入
+- img
+- text: permission preset workspace-write
+- textbox "Message the agent"
+- button "Add attachment":
+  - img
+- 'button "Access mode, current: Workspace Write"': Workspace Write
+- button "Plan mode off, press to turn on": Plan off
+- button "Select model, current deepseek-v4-flash":
+  - text: deepseek-v4-flash
+  - img
+- button "Send message" [disabled]
+- text: 1 turns · 2 steps Tool call {{duration}} Cache hit 98% Input 15.8K tok · Output 135 tok

apps/web/tsconfig.json

@@ -26,6 +26,7 @@
     "tests/scaffold-hermetic.e2e.ts",
     "tests/live-interactions.e2e.ts",
     "tests/question-composer.e2e.ts",
+    "tests/approval-composer.e2e.ts",
     "tests/plan-review.e2e.ts",
     "tests/steering.e2e.ts",
     "tests/navigation-panes.e2e.ts",